Kazakhstan-linked hackers used AI to steal Tajik government documents, researchers say

A hacking group tied to Kazakhstan ​recently used AI to steal more ​than 2,000 national security-related documents from ‌neighboring ​Tajikistan, a cybersecurity company said in a report it published on Wednesday.

Singapore-based CloudSek said it caught the cyber spies using Hermes — an open-source ‌framework for autonomous AI agents — after they inadvertently left a server exposed to the internet. Reuters previously reported on how cybercriminals were assigning their break-ins to autonomous AI agents. CloudSek said its discovery ‌showed more advanced, espionage-focused hackers were also outsourcing their hacking sprees to AI.

“Instead of typing hacking ‌commands by hand, the attacker told Hermes what to do, and Hermes planned the attacks, wrote the rules, ran them, kept notes, and wrote up reports,” CloudSek told Reuters. Kazakh and Tajik government officials did not immediately respond to requests ⁠for ​comment.

CloudSek said the data ⁠it recovered showed the hackers using Hermes for reconnaissance beginning around mid-August and breaking into Tajikistan’s electronic document system ⁠a couple of weeks later. It said the AI agent then wrote a custom program to download the files, ​organize them, and break them into chunks to steal them more effectively. Among the exposed ⁠data were instructions from the hackers to their AI agent and guidelines on how it should see itself, operate and ⁠communicate ​with the hackers running it.

“You are an elite offensive security specialist and red teamer,” the instructions stated. A red teamer is a cybersecurity professional who simulates covert attacks to ⁠test an organization's systems. CloudSek said the hackers belonged to a group nicknamed “Silent Lynx,” which other researchers ⁠have tied to ⁠Kazakhstan. CloudSek said it found evidence the hackers spoke Russian, worked Kazakh business hours and often accessed the exposed server through a residential Kazakh internet ‌connection.

Efforts to reach ‌Silent Lynx were unsuccessful.