Hackers used DeepSeek AI to steal 2,000 defence documents, then made one big mistake

A group of suspected cyber spies has reportedly broken into Tajikistan’s national railway network, accessed thousands of sensitive government documents and used artificial intelligence to help carry out the operation. The group, known as Silent Lynx, is now under scrutiny after cybersecurity researchers discovered something unusual. The hackers had accidentally left their own server exposed to the internet, revealing details of their operations.

According to a November 11 by cybersecurity firm CloudSEK, the exposed server contained more than a dozen gigabytes of stolen documents, passwords, malware and operational records dating from April to October 2026. Researchers say the group collected over 2,000 defence-related documents and compromised another government platform in Uzbekistan. The attackers even had an AI assistant handling parts of their espionage activities.

:

Who is Silent Lynx and what did the hackers steal?

Silent Lynx is a cyber espionage group that has previously targeted government organisations across Central Asia. CloudSEK says the group maintained access to Tajikistan’s railway network from mid-August until at least October 10, 2026.

The attackers reportedly stole administrative passwords, internal railway reports and government correspondence. Using a railway employee’s account, they accessed a national document management system containing sensitive defence records.

The stolen material included military personnel transfers, flight-clearance requests, defence purchases, air-defence cooperation records and identity documents.

How did hackers use DeepSeek AI?

Here’s where the investigation gets interesting. The hackers reportedly used a self-hosted AI agent running on the Hermes framework, mainly using DeepSeek AI models.

The AI assistant helped examine computer networks, organise stolen information, write programs and remove evidence of suspicious activity.

CloudSEK told Reuters, “Instead of typing hacking commands by hand, the attacker told Hermes what to do, and Hermes planned the attacks, wrote the rules, ran them, kept notes, and wrote up reports.”

The researchers found that some potentially destructive commands could run without additional human approval.

:

Which countries were targeted?

Were the hackers operating from Kazakhstan?

CloudSEK found Russian-language instructions and test connections from residential internet services in Kazakhstan, including Kazakhtelecom.

The researchers expressed high confidence that the exposed server belonged to Silent Lynx, but assessed the Kazakhstan connection with medium confidence. This does not establish involvement by the Kazakh government.