An exposed server belonging to the Central Asian espionage group Silent Lynx shows an operator handing reconnaissance, document collection and log cleanup to a self-hosted AI agent, tasked from a phone over Telegram. Little of the tradecraft is new. What has changed is how cheaply one person can now run it at scale, and UK defenders should take note.
What happened
On 11 November 2026 Singapore-based CloudSEK published its analysis of an unauthenticated open directory on a Debian VPS holding more than a dozen gigabytes of material. It attributes the server with high confidence to Silent Lynx, a cluster also tracked as YoroTrooper and Cavalry Werewolf. The Record reported the findings on 12 November.
The directory held everything in one place: phishing kits, per-victim implant builds, pivot databases, stolen credentials, exfiltrated documents and the full state of an agent built on Hermes, an open-source autonomous agent framework. The records span April to October 2026.
The biggest intrusion hit Tajikistan’s national railway, where CloudSEK says the operator held domain-level access from mid-August until at least 10 October. With one railway employee’s ordinary credentials, the operator then signed in to the government’s national electronic document management platform and collected more than two thousand documents addressed to or routed via the Ministry of Defence, plus smaller sets linked to the National Guard and other security and investment bodies. A host behind Uzbekistan’s Smart Forestry GeoServer was also compromised. Lures posing as Turkmenistan Railways tickets and a Turkmen provincial report were tested in October; whether that campaign launched is unknown.
CloudSEK gives a medium-confidence Kazakhstan link, citing Russian-language tasking and the operator’s test sessions from a residential Kazakhtelecom line. The Record notes that the findings do not establish any connection to the Kazakh government.
The technical picture
Delivery is old-fashioned: a PDF-iconed shortcut, packed in an archive or disk image, shows a decoy while hidden PowerShell fetches an unobfuscated reverse shell script and runs it in memory. One variant first disables AMSI scanning, a step CloudSEK says public reporting on the group has not documented. Shortcut filenames show the operator testing each stage, starting with Notepad.
Persistence came from the group’s known Laplas and Chvost TLS reverse shells, shipped with genuine OpenSSL libraries and installed as services with lookalike names. Inside the railway the operator used standard kit: Ligolo, NetExec, Impacket, Responder and Inveigh. Many hosts still ran SMBv1 with signing off, so credential capture was easy, and CloudSEK found NTDS-style dumps containing Administrator and krbtgt. Credentials for the upstream ISP’s MikroTik, Cisco and D-Link devices, still on default passwords, were taken too. In Uzbekistan, malicious WAR files on GeoServer led to a PostgreSQL superuser login, abused for command execution and cron callbacks.
The agent is the new part. Its persona casts it as an elite red teamer, drops safety disclaimers and asks for low-noise techniques. Most calls went via OpenRouter to a DeepSeek model, with Gemini handling sub-tasks. Destructive commands such as SQL DROP were allowed to run without confirmation, and the stop-after-repeated-failures safeguard was off. The operator wrote the agent a handoff note on the document platform login so it could keep collecting alone, and the collectors built for the platform ran at high concurrency and posted progress to Telegram. In early October it shredded histories, cleared cron entries and zeroed login records, but missed the exposed directory. Its memory even noted a trick to dodge Hermes’ own secret redaction.
Why it matters for UK organisations
CloudSEK names no UK victims, and Central Asian ministries are a long way from most British networks. The relevance lies in the method. This was not a well-resourced team using bespoke exploits. It appears to have been a single operator, whose logged activity over the few days CloudSEK could time fell within weekday office hours, using a free agent framework and a low-cost model to get through tasks that would usually need several people. The same agent stack has already turned up in a ransomware affiliate’s operation that CloudSEK investigated separately, which suggests the approach is spreading into the kind of criminal operations that do hit UK companies.
The weaknesses exploited are ones I see regularly on UK engagements. Document and case management platforms that check whether a user is logged in but not whether that user may read a given record are common in local government, the NHS supply chain and professional services. SMB signing gaps and legacy SMBv1 persist in operational technology and transport estates. Network kit left on default credentials, often managed by a third party, is a familiar finding. For UK firms with offices, joint ventures or supply chains in Central Asia and the wider CIS, particularly in logistics, energy and mining, this group is a direct threat to staff mailboxes and partner systems.
Expert view
When we run adversary simulations, the slow part is rarely getting in. It is the hours of patient enumeration and collection afterwards. Here an agent took on most of that work, at a pace and concurrency a human would struggle to sustain. The downside for the attacker was noise: CloudSEK notes that sequential ID probing and rapid enumeration tripped web application firewall lockouts on several targets. That is good news. Agent-driven intrusions may be faster, but at present they tend to be louder, and defenders who alert on volume and odd access patterns have a real chance of catching them.
The operator’s security failures are just as telling. One IP address was used for C2, phishing, scanning and payload hosting, and developer build paths were left in production binaries. The agent cleaned some logs while a daily job exported its conversations. Automation does not fix poor discipline, and in this case it left a detailed, timestamped record of the whole operation.
What to do now
- Test object-level authorisation on internal document systems. Confirm that a low-privilege account cannot request arbitrary document or attachment IDs, and that file services require authentication. Add this to your next penetration test scope (Cyber Essentials: user access control).
- Block shortcut and container lures. Stop LNK, ISO and password-protected archives at the email gateway, enable PowerShell script block logging and Constrained Language Mode where practical, and alert on AMSI tampering (malware protection, secure configuration).
- Retire SMBv1 and enforce SMB signing across servers and domain controllers, and disable LLMNR and NBT-NS so tools such as Responder have nothing to capture (secure configuration).
- Change default credentials on routers and switches, including kit managed by your ISP or MSP, and put management interfaces behind restricted networks (firewalls, secure configuration).
- Watch for agent-scale behaviour: bursts of sequential document requests from one account, new Windows services with lookalike names, unexpected outbound TLS from servers, and Telegram API traffic from systems with no business reason to use it.
- Treat krbtgt exposure as a full-domain event. If NTDS data may have left, rotate krbtgt twice and reset privileged credentials (security update management and user access control).
Bottom line
Silent Lynx did not need new exploits. It used a free AI agent to scale up techniques that UK networks are still vulnerable to: broken authorisation, legacy SMB, default passwords and PowerShell-launching shortcuts. Close those gaps and an agent has far less to work with.
