Hackers Allegedly Use AI-Powered Tools to Steal Thousands of Tajik Government Documents

Cybersecurity researchers have uncovered an alleged cyber espionage operation in which hackers believed to have links with Kazakhstan used artificial intelligence to infiltrate government systems in Tajikistan. The attackers reportedly obtained more than 2,000 confidential documents, highlighting the growing use of autonomous AI technologies in sophisticated cyberattacks.

According to cybersecurity firm CloudSek, the operation was linked to a hacking group known as Silent Lynx. Investigators found evidence suggesting that the group employed Hermes, an open-source autonomous AI framework, to automate several stages of the intrusion, including reconnaissance, attack planning and data extraction.

The AI-powered system reportedly helped the attackers develop customised software capable of locating, downloading and organising sensitive government files. Researchers discovered evidence of the operation after the hackers inadvertently exposed a server containing information about their activities.

The investigation indicated that reconnaissance activities began around mid-August 2026, before the attackers allegedly gained access to Tajikistan's electronic document management system. The compromised platform reportedly contained official records and communications belonging to government institutions.

CloudSek attributed the activity to Kazakhstan-linked operators based on technical evidence and behavioural patterns observed during its investigation. However, the suspected geographical connection has not been independently confirmed by the governments concerned.

The incident raises concerns about the increasing accessibility of advanced cyber espionage capabilities through artificial intelligence. By automating complex technical processes, AI agents can potentially reduce the time and expertise required to execute coordinated attacks.

The findings also underscore the growing challenges organisations face in securing sensitive digital infrastructure against increasingly automated cyber threats.

11-11-2026