Skip to content
Kazakhstan-Linked Hackers Use AI to Steal Over 2,000 Tajik Government Documents

Kazakhstan-Linked Hackers Use AI to Steal Over 2,000 Tajik Government Documents

First seen 11 Nov 2026, 17:03 UTC • •

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 12, 2026 at 15:51 UTC
  • •Silent Lynx hacked Tajikistan's government, stealing over 2,000 sensitive documents.
  • •The attack utilized the Hermes AI framework for reconnaissance and data extraction.
  • •Evidence suggests a Kazakhstan nexus, but no state sponsorship has been confirmed.

A hacking group known as Silent Lynx, suspected to operate from Kazakhstan, has stolen over 2,000 sensitive documents from Tajikistan's government systems using an AI framework called Hermes. The attack, which began in mid-August 2026, involved the hackers gaining access to Tajikistan's electronic document management system through a compromised railway employee's account. The stolen documents included national security information and military correspondence. The operation was uncovered after the attackers inadvertently left a server exposed, allowing cybersecurity firm CloudSEK to analyze their methods and tools. The use of AI in this context represents a significant shift in cyber espionage tactics, allowing for greater automation and efficiency in data theft. Despite the evidence linking the group to Kazakhstan, there is no confirmation of state sponsorship. The incident highlights the evolving landscape of cyber threats involving AI technologies.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Timeline

2026-08-15
Reconnaissance began
Silent Lynx started gathering information on Tajikistan's electronic systems using the Hermes AI framework.
The420.In
2026-10-10
Access gained to Tajik government systems
The hackers accessed Tajikistan's electronic document management system through a compromised railway employee's account.
Timesca
2026-11-11
Investigation published
CloudSEK disclosed findings on the operation after discovering an exposed server containing operational records.
The420.In

More articles in this cluster (13)

Following this threat?

Track Silent Lynx and Hermes in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Common questions

What types of documents were stolen?
The stolen documents included national security information, military personnel transfers, and correspondence from the Ministry of Defence of Tajikistan.
How did the hackers gain access?
The attackers gained access through a compromised account of a railway employee, which allowed them entry into the electronic document management system.
Is there evidence of state sponsorship?
While the group is linked to Kazakhstan, there is currently no evidence to confirm that the Kazakh government sponsored the operation.