A cyberattack has allegedly stolen more than 2,000 documents related to Tajikistan’s defense and national security, according to a CloudSEK investigation cited by Reuters. The Singapore-based cybersecurity firm said the hackers, suspected to be a group with purported links to Kazakhstan, used autonomous artificial intelligence agents built on the Hermes platform. The report says the use of Hermes for intelligence operations began around mid-August 2026. According to the report, the intruders accessed Tajikistan’s state electronic document exchange system and spent several weeks collecting, organizing and exfiltrating files. Officials in Kazakhstan and Tajikistan did not respond to Reuters requests for comment at the time of publication.
Key Takeaways: CloudSEK says more than 2,000 files, including defense- and national-security-related documents, were stolen from Tajikistan’s state document system. The attackers allegedly used Hermes-based autonomous AI agents to plan actions, run tools and prepare stolen data for transfer. Researchers also found signs of access to Tajikistan’s railway computer infrastructure and material prepared for phishing against Turkmen organizations, but did not provide evidence that those attacks succeeded.
The incident underscores growing concerns over cyber-espionage targeting government infrastructure across the post-Soviet space. The hacking group is believed by researchers to be Silent Lynx, which has previously been tracked in operations against state institutions in several former Soviet countries. The reported Kazakhstan connection is based on indirect indicators: the hackers used Russian-language tools, their activity matched working hours in Kazakhstan, and an internet connection from the country was used to reach the server. However, CloudSEK did not identify who controls the group and did not establish that Kazakh government structures were involved.
According to CloudSEK, the use of Hermes for intelligence operations reportedly began in mid-August 2026. The platform was used to create AI agents capable of independently planning operations, launching required programs, gathering information and producing reports. At one stage, an AI agent reportedly built a specialized tool to download documents, systematize them and split them into smaller parts, making the stolen material easier to transfer. Investigators also detected signs of intrusion into the computer infrastructure of Tajikistan’s railways. Separately, the server contained materials prepared for phishing attacks against Turkmen organizations, although researchers did not present proof of successful execution.
No definitive conclusion has yet been reached on which state or organization is behind the operation. Reuters contacted officials in Kazakhstan and Tajikistan for comment but received no response by publication time, and journalists were unable to reach Silent Lynx representatives. Cybersecurity experts caution that language, time-zone patterns and technical traces are indirect indicators and should be verified through official investigations and independent analysis.
The next developments will hinge on official statements from Tajikistan and Kazakhstan and on whether CloudSEK publishes further technical details. The full scale of the breach, the contents of the stolen documents and their possible use remain unclear. The case adds to regional pressure to strengthen cyber defenses around government document systems and defense-related infrastructure, particularly as AI-enabled tools lower barriers for sophisticated intrusion and data-theft operations.
Source: kun.uz