Singapore-based cybersecurity firm CloudSEK uncovered the operation after discovering an exposed server belonging to Silent Lynx, a hacking group previously linked to espionage campaigns targeting Kyrgyzstan, Turkmenistan, Tajikistan, Armenia, Belarus and Russia. The server contained more than a dozen gigabytes of data, including stolen government documents, hacking tools and records showing how an attacker used an AI agent to automate parts of the operation.
According to the report published Wednesday, the operator relied on Hermes, an open-source AI agent configured to act as an offensive cybersecurity expert. The system mainly used AI models developed by Chinese company DeepSeek.
Unlike conventional chatbots, AI agents can execute commands, run software and carry out tasks on behalf of their users. The agent helped with reconnaissance, data collection and erasing traces of activity from compromised systems, researchers said. It was also configured to execute certain potentially destructive commands without requiring extra approval.
