One railway login and AI helped hack thousands of Tajik military files

A railway employee’s login gave hackers access to a system used by Tajikistan’s defence ministry. The hackers then turned to an AI agent to help collect government documents, cybersecurity researchers say, according to Singapore-based cybersecurity firm CloudSEK.

In a report published on 11 November, CloudSEK attributed the theft to a group known as Silent Lynx. Researchers found more than 2,000 files sent to or through Tajikistan’s Ministry of Defence, including flight clearance requests, procurement correspondence and personnel records.

The attackers logged into Tajikistan’s national electronic document platform using a standard account of a railway employee. Lax controls on who could open individual files gave them access to correspondence well beyond the railway’s own records, CloudSEK said.

Investigators from the firm pieced together the theft after discovering a public directory on the hackers’ server. It contained stolen files and recordings of the hackers’ interactions with their AI agent.

Read more: Uzbekistan confirms data leak affecting 60,000 citizens

What the AI did

The hackers used Hermes, an open-source framework for running AI agents. DeepSeek models handled most of the recorded work. The agent helped scout systems and wrote a program to download, sort and split files into batches for transfer, CloudSEK told Reuters.

The hackers left instructions so the agent could continue collecting files on its own. It also erased some records of the operation, but CloudSEK still found the directory exposed.

Up close: OpenAI agents quietly team up for major security breach

The ‘Kazakh’ connection

Some of the connections were traced back to residential internet services in Kazakhstan, which CloudSEK assessed with medium confidence to be the country of origin, corroborating earlier findings from Cisco Talos. The report did not prove Kazakhstan’s involvement, and Kursiv Uzbekistan could not independently verify its authenticity.

Kazakh and Tajik officials did not immediately respond to requests for comment from Reuters.

CloudSEK also reported that the group hacked Uzbekistan’s Smart Forestry platform. Items resembling a Turkmen railway ticket and a regional government report suggested the hackers’ preparations to attack Turkmenistan as well.