In this article
Security researchers at CloudSEK reported on November 11 that an espionage operation attributed to Silent Lynx collected more than 2,000 unique documents from a Tajik government system. They say the operators delegated some of the work to an agent built with the Hermes framework and configured to use DeepSeek models. Investigators reconstructed part of the operation from records found on an exposed server. CloudSEK assesses a link between the operators and Kazakhstan with medium confidence. CloudSEK report
What the exposed server gave investigators
CloudSEK found tools, activity records and collected files in the same environment. That let investigators compare what the agent recorded with material recovered from the server. A conversation can tell an investigator what someone asked an agent to do. An execution record or a corresponding file adds evidence about what happened. The report draws on several kinds of record to reconstruct part of the campaign.
The reconstruction covers activity for which the researchers found evidence. A file on the server cannot show on its own who saw it later or whether a copy went elsewhere. The forensic findings are CloudSEK’s. Reuters reported on the investigation and sought comment from Tajik and Kazakh officials, who did not immediately respond. IANautaLab did not take part in the forensic work. Reuters via ThePrint
What the figure of 2,000 refers to
CloudSEK describes more than 2,000 unique documents in the collection associated with the Tajik government system. They include correspondence sent to or routed through the Ministry of Defence and material of other kinds. The figure describes the collection the researchers examined. The report also discusses other organizations and incidents in Central Asia, which have their own evidence.
Routing tells investigators something about how the correspondence circulated. It gives them less information about what each document contains or how it was classified. A ministry can receive material ranging from routine scheduling to sensitive communications. Reuters described the material as related to national security and attributed the count to CloudSEK. Establishing the sensitivity of individual files would require evidence about their content and handling. CloudSEK · Reuters via ThePrint
The framework and the model
Hermes is the framework that organizes an agent’s work. It can keep task context, consult a model and send actions to tools an operator has made available. DeepSeek is the model family found in the records. CloudSEK identifies DeepSeek V4 as the primary model in the recovered configuration. In the researchers’ account, the operators set the objectives and decided what tools and permissions the agent would have.
The same arrangement can serve an ordinary business task. A model could interpret a question about a company’s inventory, while the framework consults a catalogue through a service account. With read access, the agent can look up the items the account is permitted to see. Editing the catalogue would require a different permission. The distinction matters when assigning responsibility for an action and when deciding which capabilities an organization needs to monitor.
Where the operators remained involved
CloudSEK says the recovered records show operators assigning work to the system and the agent helping with activities such as reconnaissance and organizing information. Investigators also found conventional tools. The AI may have reduced the amount of repetitive work that required hands-on attention. The published evidence does not let readers calculate how much of the operation depended on the agent or assign each decision to a model.
Delegating a task means some intermediate steps can proceed before a person checks the result. The degree of autonomy depends on the task and on the tools available at the time. A person can still choose the objective, set permissions and decide whether to act on a result. In an investigation, those choices help identify where an operator exercised control and where the record leaves room for uncertainty.
How strong is the Kazakhstan link?
CloudSEK gives its association of the tooling with Silent Lynx high confidence. It gives the link to the intrusion set medium-high confidence and its assessment of a Kazakhstan connection medium confidence. Those judgments address different questions. Similar tooling can connect several pieces of activity. Language, activity schedules and connection records can support a geographic inference while leaving the operators’ identities and any state involvement unresolved.
New records could change the assessment, and the same clues can admit more than one explanation. At the time Reuters published, neither government had immediately responded to its request for comment. CloudSEK · Reuters via ThePrint
An organization responding to a similar incident would have a different question from an investigator trying to identify the group. It would need to establish which accounts could reach the affected records, whether those permissions are still in use and which teams depend on them. Those questions can guide containment even while the attribution is being reviewed.
What organizations can do to limit an agent’s reach
Start with what the task requires. An agent summarizing documents for one department can receive read access to that department’s documents. Exporting files or changing permissions can require a person to approve the action. Separate service credentials give security staff a way to identify which integration acted and to revoke its access without interrupting unrelated services.
Activity records are most useful when a security team can inspect them and the agent cannot alter them. An unusual increase in file reads can trigger a review of what the service is doing and which documents it was authorized to access. A team can test those controls in an isolated environment using sample data before introducing real documents.
A document can also contain instructions designed to make an agent perform an action outside its assignment. Restricting the service that receives an action can prevent an unauthorized transfer even when the model treats text in a file as an instruction. That gives the organization a control it can test without assuming that the agent will interpret every document correctly.
