A Chinese-speaking threat actor is suspected of mounting a wave of cyber attacks against government organizations across Central Asia since January 2025, according to research published Friday by Russian cybersecurity firm Kaspersky. The targets span Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan and the Syrian Arab Republic, operating in sectors such as healthcare, research, government offices, ministries of foreign affairs, logistics, law-enforcement agencies, urban planning and facilities management, and public educational establishments.
The campaign relies on two previously unknown obfuscated backdoors, tracked as OctLurk and SilkLurk, as well as a specialized utility codenamed LurkProxy used to proxy network traffic. Kaspersky said the activity has not been linked to any known adversary or group, and the initial access vector used in the attacks is currently unknown.
“OctLurk and SilkLurk can download and inject additional plugins to perform further malicious actions, including launching command shells, performing file system activity, synthesizing keyboard and mouse events, network scanning, credential dumping, keylogging, password theft from browsers, email collection, and remote access,” Kaspersky researchers Saurabh Sharma and Yaroslav Kikel said.
Kaspersky’s analysis found OctLurk is injected into memory and deployed by means of a loader. The attackers first check internet connectivity to the domain dns.ssentialserv[.]xyz before executing a batch script that launches LurkProxy, which establishes contact with a remote server at 154.196.162[.]76 for command-and-control. Once running, OctLurk collects system information, encrypts it and sends it to a hard-coded C2 server at dns.multitoconference[.]com, and can load plugins into memory for command execution, file operations, clipboard gathering, screenshot capture and mouse movement.
Observed post-compromise activity includes fingerprinting the host, exporting successful logon events for remote interactive logons, harvesting password hashes from domain controllers with Impacket’s secretsdump.py tool, dropping a keylogger that masquerades as AnyDesk, decrypting passwords from Google Chrome and Mozilla Firefox, installing remote access via the Pandora RC agent, scanning networks with Fscan, and connecting to email servers to collect or manipulate messages.
LurkProxy can function as a reverse proxy in two modes, SOCKS5 or transparent, routing network traffic through a target address. SilkLurk, the third tool, is launched through a DLL side-loading sequence and connects to a C2 server specified in its configuration. Its post-compromise activity includes invoking cmd.exe to run PowerShell, connecting to shared network resources with administrative credentials, staging confidential documents, archiving them with WinRAR or 7-Zip, and dropping PlugX, a backdoor associated with Chinese hacking groups.
Kaspersky said it found infrastructure overlaps between the campaign and a prior set of attacks involving a C++-based implant codenamed SilentRaid, also known as MystRodX and TrustFall. “This overlap points to shared infrastructure across multiple OS-targeting campaigns, though it remains unclear whether these activities ran concurrently or at different times,” the company said.
“The emergence of the OctLurk and SilkLurk multi-plugin malware framework highlights how threat actors continuously refine their tactics to evade detection and maintain control over compromised networks,” Kaspersky added. Both backdoor families operate primarily in memory, leaving only a minimalistic loader on disk that relies on machine-specific data (OctLurk uses the drive serial number, SilkLurk uses the computer name) to decode payload locations, making reverse engineering and automated detection considerably harder.
Sources: The Hacker News, Kaspersky Securelist
discussion