CloudSEK Traces Exposed Server to Silent Lynx Espionage Cluster

Nov 11, 2026 · Original article ↗

Summary

CloudSEK says an unauthenticated directory exposed Silent Lynx tooling, intrusion records and AI-agent logs, revealing access to railway and government systems in Central Asia. It links the server to the cluster with high confidence based on code markers and build paths

Key points

The exposed Debian server directory, accessible without authentication on port 8088, contained operator tools, victim data, credentials and AI-agent records.
CloudSEK attributes the server to Silent Lynx with high confidence, citing implant markers and build paths matching published Chvost and Laplas samples.
Server records indicate the operator maintained access to Tajikistan's national railway network and collected internal reports, correspondence and credentials.
A railway employee account was used to collect thousands of documents from Tajikistan's government document platform, including correspondence routed through the Ministry of Defence.
On Uzbekistan's Smart Forestry platform, the operator used a webshell and PostgreSQL access to obtain host-level command execution; CloudSEK says root access was not obtained.
The phishing chain used shortcut files in archives or ISO images to open decoys and run hidden PowerShell; a test variant included an AMSI bypass.
Logs show a Hermes AI agent using DeepSeek models to support reconnaissance, collection and cleanup, with destructive commands allowed without confirmation.

Article Details

Attack Vectors: PDF-themed LNK shortcuts were packaged in ZIP archives, password-protected archives, or an ISO; opening one displayed a decoy and launched hidden PowerShell, which downloaded P.ps1 from the operator's server and ran it in memory.
An AMSI-bypass shortcut variant set amsiInitFailed through reflection before downloading the script.
P.ps1 opened a raw TCP reverse shell and executed received commands with Invoke-Expression.
Laplas and Chvost implants called back over TLS and spawned processes; service wrappers installed shells as Windows services.
The Tajikistan Railway intrusion used Ligolo tunnels and SMB enumeration; the operator obtained administrative access using plaintext passwords and NTLM hashes.
The operator accessed the government document platform through a railway employee's SSO credentials and collected documents despite weak per-document authorization and unauthenticated attachment access.
On Uzbekistan's Smart Forestry host, the operator deployed malicious WAR files and a webshell, used PostgreSQL superuser access with COPY FROM PROGRAM to open a reverse shell, and added cron callbacks.
A Telegram bot provided a tasking channel for the Hermes agent, while document collectors posted progress updates to Telegram.
Defensive Notes: Review document-level authorization and require authentication for attachment services; the article reports weak checks and attachments served without authentication.
Investigate railway networks for unauthorized SMB access, exposed NTDS-format credential dumps, and administrative access obtained with plaintext passwords or NTLM hashes; the article also reports SMBv1 and disabled signing on many hosts.
Inspect affected web and database hosts for malicious WAR files, webshells, PostgreSQL COPY FROM PROGRAM activity, and unauthorized cron callbacks.
Hunt for unauthorized Windows service installations and Laplas- or Chvost-family implants, including TLS reverse-shell activity.
Review exposed or reused credentials for network equipment; the operator reportedly harvested credentials for upstream ISP devices using default passwords.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`foreverpeace[.]ru`	Domain used for the operator's self-hosted NetBird mesh control plane and Pangolin reverse proxy.
IPV4	`134[.]17[.]14[.]24`	Unattributed second IP called by cron entries on the compromised Smart Forestry host; ownership is unconfirmed.
IPV4	`89[.]125[.]213[.]123`	Operator-controlled server used to host payloads and phishing files, receive callbacks, and conduct scanning.
SHA256	`19b68e504e1512dc19feef6b1da0f67f876191a937fdcd64ffb965c12d1f0bf0`	Hash of CoreMessaging.exe, a renamed netsrvc service wrapper from late August 2026.
SHA256	`27dc5628adc666da702c9a33e8f96bb87087ac68a7064f99b91fb76b932aef6e`	Hash of ssdpdrv.exe, a 32-bit Chvost-family shell.
SHA256	`368cb250f7b962c551dd721f6f62224a936dd7cffb8e0d92f223d82b991a0e6d`	Hash of the executable lure referencing the Ahal regional administration's state programme report.
SHA256	`5d8a2df90fa3cf913e2b5764e586ee3405a101294909df091060bd3e3d1a44c1`	Hash of netsrvc.exe, a malicious service wrapper used to install shells.
SHA256	`af2822560bc0e44b600eefbe0170d3526e035704b533a806f9d455da6ac30d2c`	Hash of srvdriv.exe, a Laplas build for Tajikistan from April 2026.
SHA256	`bf7fe6b518676a3e6d40459ac16b491e62d0e0a222ebb243a44d64ac33aed826`	Hash of CoreMessaging.exe, a renamed netsrvc service wrapper from early September 2026.
SHA256	`e6907392677134a1a4ffec14d303471352eee90da09db1991eb47486611f2e0d`	Hash of srvdriv.exe, a Laplas railway build from early September 2026.
SHA256	`efc1bbb873e9b691657a66e987b0ea87c454bb16e89126d1a41bcaa9bae9fab1`	Hash of ssdspsrv.exe, an older malicious service wrapper.
SHA256	`f26756cabe92842e25d82bee5f65ef9c22c80aec895386b9840b471b42e01463`	Hash of srvdriv.exe, a Laplas railway build from late August 2026.
URL	`hxxp[:]//89[.]125[.]213[.]123:8080/decoy.pdf`	Operator-hosted decoy PDF used in the malicious shortcut delivery chain.
URL	`hxxp[:]//89[.]125[.]213[.]123:8080/P.ps1`	Operator-hosted PowerShell stage downloaded and executed by the LNK delivery chain.