Hackers with AI agents stole more than 2,000 documents from Tajikistan; the trail reportedly leads to Kazakhstan

How the attack unfolded

A hacker group, believed to be linked to Kazakhstan, stole more than 2,000 documents concerning Tajikistan's national security. Reuters reports this, citing a study by the Singapore-based company CloudSEK; the findings of the investigation were also covered by Daryo.uz and Kun.uz.

The role of artificial intelligence

According to CloudSEK, around mid-August 2026 the attackers began using the Hermes platform, designed for creating autonomous AI agents: such agents plan actions on their own, run programs, gather information and prepare reports. A few weeks after the reconnaissance operations began, the hackers penetrated Tajikistan's state electronic document management system. An AI agent wrote a program for downloading, sorting and splitting documents into fragments, which made it easier to transfer the stolen data. As a result, more than 2,000 documents were stolen, including materials on defense and national security.

Traces on the server and other targets

Researchers were able to reconstruct the course of the attack because the hackers accidentally left one of their servers exposed on the internet. It also showed signs of breaches of the computer systems of Tajik Railways and the Uzbek digital platform Smart Forestry, used in forestry, as well as materials for phishing attacks against organizations in Turkmenistan — however, the researchers did not present evidence that these attacks succeeded.

Attribution and its limitations

Experts link the attack to the Silent Lynx group, which had previously been suspected of cyber espionage against government agencies in former Soviet countries. The assumption of a link to Kazakhstan rests on indirect signs: the hackers used the Russian language, their activity coincided with working hours in Kazakhstan, and an internet network located in that country was used to connect to the server. At the same time, the researchers were unable to establish who led the group and presented no evidence of the involvement of Kazakh state structures. Reuters requested comment from the governments of Kazakhstan and Tajikistan but received no response by the time of publication; journalists were also unable to reach representatives of Silent Lynx. Experts rate the likelihood of a link to Kazakhstan as moderate, emphasizing that the data is insufficient for a definitive conclusion about the origin and organizers of the attacks.

Context

In October 2026, the companies Cisco Talos and Recorded Future published a study on cyber espionage against government agencies of post-Soviet states: according to their data, the attacks had been carried out since at least January 2025, and the hackers were interested in diplomatic correspondence, economic policy, energy, water resources and agriculture. The new CloudSEK investigation is notable because it is the first time the use of autonomous AI agents has been documented in such a campaign — from reconnaissance to writing a tool for exfiltrating stolen documents.