New findings published on October 14 suggest that hackers spying on Central Asian governments have been operating from Kazakhstan. The group, named Silent Lynx by researchers, used hijacked official email accounts to break into government computers.
The hackers left some of their own working files unprotected online, allowing researchers to examine how they prepared and adapted their attacks. Their targets included agencies holding information about regional diplomacy and natural resources.
The investigation was conducted by cybersecurity firm Recorded Future and Talos, a security research group at computer networking company Cisco. The two companies, both based in the United States, have not established whether the hackers were working for a government.
Hijacked Official Email Accounts
Seqrite, an Indian cybersecurity provider, gave the hackers the name Silent Lynx in January 2025. Its investigation found that they had sent malicious emails from an employee’s hijacked account at Kyrgyzstan’s central bank. A message from a real official’s address could make a dangerous attachment look like routine business.
One message claimed that correspondence intended for Kyrgyzstan’s Finance Ministry had been sent to the central bank by mistake. Attached was what appeared to be a United Nations meeting invitation, packaged with a malicious program. Running it would allow the hackers to issue instructions to the recipient’s computer and send files through a chat they controlled on Telegram, the messaging app.
In related attacks, investigators saw the hackers copying documents and collecting passwords saved in web browsers. One victim had left a file called passwords.txt on the desktop, which the attackers stole and could use to access other accounts. German cybersecurity company VMRay and independent researcher Pol Thill documented these thefts in February 2026.
The Files That Gave Them Away
Researchers Ashley Shen and Julian-Ferdinand Vögele, from Talos and Recorded Future, respectively, found three online folders where the hackers had left attack software and other tools publicly accessible. A program in one folder led them to an account on GitHub, a website where programmers store and share code.
GitHub preserves earlier versions of files, so the researchers could see how the hackers had revised their software and changed the internet addresses used to control infected computers. Moving to a new address did not erase the record, allowing investigators to continue tracking the operation.
An attack file identified in April exploited a weakness in WinRAR, a program for unpacking compressed files. It was designed to install software that would start when the user next signed in, allowing the hackers to send instructions to the computer. A July 2025 update had fixed the weakness in WinRAR, but the attack could still work on computers where users had not updated the program.
VMRay’s earlier investigation found that some operators had infected their own computers, exposing their browsing histories to the researchers.
What Were They Looking For?
The victims of those earlier attacks included water and hydropower institutions in Kyrgyzstan and water-related bodies in Uzbekistan and Tajikistan. Access to water records could be valuable in a region where decisions upstream affect farming far downstream.
Kazakhstan’s Ministry of Water Resources and Irrigation estimates that 44.3% of the country’s long-term average surface-water supply comes from rivers flowing across its borders. This year, for example, Kazakhstan, Tajikistan, and Uzbekistan agreed on summer releases from the Bahri Tojik reservoir to irrigate farmland in southern Kazakhstan.
Recorded Future’s new report identified computers at a Tajik economic-development institution communicating with servers used by the hackers. It detected activity involving computer systems associated with Uzbekistan’s Smart Forestry initiative, which collects geographic information about forest lands. These connections did not establish what information, if any, had been stolen.
An August 2025 document posed as a cooperation proposal from Turkmenistan’s state oil concern to Russia’s Orsk Oil Refinery. Talos suggests the lure may reflect interest in regional fuel supplies and the effects of the war in Ukraine on Kazakhstan’s energy security. The document does not prove either organization was successfully breached.
Recorded Future believes the hackers were gathering intelligence about regional diplomacy and natural resources, although the researchers could not establish precisely what information the operators wanted.
The Trail to Kazakhstan
In 2022, just 86 seconds after a program used by the hackers was created, it was uploaded from Kazakhstan to VirusTotal, a service for checking suspicious files. Recorded Future and Talos describe the upload in their joint research paper and believe it was an attacker testing a new tool.
GitHub’s records show that the hackers usually saved revised versions of their attack programs between 9 a.m. and 6 p.m. Kazakhstan time, matching a daytime office schedule. A saved record also showed an operator trying to enter English commands while the keyboard was set to Russian. Talos suspects the hackers were working from Kazakhstan but rates its assessment at medium confidence.
Talos and Recorded Future expect the campaign to continue, citing the group’s persistence and adoption of new ways to break into computer systems. They identify government agencies managing diplomacy and natural resources as likely targets for further attacks.