Documents related to Tajikistan's national security were stolen: hackers used artificial intelligence
During the inspection, traces of access to the Smart Forestry digital platform used in Uzbekistan's forestry sector were also identified.
A hacker group breached Tajikistan's state electronic document circulation system and stole more than 2,000 documents. Among them are materials related to defense and national security. Reuters reported this, citing research by the Singapore-based cybersecurity company CloudSEK reported.
Experts identified traces of the cyberattack after the hackers left one of their servers exposed on the internet due to an error. By studying the materials on the server, the researchers were able to reconstruct how the attacks were carried out.
It turned out that the hackers used the Hermes platform. It enables the creation of autonomous artificial intelligence agents capable of independently planning actions, launching the necessary programs, collecting data, and preparing reports.
According to CloudSEK, the use of the Hermes platform in cyberattacks began around mid-August 2026. A few weeks later, the hackers breached Tajikistan's state electronic document circulation system. The AI agent created a special program to download, organize, and break documents into small parts. This made it easier to transfer the stolen data. As a result, more than 2,000 documents were obtained.
During the investigation, traces of access were also found in the computer infrastructure of Tajikistan Railways and in the Smart Forestry digital platform used in Uzbekistan's forestry sector.
In addition, materials prepared for conducting phishing attacks against Turkmenistan's state organizations were found on the hackers' server. However, the experts did not find evidence confirming that these attacks were successfully carried out.
The researchers link the cyberattacks to the Silent Lynx group, which has previously been observed in cyberespionage operations against post-Soviet government agencies. Assumptions about the group's connection to Kazakhstan are based on several indirect signs. In particular, the hackers used Russian, and their activity times corresponded to working hours in Kazakhstan. The country's internet network was also used to connect to the server.
At the same time, the researchers were unable to determine who exactly leads the group. No evidence has been presented of the involvement of Kazakh state structures in the cyberattacks.
