OMM Newsroom
Hackers linked to Kazakhstan stole thousands of documents related to Tajikistan’s national security, according to a report released on Wednesday, November 11, by Singapore-based cybersecurity company CloudSek. AnewZ reports that the group, known as “Silent Lynx,” also accessed Uzbekistan’s forestry management platform and prepared phishing messages targeting Turkmenistan.
The hackers gave artificial intelligence agents instructions in Russian to carry out cyber operations. They operated during Kazakhstan’s business hours and sometimes used an internet connection associated with a residential address in Kazakhstan.
Officials in Kazakhstan and Tajikistan did not immediately respond to requests for comment. AnewZ also contacted the governments of Turkmenistan and Uzbekistan. Attempts to reach “Silent Lynx” were unsuccessful.
CloudSek said it identified the hackers after they inadvertently exposed a server that was accessible via the internet.
Hackers accessed Tajikistan’s railway network
According to information obtained by CloudSek, the hackers infiltrated Tajikistan’s national railway network in mid-August and gained administrator-level access. They then used the credentials of a railway employee to access the country’s national electronic document management platform.
Access through a single account enabled the hackers to obtain numerous documents beyond the railway sector.
Thousands of the stolen documents were addressed to Tajikistan’s Ministry of Defense. They included material on airspace use, flight permit applications, military attaché appointments, foreign relations correspondence, budgets and air defense cooperation.
The hackers also obtained a smaller number of documents addressed to Tajikistan’s National Guard — a military body responsible for public security — and the State Committee for National Security, which handles counterterrorism and counterintelligence.
The stolen material also included hundreds of letters addressed to the State Investment Committee, which is responsible for investment in the country.
Uzbekistan and Turkmenistan also targeted
Other Central Asian countries were also targeted, according to the report. The hackers exploited a vulnerability in Uzbekistan’s “Smart Forestry GeoServer” platform to gain remote access.
CloudSek said phishing messages sent in the name of Turkmenistan Railways and one of Turkmenistan’s regional administrative bodies were prepared and tested in October 2026.
The discovered material included instructions the hackers gave to an artificial intelligence agent on how to present itself, operate and communicate with the hackers controlling it. The instructions told the agent: “You are an elite offensive security specialist and red team member.”
A red team member is a cybersecurity specialist who simulates covert attacks to test an organization’s systems.
