An exposed open directory from the Silent Lynx espionage group revealed extensive operations targeting Central Asian governments and critical infrastructure through October 2026. The directory contained active intrusion tooling, collected government correspondence including defense documents, and implants related to known malware families Laplas and Chvost, plus unreported variants. The operator used a self-hosted AI agent named DeepSeek for reconnaissance, collection, and log cleanup. The group maintained persistent access to transport networks and compromised a government geospatial platform. Lures impersonating Turkmenistan Railways were prepared for future campaigns. Operational security failures exposed the entire operation, including storing all data on one server and leaving developer paths in binaries. The activity is linked to a Kazakhstan nexus based on language and network traffic analysis.
