Organization

RTX Corporation

3 mentions in 7 days · 3 in 30 days · 3 total · first seen Sep 17, 2026 · last 45m ago

Timeline3 articles

SilkParasite Infrastructure Links SpiceRAT to Central Asian Targetsnew

Hunt.io linked SpiceRAT, NodeEdgeRAT, and NomadRAT C2 servers to the SilkParasite campaign targeting Central Asian governments since mid-2022.

Hunt.io and researcher Guy Yasur mapped C2 infrastructure tying three of seven RAT families from Bitdefender's SilkParasite report through shared TLS certificates, parent domains, and a cloned RTX Corporation homepage. One certificate spoofing Uzbekistan's state railway was issued by TLC, a CA funded by China's CAICT, and domains impersonate state entities in Turkmenistan, Uzbekistan, Tajikistan, and Kyrgyzstan. Passive DNS pushes the campaign back to mid-2022, and the infrastructure overlaps China-nexus activity including FamousSparrow and IndigoZebra.

Security Affairs14:16 UTC · 45m agoThreat actor in the wild 3 sources

SilkParasite Hackers Use SpiceRAT Infrastructure to Target Central Asian Governments and Energy Firms

Hunt.io links SpiceRAT C2 infrastructure to the China-nexus SilkParasite espionage cluster targeting Central Asian governments, telecoms, and energy firms.

Hunt.io analysis expanded the SpiceRAT command-and-control footprint tied to SilkParasite, a China-nexus espionage cluster (medium confidence per Bitdefender) targeting government, telecommunications, and energy entities across Central Asia. Five active servers coordinated from mid-March 2026 were clustered via reused hostnames, TLS certificates, and a byte-identical clone of RTX Corporation's webpage found on 13 IPs; a certificate for azure.uzrailwaystax[.]com appeared across eight servers. Domains impersonated Türkmengaz, Tojiktelecom, Turkmenistan's Foreign Ministry, and Uzbek and Kyrgyz bodies, with passive DNS history dating to mid-2022. Impersonated organizations were not confirmed as compromised; Cisco Talos previously linked SpiceRAT to SneakyChef's LNK/HTA infection chains.

GBHackersupdated 14:16 UTC · 45m agofirst 13:12 UTC · 1h agoThreat actor in the wild 3 sources

SilkParasite-Linked Malware Infrastructure Traced Back Four Years Across Central Asia

Hunt.io links SpiceRAT C2 servers to China-nexus SilkParasite espionage targeting Central Asian governments, with related infrastructure active since 2022.

Hunt.io and researcher Guy Yasur traced a cluster of SpiceRAT command-and-control servers active from late 2025 to August 2026 to infrastructure linked to the China-nexus SilkParasite espionage operation. Shared parent domains, a certificate resembling an Uzbek railway entity, and a cloned RTX Corporation homepage appearing on 13 servers connect SpiceRAT systems to NodeEdgeRAT and NomadRAT infrastructure. Passive DNS records show related subdomains as early as mid-2022, suggesting the infrastructure has existed for at least four years. Hostnames impersonate government, energy and telecom targets across Turkmenistan, Tajikistan, Uzbekistan, Kyrgyzstan and Kazakhstan.

Cyber Security Newsupdated 14:16 UTC · 45m agofirst 12:26 UTC · 2h agoThreat actor in the wild 3 sources

Appears with

product SpiceRAT 3 product NomadRAT 3 product NodeEdgeRAT 3 vendor Hunt.io 3 threat actor FamousSparrow 2 threat actor IndigoZebra 2 threat actor SilkParasite 2 vendor Bitdefender 2 organization CAICT 1 organization Cisco Talos 1 organization Hunt.io 1 product BloodAlchemy 1 malware SpiceRAT 1 malware NomadRAT 1 product RTX Corporation 1 product SilkParasite 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.