Executive Summary

An exposed open directory belonging to Silent Lynx, a Central Asia-focused espionage cluster, gave CloudSEK an inside view of the group's operations through October 2026. The directory held the group's tooling alongside data from active intrusions into government and critical infrastructure organisations across the region, and the AI agent the operator relied on to run them.

We assess with high confidence that the directory belongs to a Silent Lynx operator, based on implant code markers and build paths shared with published samples. We assess with medium confidence that the operator has a Kazakhstan nexus: the operation runs in Russian, and the operator's own test traffic came from a residential Kazakh connection, which supports existing vendor assessments. The collection priorities, spanning transport, defence correspondence and resource ministries in neighbouring states, point to regional intelligence gathering rather than financial motive.

Key Findings

• The exposed directory provided a timestamped record of the operator's tooling, intrusions and AI agent conversations spanning April to October 2026.
• The operator held persistent, domain-level access to transport-sector networks and used a single compromised employee account to collect government correspondence at scale, including defence-related documents.
• A government-run geospatial platform was taken to host-level command execution through a webshell and database access, with persistence in place at the time of exposure.
• The implants match the group's known Laplas and Chvost families, alongside a previously unreported generation of service-installer implants and an AMSI-bypass delivery variant.
• Lures impersonating Turkmenistan Railways and a Turkmen regional administration were built and tested in October 2026, pointing to an upcoming campaign against Turkmenistan.
• A self-hosted AI agent running on DeepSeek handled reconnaissance, collection and log cleanup, with destructive commands pre-approved.
• Server logins were routed through Tor, but the operator's own test sessions came from a residential Kazakhtelecom connection.

Background: Silent Lynx in prior reporting

Silent Lynx has been tracked publicly since January 2025 under several vendor names. Reporting has centred on spear-phishing of Central Asian government bodies with LNK and archive lures that lead to lightweight reverse shells.

The exposed server

The server 89[.]125[.]213[.]123 is a Debian VPS on Baxet Group infrastructure, exposed without authentication on port 8088. It held more than a dozen gigabytes across hundreds of thousands of files, with no separation between tooling, victim data and operator workspace.

‍

Delivery kit

The fish/ folder holds the group's complete phishing chain: a PDF-themed shortcut that opens a decoy and runs a PowerShell reverse shell, the listener that receives the shell, and lures built for Turkmenistan. Shortcut names, test files and callback logs show the operator building and testing the chain one step at a time.

Infection chain

1. The target receives a shortcut with a PDF icon, packed in a ZIP, a password-protected archive or an ISO image.
2. Opening the shortcut loads a decoy PDF from the operator's server and starts a hidden PowerShell process.
3. PowerShell downloads P.ps1 from the same server and runs it in memory.
4. P.ps1 drops and opens a second decoy, Отчёт_2026.pdf ("Report_2026.pdf"), then opens a raw TCP shell to the operator.
5. On the operator's side, a dispatcher script runs whoami, hostname and ipconfig on every new shell and saves the output.

Prior reporting: Seqrite's Operation Peek-a-Baku and the Talos "Chain C" both describe shortcuts that launch PowerShell to fetch a remote script hosted on GitHub. This kit uses the same pattern but serves the script from the operator's own server.

Building the shortcuts

The shortcut names record the build order, from execution tests to the armed versions:

‍

‍

‍