VULNpocalypse
LowBreach / campaignMonitoring

CloudSEK reports exposed Silent Lynx server tied to Central Asia espionage

CloudSEK reports an exposed Silent Lynx server tied to Central Asia espionage; defenders there can check logs for the listed IP address.

Published
Exploitation
Not independently confirmed. CloudSEK says the server held data from active intrusions, but no victim or third party has confirmed this in the sources.

What happened

According to CloudSEK, an open directory belonging to a Central Asia-focused espionage cluster called Silent Lynx was exposed without authentication on port 8088 of the server 89[.]125[.]213[.]123. CloudSEK says it used that exposure to see the group’s operations through October 2026 (CloudSEK). This is a single vendor report. No independent outlet, victim or government body confirms it in the sources provided.

CloudSEK says the directory held tooling, data from intrusions into government and critical infrastructure organisations, and logs from an AI agent. It describes the agent as self-hosted, running on DeepSeek, and used for reconnaissance, collection and log cleanup (CloudSEK).

Other claims in the report, all attributed to CloudSEK:

  • It says the operator held persistent, domain-level access to transport-sector networks, and that a single compromised employee account was used to collect government correspondence, including defence-related documents.
  • It says a government-run geospatial platform was taken to host-level command execution through a webshell, with persistence in place at the time of exposure. The report summary names Tajik railway networks and Uzbekistan’s Smart Forestry platform.
  • It describes a phishing chain built on shortcut (LNK) files with a PDF icon, packed in a ZIP, a password-protected archive or an ISO image. Opening the shortcut shows a decoy PDF and starts hidden PowerShell, which downloads a script called P.ps1 from the operator’s server and opens a raw TCP shell to 89[.]125[.]213[.]123 on port 46125.
  • It says one shortcut variant sets amsiInitFailed through reflection before the download, which switches off script scanning for the session. CloudSEK says public reporting on Silent Lynx does not document this variant.
  • It says lures impersonating Turkmenistan Railways and a Turkmen regional administration were built and tested in October 2026, and reads this as pointing to an upcoming campaign against Turkmenistan.
  • It says it has high confidence the directory belongs to a Silent Lynx operator, and medium confidence in a Kazakhstan nexus.

Not confirmed: the victim organisations have not confirmed any intrusion in the sources. The initial access methods for the intrusions are not stated in the portion of the report provided. The full list of affected organisations is also not confirmed. The source text was truncated, so details beyond the sections above are not confirmed here.

Am I affected?

The sources do not give a complete victim list. CloudSEK says the activity targets Central Asian governments and critical infrastructure, and names Tajik railway networks, Uzbekistan’s Smart Forestry platform and Turkmenistan-themed lures (CloudSEK). If you are outside that profile, the report gives no indication that you are affected.

Evidence of exposure would be any of the following, as CloudSEK describes them:

  • Traffic to 89[.]125[.]213[.]123, especially on port 46125 (the reverse shell) or port 8088 (the exposed directory).
  • Shortcut files with a PDF icon delivered inside ZIP, password-protected archive or ISO files.
  • Hidden PowerShell downloading and running P.ps1 in memory.

What to do now

  1. Search proxy, DNS and firewall logs for 89[.]125[.]213[.]123, including ports 46125 and 8088. Treat a match as a lead to investigate, not as proof of compromise.
  2. Look for shortcut files with PDF icons that arrive in ZIP, password-protected archive or ISO form, and for hidden PowerShell processes that fetch a script named P.ps1.
  3. If PowerShell logging is enabled, check for script blocks that set amsiInitFailed through reflection, which CloudSEK describes in one variant.
  4. If you are in a Turkmenistan-linked organisation, be aware of railway ticket and regional administration report lures. CloudSEK says these were in testing in October 2026.
  5. Read the full CloudSEK report for further indicators, since this advisory covers only the parts of it available to us. Treat its attributions as the vendor’s assessment until confirmed elsewhere.

Sources