Hackers Ran Espionage Campaign With AI Agent Built on DeepSeek

Kazakhstan-linked hackers used an autonomous AI agent running mainly on DeepSeek V4.1 Flash to spy on Central Asian governments, Singapore-based security firm CloudSEK said in a report published Wednesday, Nov. 11. The configuration let destructive commands — shell heredocs and SQL DROP statements — execute without any human approval.

The group, tracked as Silent Lynx and also known as YoroTrooper and Cavalry Werewolf, has operated since at least 2022. CloudSEK discovered an exposed server belonging to one of its operators, holding more than a dozen gigabytes across hundreds of thousands of files: stolen government documents, hacking tools, and transcripts showing exactly how the operator put the AI agent to work.

How the agent was built

The operator installed Hermes, an open-source autonomous agent framework, rebranded it "Strix," and gave it a persona: an offensive security expert instructed to drop "safety disclaimers" and favor "low-noise techniques," the report says.

The model stack was cheap and commodity. Most logged work ran on DeepSeek V4.1 Flash through the OpenRouter API, with Google's Gemini 2.5 Flash handling parallel sub-agent tasks. The operator issued instructions in Russian, partly through a Telegram bot from a phone.

The configuration didn't just tolerate risky behavior — it codified it. Beyond allowlisting destructive commands, the operator disabled the hard stop that would normally halt the agent after repeated tool failures.

What did the transcripts show?

The logs show the agent analyzing reconnaissance output, checking whether anyone else had accessed the compromised server, and maintaining a handoff file so it could keep collecting documents without the operator in the loop.

In early October, the agent ran a clean-up. It deleted messages, shredded shell histories and zeroed login records. It missed one thing: the exposed directory itself. That oversight is why CloudSEK has the evidence at all.

Who were the victims?

In Tajikistan, the group held domain-level access to the national railway through a tunnel that stayed live from mid-August to at least Oct. 10, along with several credential dumps from the railway's Windows domain.

Using a single railway employee's sign-on account, the attackers reached the country's electronic document management platform. Weak per-document authorization exposed records far beyond the railway. The haul included more than 2,000 documents dated through 2026, among them:

• Thousands of records routed through the Defense Ministry
• Defense procurement files
• Flight clearances
• Passport scans
• A directory of more than 100 government organizations

In Uzbekistan, the group gained control of the database of a government forest-monitoring platform. In October, it built and tested lures disguised as a Turkmenistan Railways e-ticket service and a regional government report.

How solid is the Kazakhstan link?

CloudSEK attributes the exposed server to a Silent Lynx operator with high confidence. The Kazakhstan nexus gets a medium-confidence rating, resting on three signals: Russian-language operations, test logins from a Kazakhtelecom residential connection, and working hours in the UTC+5 time zone.

The Record noted that no connection to the Kazakh government has been established. The attribution stops at the nexus, not the state.

Part of a wider pattern

The case lands amid a run of similar findings. Arctic Wolf reported this week that attackers used AntiFox, an open-source AI pentest agent, to steal AWS secrets. Separate tests show free models now hack nearly as well as restricted cyber models.

The Silent Lynx case is distinct in one respect: it's not a lab test or a proof of concept. It's months of logged operational use against real government networks, run on models available to anyone through an API.

That accessibility is the story going forward. As free and low-cost frontier models close the capability gap with restricted cyber offerings, the marginal cost of AI-assisted espionage keeps falling — and CloudSEK's exposed-server window into Silent Lynx suggests operators are already taking advantage.