Off The Rails Inside An Exposed Silent Lynx Server

An exposed open directory belonging to Silent Lynx, a Central Asia-focused espionage cluster, gave CloudSEK an inside view of the group's operations through October 2026. The directory held the group's tooling alongside data from active intrusions into government and critical infrastructure organisations across the region, and the AI agent the operator relied on to run them.

We assess with high confidence that the directory belongs to a Silent Lynx operator, based on implant code markers and build paths shared with published samples. We assess with medium confidence that the operator has a Kazakhstan nexus: the operation runs in Russian, and the operator's own test traffic came from a residential Kazakh connection, which supports existing vendor assessments. The collection priorities, spanning transport, defence correspondence and resource ministries in neighbouring states, point to regional intelligence gathering rather than financial motive.

The exposed directory provided a timestamped record of the operator's tooling, intrusions and AI agent conversations spanning April to October 2026.

The operator held persistent, domain-level access to transport-sector networks and used a single compromised employee account to collect government correspondence at scale, including defence-related documents.

A government-run geospatial platform was taken to host-level command execution through a webshell and database access, with persistence in place at the time of exposure.

The implants match the group's known Laplas and Chvost families, alongside a previously unreported generation of service-installer implants and an AMSI-bypass delivery variant.

Lures impersonating Turkmenistan Railways and a Turkmen regional administration were built and tested in October 2026, pointing to an upcoming campaign against Turkmenistan.

A self-hosted AI agent running on DeepSeek handled reconnaissance, collection and log cleanup, with destructive commands pre-approved.

Server logins were routed through Tor, but the operator's own test sessions came from a residential Kazakhtelecom connection.

Background: Silent Lynx in prior reporting

Silent Lynx has been tracked publicly since January 2025 under several vendor names. Reporting has centred on spear-phishing of Central Asian government bodies with LNK and archive lures that lead to lightweight reverse shells.

The server 89[.]125[.]213[.]123 is a Debian VPS on Baxet Group infrastructure, exposed without authentication on port 8088. It held more than a dozen gigabytes across hundreds of thousands of files, with no separation between tooling, victim data and operator workspace.

The fish/ folder holds the group's complete phishing chain: a PDF-themed shortcut that opens a decoy and runs a PowerShell reverse shell, the listener that receives the shell, and lures built for Turkmenistan. Shortcut names, test files and callback logs show the operator building and testing the chain one step at a time.

The target receives a shortcut with a PDF icon, packed in a ZIP, a password-protected archive or an ISO image.

Opening the shortcut loads a decoy PDF from the operator's server and starts a hidden PowerShell process.

PowerShell downloads P.ps1 from the same server and runs it in memory.

P.ps1 drops and opens a second decoy, Отчёт_2026.pdf ("Report_2026.pdf"), then opens a raw TCP shell to the operator.

On the operator's side, a dispatcher script runs whoami, hostname and ipconfig on every new shell and saves the output.

Prior reporting: Seqrite's Operation Peek-a-Baku and the Talos "Chain C" both describe shortcuts that launch PowerShell to fetch a remote script hosted on GitHub. This kit uses the same pattern but serves the script from the operator's own server.

Building the shortcuts

The shortcut names record the build order, from execution tests to the armed versions:

The AMSI variant sets amsiInitFailed through reflection before the download, which switches off script scanning for the session. Public reporting on Silent Lynx does not document this variant.

In this specific campaign the operators packed the shortcuts three ways: an unencrypted ZIP, a password-protected ZIP with Russian-named shortcuts (Отчёт_2026.pdf.lnk) and an ISO image built in early October 2026.

P.ps1 is a plain PowerShell loop with no encryption or obfuscation. It reads commands from the socket, runs them with Invoke-Expression and returns the output:

The decoy PDF impersonates a Turkmenistan Railways electronic ticket for an Ashgabat to Turkmenabat trip in mid-October 2026. It is a plain text page with no logo or formatting, the passenger is a Russian placeholder name, and the travel date sits a week after the ISO was built.

A separate executable lure carries a long Turkmen-language filename referencing the Ahal regional administration's 2026 state programme report. It contains the operator's IP and the Ahal administration domain in its strings, and was compiled on the same day the operator announced a test shell to the AI agent.

The operator tested the binary on his own machine which places this Turkmenistan campaign as an upcoming target. Prior reporting also lists Turkmenistan among the group's victim and lure countries and documented a decoy impersonating Turkmennebit, the state oil company, in an August 2025 campaign

Listener and callback logs

watch_shell.py listens for incoming shells. auto_recon_dispatcher.py watches the callback ports, runs first-look commands on each new session and relays the output to the operator. cap.log records HTTP requests for the kit files.

The sessions/ folder holds dozens of callback logs named by source IP, in three groups:

Most contain TLS handshake bytes rather than shell text: Laplas and Chvost implants calling back to a plain-text listener. Their sources cluster in a few hosting ranges. CloudSEK could not confirm whether these are victims, sandboxes or operator test hosts.

A few come from internet scanners.

Two come from the operator's own test machines, the same Proton VPN and Kazakhtelecom addresses seen in the server's login log.

The payloads/ folder holds per-target builds for Tajikistan, the Tajik railway and Kyrgyzstan. Each build pairs a small Windows executable with genuine OpenSSL 3 libraries.

srvdriv.exe is a TLS reverse shell from the Laplas family. It opens an OpenSSL session to the operator and spawns processes on command. Build paths reference a Visual Studio project named Laplasgeneral, and the operator compiled multiple builds between April and September 2026, including a dedicated build for the railway intrusion.

ssdpdrv.exe is a Chvost-family shell with the debug path \chvost\Release\Netdrv.pdb. It carries a fixed block of strings that matches published Chvost reporting, down to the exact greeting wording: Phenyx2022, shexit, HELLO. Press Enter. and Goodbye.. This block is the strongest technical link between the server and the Silent Lynx toolset.

The Kyrgyzstan set is a 32-bit build paired with 32-bit OpenSSL libraries. The Tajik builds are 64-bit.

Prior reporting named Chvost, Laplas and PickleShell as the group's custom reverse shells.

netsrvc.exe, CoreMessaging.exe and ssdspsrv.exe install the shells as Windows services under names that mimic legitimate components. Their strings include Success install service! and ERROR: DUPLICATE_SERVICE_NAME.

CoreMessaging.exe carries the same netsrvc.pdb build path as netsrvc.exe, so it is the same wrapper renamed for the railway deployment. ssdspsrv.exe is an older, separate wrapper built from an E:\ \shell\service project.

Intrusion 1: Tajikistan Railway

The operator had domain-level access to Tajikistan's national railway network from mid-August to at least 10 October 2026. The Ligolo server database records a live tunnel through a railway host for nearly two months.

From that foothold the operator:

Enumerated dozens of internal Windows hosts, from Windows 7 to Server 2022, many with SMBv1 enabled and signing disabled.

Obtained administrative access on multiple servers using plaintext passwords and NTLM hashes.

Produced several NTDS-format credential dumps that include Administrator and krbtgt.

Copied operational reports, dispatcher summaries and internal correspondence from SMB shares, including documents dated August 2026.

Harvested credentials for network equipment belonging to the railway's upstream ISP, including MikroTik, Cisco and D-Link devices running default passwords.

The operator also deployed an ASP.NET webshell on one railway web server and prepared Metasploit resource files for MS17-010 against an unpatched Windows Server 2008 R2 host.

The Ligolo database also holds an earlier tunnel, active from April to May 2026, through a host named DC with routes into two further networks.

Intrusion 2: Tajik government document platform

The largest data exposure came from Tajikistan's national electronic document management (EDO) platform, which ministries and state bodies use to exchange official correspondence. The operator logged in through the government SSO portal with the credentials of one railway employee holding a standard user role.

That single account was enough to pull documents far outside the railway's own scope. The operator's notes describe weak per-document authorisation checks and a file service that served attachments without authentication.

The operator built collectors to walk the platform at high concurrency, resume after failures and post progress updates to Telegram. The output includes:

Thousands of documents addressed to or routed through the Ministry of Defence, sorted by month through 2026.

Smaller sets tagged to the National Guard and the State Committee for National Security.

Hundreds of State Investment Committee letters.

A directory export listing more than a hundred government organisations, with department and user listings.

Sample collected document

The collection runs to more than two thousand unique documents dated through 2026, correspondence to or through the Ministry of Defence. By volume:

Air-space use and flight-clearance requests

Conscript and personnel transfers and appointments

Military attaché postings and foreign-liaison correspondence

Defence procurement enquiries and vendor material, including Embraer, Milanion Group and Puma UAS

Budget and finance paperwork

Legal and regulatory drafts

Air-defence cooperation, training and exercise correspondence

Telecoms and radio-frequency coordination

Border-zone construction reporting

Ceremonial, anniversary and sporting correspondence

Identity documents, including passport and national ID scans, for named individuals attached to visit and delegation correspondence

Intrusion 3: Uzbekistan Smart Forestry

The operator gained command execution on the host behind Uzbekistan's Smart Forestry GeoServer. The access chain runs from a web application foothold to the database service to the host.

Prior reporting observed activity involving Uzbekistan's Smart Forestry initiative in May 2026 but did not describe the access path. The server shows how that access worked.

Malicious WAR files deployed to the GeoServer instance, one of them carrying a Metasploit payload servlet.

A webshell on the /health/ path, driven from the operator's server through a small curl wrapper.

PostgreSQL login with superuser rights, then COPY ... FROM PROGRAM to open a reverse shell to the operator as the postgres user.

Cron entries on the host that call back to the operator's server and to a second, unattributed IP.

The operator did not obtain root. sudo required a password and Docker socket access was denied. The access still gives full control of the forestry database and any data the GeoServer instance publishes or stores.

The operator and the AI agent

The operator runs much of the work through Hermes, an open-source autonomous agent framework, installed under .hermes/ on the same server. The agent holds a persistent memory, a task board for parallel sub-agents, cron jobs, custom scripts and a large imported library of offensive security skills.

The agent's persona file casts it as an elite offensive security specialist and red teamer. Its configuration routes model calls through OpenRouter, with DeepSeek models handling most of the logged traffic.

The persona tells the agent to drop "safety disclaimers", treat the operator as an expert peer, and favour "low-noise techniques" with notes on AV and EDR impact. The configuration shows how much autonomy the agent had:

The agent's conversation database shows the operator giving instructions in Russian. The operator:

Asked the agent to analyse the output of the recon dispatcher running in a tmux window.

Announced their own test shell before running it, then named the single IP they connected from.

Asked the agent to check whether anyone else had broken into the server.

Ordered the deletion of skills the agent had acquired in the day.

The railway intrusion folder includes a handoff file written for the agent, describing the working EDO login chain so the agent could continue collection without the operator. A separate agent-written report summarises access to the railway's upstream ISP.

The agent also ran its own cleanup. The transcript records deleted messages, rebuilt indexes, vacuumed databases, shredded shell histories, cleared cron rows and zeroed login records in early October 2026. The cleanup missed the directory that was exposed.

Where the operator connects from

The agent captured the server's SSH log in its own transcript before the cleanup. It records hundreds of root logins over five days in late September and early October 2026, from more than a hundred source IPs. Most came through Tor exit nodes, with two commercial VPN exits. Kazakhstan is the exception: dozens of logins came from residential connections on Kazakhtelecom and a second Kazakh ISP, more than any other non-Tor source.

The Kazakhtelecom line ties back to the operator directly. On 2 October the operator logged in from it, switched to Proton VPN and logged in again four minutes later. The operator’s test machine, DESKTOP-S3MHLFV\nemo, sent test shells to the server through both connections.

Shortly after the switch, the operator told the agent the Proton address was the only IP he had connected from. The Kazakhtelecom logins earlier the same afternoon show otherwise.

Every operator login and agent message with a recorded time falls between 08:00 and 20:00 in Kazakhstan's time zone (UTC+5), with no activity overnight. Talos reported a matching working-hours pattern from the group's GitHub commits. The sample here covers only a few days, but it comes from a separate source: the operator's own logins and conversations with the agent.

All recorded activity falls on weekdays, starts around 08:00 and ends before 20:00 local time, with a quiet stretch in the early afternoon and nothing overnight. That pattern matches a salaried working day rather than a side job worked in evenings and weekends. The records cover only three working days and cannot show weekend behaviour, and bursts of logins seconds apart reflect tools reconnecting rather than separate human actions.

What the agent remembers

The agent's persistent memory file reads as the operator's own operations notes, partly in Russian.

Infrastructure. The agent works from a Kali box on a self-hosted NetBird mesh, with the control plane and a Pangolin reverse proxy under foreverpeace[.]ru. Every mesh peer sits on the same hosting provider as the exposed server.

A victim mounted on the operator's box. The memory warns that /mnt is a CIFS mount of a on a railway server and "can hang". The carries the name of a railway account that appears in the operator's admin access records.

Working around the agent's own guardrails. Hermes redacts tokens and private keys in tool output. The memory instructs the agent to extract and use a secret inside one shell command so the redaction never applies.

Further targets. Entries record Armenian government networks filtering the operator's traffic, and an October 2026 "engagement" against Pakistan's Ministry of Foreign Affairs and its national telecom provider, where a WAF repeatedly banned the operator's IP.

Telegram as the control channel

Telegram ties the operation together. The agent ran Hermes' messaging gateway with a Telegram bot, so the operator could task it from a phone, and the collectors that pulled government documents posted progress updates to a Telegram chat. Seqrite's first Silent Lynx report described Telegram bots used for command and control. Here Telegram controls the AI agent rather than the implants, which call back over TLS.

The agent's session records and gateway logs tie the bot to a single Telegram account. The operator's Telegram session with the agent dates back to mid-August 2026, and every inbound command came from one Telegram user ID with the display name «Марат». That includes the operator's announcement of his own test shell on 2 October: «Щас запущу тестовый шелл, он будет моим» ("Launching a test shell now, it'll be mine").

The same harness and model family appeared in CloudSEK's earlier investigation of a Gentlemen ransomware affiliate. The two operators are unrelated. The overlap shows the same open-source agent stack spreading across both espionage and ransomware operations.

Everything on one box. Malware source, pivot state, victim credentials, stolen documents and the agent's full conversation history sat in one exposed directory.

One IP for every role. The same address appears in implant strings, LNK command lines, the PowerShell C2, Responder, cron callbacks and recon scans.

Developer paths left in binaries. Build paths such as Laplasgeneral and chvost\Release\Netdrv.pdb survive in production implants.

Secrets stored beside tools. Victim credentials, the EDO login chain, API keys and the Ligolo private key sit to the tooling that uses them.

Self-tests leave a trail. The operator's test machines reused the same Windows host and user names across VPN exits, and ran the Turkmen lure from a WinRAR temp folder. Server logins went through Tor, but test sessions leaked a residential Kazakh ISP.

Contradictory cleanup. The agent shredded histories in one session while a daily logger kept exporting conversations and archiving collected files with a weak, predictable password.

Noisy collection. High-concurrency enumeration, sequential ID probing and Telegram progress pings triggered WAF lockouts on multiple targets.

CloudSEK attributes this server to the Silent Lynx cluster with high confidence on tooling and medium-high confidence on the intrusion set. The anchors are code-level markers and build paths shared with published Chvost and Laplas samples, the LNK-to-PowerShell delivery pattern, and a victim already linked to the group in public reporting.

The operator works in Russian, and test traffic from the operator's own machine came through a residential Kazakhtelecom connection. Public reporting assesses a Kazakhstan nexus for this cluster with medium confidence, and the Kazakhtelecom sessions support that assessment.

Prior reporting based its Kazakhstan assessment on Russian-language artifacts, malware-testing submissions from Kazakhstan shortly after compilation, and repository commits during UTC+5 working hours. The Kazakhtelecom sessions are a separate, network-level signal pointing the same way.

Cisco Talos, "Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations", 14 October 2026. Link

Recorded Future Insikt Group, "TAG-193 regional espionage operations", October 2026. Link

Shen and Vögele, "Break the silence: tracking Silent Lynx through exposed infrastructure", Virus Bulletin 2026. Link

Seqrite Labs, "Operation Peek-a-Baku: Silent Lynx APT makes sluggish shift to Dushanbe", 3 November 2025. Link

Seqrite Labs, "Unveiling Silent Lynx APT targeting entities across Kyrgyzstan and neighbouring nations", 21 January 2025. Link

Group-IB, "ShadowSilk", 27 August 2025. Link

BI.ZONE, "Cavalry Werewolf raids Russia's public sector with trusted relationship attacks", 2025. Link

VMRay, "Hydra Saiga: covert espionage and infiltration of critical utilities", 24 February 2026. Link

Cisco Talos, "Attributing YoroTrooper", 25 October 2023. Link

Kaspersky, "Tomiris called, they want their Turla malware back", 24 April 2023. Link