Silent Lynx Exposed: AI Agent Logs Reveal Windows Espionage and Government Data Theft

What was exposed​

CloudSEK describes the host as a Debian VPS on Baxet Group infrastructure at 89[.]125[.]213[.]123, reachable without authentication on port 8088. It held more than a dozen gigabytes across hundreds of thousands of files. Tooling, victim data and the operator's workspace were all mixed together. The records run from April to October 2026.

The main folders were:

• fish/: the LNK phishing kit, PowerShell payload, decoy PDFs and ISO or archive bundles.
• payloads/: implant builds sorted by target country.
• Per-target folders: recon output, collectors, stolen documents and credentials.
• .c2/: a webshell wrapper and captured output from the Smart Forestry intrusion.
• .hermes/: the AI agent's state, memory, persona, scripts and logs.
• Pivot and credential state: Ligolo and NetExec data, plus public tools such as fscan, GOST, Inveigh, Responder, Impacket and public exploits.

Attribution: what is established and what is judgment​

CloudSEK attributes the server to Silent Lynx with high confidence. Its evidence is code markers and build paths shared with published samples. The strongest link is a Chvost sample, ssdpdrv.exe, which has the debug path \chvost\Release\Netdrv.pdb. It also carries a block of strings matching earlier Chvost reporting. The server also held Laplas builds whose Visual Studio project is named Laplasgeneral.

CloudSEK's Kazakhstan nexus is a medium-confidence judgment. It rests on three points:

• The operation runs in Russian.
• The operator's own test traffic came from a residential Kazakhtelecom connection.
• Every recorded login and agent message falls between 08:00 and 20:00 UTC+5 on weekdays.

CloudSEK admits the time sample covers only a few days and can't show weekend behaviour.

Cisco Talos published related research on 14 October 2026, tracking the cluster as UAT-6275 (Recorded Future calls it TAG-193). Talos reported activity from June 2025 through August 2026 across nine countries and four infection-chain types. It also assessed a Kazakhstan nexus at medium confidence. Talos cited Russian-language artifacts, malware-testing submissions from Kazakhstan and UTC+5 working hours. CloudSEK says its network-level signal points the same way as Talos's evidence. The Talos work separately described three publicly accessible staging directories, so this is not the first exposure of this cluster's infrastructure.

The Windows infection chain​

CloudSEK reconstructs the delivery chain as follows:

1. The target receives a shortcut with a PDF icon. It comes in an unencrypted ZIP, a password-protected ZIP or an ISO.
2. Opening it shows a decoy PDF from the operator's server and starts a hidden PowerShell process.
3. PowerShell downloads P.ps1 from the same server and runs it in memory.
4. The script drops a second decoy, Отчёт_2026.pdf ("Report_2026.pdf"), and opens a raw TCP shell to the operator.
5. A dispatcher script runs whoami, hostname and ipconfig on each new shell.

P.ps1 is a plain loop with no encryption or obfuscation. It reads commands from the socket and runs them with Invoke-Expression. Earlier Silent Lynx shortcut chains, such as Talos's "Chain C", fetched a script hosted on GitHub. This kit serves the script from the operator's own server instead.

The AMSI variant​

The shortcut filenames show the operator testing step by step, from Notepad and Calculator launches to the final version. One final variant sets amsiInitFailed through reflection before the download. That switches off AMSI script scanning for the session. CloudSEK says public Silent Lynx reporting does not document this variant.

The AMSI bypass only matters if the rest of the chain gets that far. The operator's payload is cleartext PowerShell fetched over HTTP on port 8080. Several layers can catch that:

• Script block logging and network egress filtering.
• Controls on shortcuts that launch PowerShell.
• Blocking ISO and archive delivery from email.

That last point is my general assessment, not CloudSEK's.

Implants and persistence​

The payloads folder holds per-target Windows builds for Tajikistan, the Tajik railway and Kyrgyzstan. Each pairs a small executable with genuine OpenSSL 3 libraries. The Kyrgyzstan set is 32-bit and the Tajik builds are 64-bit.

• Laplas (srvdriv.exe): a TLS reverse shell. CloudSEK says builds were compiled between April and September 2026, including a dedicated railway build.
• Chvost (ssdpdrv.exe): a Chvost-family shell, which is the main link to published Chvost reporting.
• Service wrappers (netsrvc.exe, CoreMessaging.exe, ssdspsrv.exe): these install the shells as Windows services under names that mimic legitimate components. CoreMessaging.exe shares the netsrvc.pdb build path, so it is a renamed netsrvc.exe. ssdspsrv.exe is an older, separate wrapper.

The wrappers' strings include "Success install service!" and "ERROR: DUPLICATE_SERVICE_NAME". Service names that imitate system components are worth hunting for. A name like CoreMessaging on a host that shouldn't have it is a lead worth chasing.

Intrusion 1: Tajikistan Railway​

CloudSEK says the operator held domain-level access from mid-August to at least 10 October 2026. The Ligolo database records a live tunnel for nearly two months. An earlier tunnel through a host named DC ran from April to May 2026, with routes into two further networks.

From that foothold the operator reportedly:

• Enumerated dozens of Windows hosts, from Windows 7 to Server 2022. Many had SMBv1 enabled and signing disabled.
• Gained administrative access on multiple servers using plaintext passwords and NTLM hashes.
• Produced several NTDS-format credential dumps that include Administrator and krbtgt.
• Copied operational reports, dispatcher summaries and internal correspondence from SMB shares.
• Harvested credentials for upstream ISP network gear (MikroTik, Cisco and D-Link) running default passwords.
• Deployed an ASP.NET webshell on a railway web server.
• Prepared Metasploit resource files for MS17-010 against an unpatched Windows Server 2008 R2 host.

None of this is exotic. SMBv1, unsigned SMB, default device passwords and an unpatched 2008 R2 box are old problems. A krbtgt dump means a full domain rebuild and a double krbtgt password reset, not a routine cleanup. That is standard incident-response practice, not something CloudSEK states.

Intrusion 2: the document management platform​

This is the largest data theft CloudSEK describes. The operator logged into Tajikistan's national electronic document management platform through the government SSO portal. It used the credentials of one railway employee with a standard user role. CloudSEK's notes say the platform had weak per-document authorisation checks and a file service that served attachments without authentication. One low-privilege account could therefore reach material far outside the railway.

The operator built collectors that ran at high concurrency, resumed after failures and posted progress to Telegram. The haul includes:

• More than 2,000 unique documents addressed to or routed through the Ministry of Defence.
• Smaller sets tagged to the National Guard and the State Committee for National Security.
• Hundreds of State Investment Committee letters.
• A directory of more than 100 government organisations.
• Passport and national ID scans for named individuals attached to delegation correspondence.

Reuters independently reported that CloudSek said the data showed the hackers using Hermes for reconnaissance from around mid-August, then breaking into Tajikistan's electronic document system a couple of weeks later. Reuters also reported that the AI agent wrote a custom program to download the files, organize them, and break them into chunks.

Intrusion 3: Uzbekistan Smart Forestry​

Talos had already linked the cluster to Uzbekistan's Smart Forestry initiative in May 2026. It did not describe the access path. CloudSEK says the server shows it. The operator got command execution on the host behind the platform's GeoServer through this chain:

• Malicious WAR files deployed to GeoServer, one carrying a Metasploit payload servlet.
• A webshell on the /health/ path.
• PostgreSQL superuser access, then COPY ... FROM PROGRAM to open a reverse shell as the postgres user.
• Cron entries calling back to the operator and to a second IP, 134.17.14[.]24, whose ownership is unconfirmed.

The operator did not get root. sudo needed a password and Docker socket access was denied. Even so, the operator controlled the forestry database and anything GeoServer stored or published.

The AI agent angle​

The operator ran Hermes, an open-source autonomous agent framework, under .hermes/ on the same server. Reuters quoted CloudSEK's summary: "Instead of typing hacking commands by hand, the attacker told Hermes what to do," and Hermes planned attacks, ran them, kept notes and wrote reports.

CloudSEK's configuration findings are the most useful part for defenders:

The persona file tells the agent it is "an elite offensive security specialist and red teamer." CloudSEK says it also tells the agent to drop safety disclaimers and favour low-noise techniques.

The agent also did the cleanup. CloudSEK's transcript review shows deleted messages, shredded shell histories, cleared cron rows and zeroed login records in early October 2026. It missed the exposed directory. A daily logger kept exporting conversations and archiving collected files with a weak password. The agent's memory also told it to extract and use secrets inside one shell command so Hermes' output redaction never applied.

This is not an isolated case. CloudSEK says the same agent harness and model family appeared in its earlier investigation of a Gentlemen ransomware affiliate. It describes the two operators as unrelated. Unit 42 separately reported a Chinese-speaking actor using Hermes with DeepSeek, which exposed the actor's workspace after the agent started an HTTP file server from its home directory. Cheap agent frameworks are clearly attracting both espionage and criminal operators. They also seem to be producing sloppy operational security.

Operator security failures​

The OPSEC failures CloudSEK lists are almost comic:

• Malware source, pivot state, victim credentials, stolen documents and the agent's full chat history sat in one exposed directory.
• One IP address showed up in implants, LNK command lines, the PowerShell C2, Responder and cron callbacks.
• Build paths like chvost\Release\Netdrv.pdb survived in production implants.
• Server logins went through Tor, but test sessions leaked a residential Kazakh ISP connection.
• The test machine reused the same Windows host and user names across VPN exits.

CloudSEK also notes the operator told the agent the Proton VPN address was the only IP he had used. Earlier logins from Kazakhtelecom the same afternoon contradict that. The operator's Telegram control channel ties back to a single user ID with a display name CloudSEK renders as "Марат". Treat that as a handle from the logs, not an established identity.

Turkmenistan: preparation, not a confirmed campaign​

CloudSEK found lures built and tested in October 2026. One is a plain decoy PDF posing as a Turkmenistan Railways e-ticket for an Ashgabat to Turkmenabat trip in mid-October. The other is an executable with a Turkmen-language filename referring to the Ahal regional administration's 2026 state programme report. CloudSEK says the operator tested it on his own machine. That points to an upcoming campaign, not a confirmed one. Talos had earlier documented a Turkmennebit-themed lure from August 2025.

What Windows defenders can do​

CloudSEK's report supports these actions, with my own general hardening notes marked as such.

1. Hunt for hidden PowerShell launched from shortcuts. A .lnk that opens a PDF and starts a hidden PowerShell process is the core behaviour.
2. Watch for in-memory script downloads. IEX(DownloadString) patterns pulling P.ps1 from an unusual host are an indicator. Look for the reflection-based amsiInitFailed change too.
3. Audit service creation. Look for services named like Windows components, such as CoreMessaging, that point at unexpected binaries.
4. Block known indicators. The hashes and defanged network indicators are below.
5. Follow Talos's broader guidance. Monitor unexpected PowerShell, scheduled-task and Startup-folder changes. Keep archive tools patched; Talos documented a Silent Lynx chain using WinRAR CVE-2025-8088.
6. Fix the basics the operator exploited (general advice). Disable SMBv1, require SMB signing, retire unpatched Server 2008 R2 hosts, patch MS17-010 and change default passwords on network gear.
7. Tighten application authorisation (general advice). The document platform's weakness was per-document access checks, not Windows itself. A single standard-user account should not reach other ministries' files.

Indicators from CloudSEK​

• IPv4: 89.125.213[.]123 (payload host, C2, phishing, scanning)
• URLs: hxxp://89.125.213[.]123:8080/P.ps1 and hxxp://89.125.213[.]123:8080/decoy.pdf
• Domain: foreverpeace[.]ru
• IPv4: 134.17.14[.]24 (cron callback; ownership unconfirmed)
• SHA-256 hashes for the Laplas, Chvost and service-wrapper samples, including srvdriv.exe, netsrvc.exe, CoreMessaging.exe, ssdpdrv.exe, ssdspsrv.exe and the Ahal lure executable. The full list is in CloudSEK's report.

CloudSEK's report does not establish that this infrastructure is still active. The operator may already have moved on. Treat the indicators as retrospective hunting leads.

Caveats​

This is a vendor report. The attribution and the Kazakhstan nexus are analytic judgments, and CloudSEK itself marks them medium confidence. Reuters reported that Kazakh and Tajik officials did not immediately respond to requests for comment. CloudSEK also could not confirm whether some callback sources in the logs were victims, sandboxes or the operator's own test hosts. The victim details are CloudSEK's reading of the operator's own files.

The takeaway is that old Windows weaknesses did most of the work here. An AI agent made the operator faster and, as it turns out, careless. Defenders need to cover both the old weaknesses and the new automation.