[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fW7H600o4upsIvHy2qTNdwajOc4YiwdhgwT2cgAs4BOE":3},{"article":4,"iocs":49,"watch_terms":54,"solutions":55,"lesson":135},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"10523efe-3387-46c2-9279-0a9fc891be8e","Kazakhstan-linked hackers used AI agent to spy on Central Asian governments","kazakhstan-linked-hackers-used-ai-agent-to-spy-on-central-asian-governments-d60106","Suspected Kazakhstan-linked hackers used an artificial intelligence agent to help spy on Central Asian governments, steal sensitive documents and infiltrate critical infrastructure networks, according to new research.","Suspected Kazakhstan-linked hackers, identified as Silent Lynx, utilized an AI agent named Hermes to automate espionage activities against Central Asian governments. The group infiltrated networks in Tajikistan and Uzbekistan, stealing sensitive government documents and credentials. The AI agent assisted with reconnaissance, data collection, and trace erasure, and was controlled remotely via Telegram.","Kazakhstan-linked hackers used an AI agent to spy on Central Asian governments.","https:\u002F\u002Ftherecord.media\u002Fkazakhstan-hackers-central-asia","http:\u002F\u002Fcms.therecord.media\u002Fuploads\u002FCentral_Asia_7feabe2c24.jpg","2026-11-12T13:00:00+00:00","2026-11-12T14:00:16.264187+00:00",8,[17,20,23],{"name":18,"type":19},"Silent Lynx","threat_actor",{"name":21,"type":22},"DeepSeek","vendor",{"name":24,"type":25},"AI agent","technology","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":26,"icon":28,"name":29,"slug":30},null,"Nation-state","nation-state",[32,37,39,44],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":38},{"id":26,"icon":28,"name":29,"slug":30},{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":45},{"id":46,"icon":28,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50],{"type":51,"value":52,"context":53},"malware","Hermes","AI agent used by hackers for espionage",[21],{"controls":56,"vendors":134},[57,86,112],{"slug":58,"name":59,"problem":60,"products":61},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":87,"name":88,"problem":89,"products":90},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[91,96,104],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":92,"product_name":93,"url":94,"description":95},"falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":113,"name":114,"problem":115,"products":116},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[117,118,126],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",[],{"slug":136,"title":137,"body":138,"framework_refs":139,"framework_notes":145},"ai-powered-espionage-tool-automates-credential-theft-and-trace-erasure-against-government-networks","AI-Powered Espionage Tool Automates Credential Theft and Trace Erasure Against Government Networks","The Silent Lynx group deployed a custom AI agent called Hermes to automate reconnaissance, credential harvesting, document exfiltration, and evidence erasure inside compromised Central Asian government networks. The use of AI to orchestrate these tasks significantly accelerated the attack lifecycle while reducing the human footprint that defenders typically look for. Command-and-control was routed through Telegram, a legitimate messaging platform, making malicious traffic harder to distinguish from normal communications. This case demonstrates that AI-assisted attacks can outpace traditional detection capabilities, making robust behavioral monitoring and strict access controls essential for sensitive government environments.",[140,141,142,143,144],"MITRE ATT&CK T1567: Exfiltration Over Web Service","MITRE ATT&CK T1070: Indicator Removal","NIST SP 800-53 AU-9: Protection of Audit Information","CIS Control 13: Network Monitoring and Defense (v8)","NIS2 Article 21(2)(i)",{"NIS2 Article 21(2)(i)":146,"MITRE ATT&CK T1070: Indicator Removal":147,"MITRE ATT&CK T1567: Exfiltration Over Web Service":148,"CIS Control 13: Network Monitoring and Defense (v8)":149,"NIST SP 800-53 AU-9: Protection of Audit Information":150},"This point requires appropriate human resources security, access control, and asset management policies, which — if enforced with least privilege and MFA — would have significantly limited the attacker's ability to harvest credentials and move laterally through government networks.","The AI agent was specifically tasked with erasing traces of attacker activity, matching this technique's definition of adversaries deleting or modifying artifacts to avoid detection.","Hermes used Telegram as a command-and-control and exfiltration channel, which is precisely the technique this ATT&CK entry covers — abusing legitimate web services to move data out of victim environments.","Continuous monitoring of network traffic for anomalous outbound connections to Telegram and automated data-staging behaviors would have detected the AI agent's activities earlier in the attack chain.","This control requires that audit logs be protected against unauthorized modification or deletion, which would have limited the AI agent's ability to erase evidence of the intrusion."]