SilkParasite Infrastructure Links SpiceRAT to Central Asian Targets
Hunt.io linked SpiceRAT, NodeEdgeRAT, and NomadRAT C2 servers to the SilkParasite campaign targeting Central Asian governments since mid-2022.
Hunt.io and researcher Guy Yasur mapped C2 infrastructure tying three of seven RAT families from Bitdefender's SilkParasite report through shared TLS certificates, parent domains, and a cloned RTX Corporation homepage. One certificate spoofing Uzbekistan's state railway was issued by TLC, a CA funded by China's CAICT, and domains impersonate state entities in Turkmenistan, Uzbekistan, Tajikistan, and Kyrgyzstan. Passive DNS pushes the campaign back to mid-2022, and the infrastructure overlaps China-nexus activity including FamousSparrow and IndigoZebra.
- Shared TLS certificates and parent domains link three RAT families to one SilkParasite campaign.
- Certificate spoofing Uzbekistan's railway was issued by TLC, a CA funded by China's CAICT.
- A cloned RTX Corporation homepage hash matched 13 servers across hosting providers and countries.
- Domains impersonate state entities in Turkmenistan, Uzbekistan, Tajikistan, and Kyrgyzstan.
- Infrastructure overlaps FamousSparrow and IndigoZebra; passive DNS extends activity to mid-2022.
- Threat actors
- FamousSparrowIndigoZebra
- Malware
- SpiceRATNodeEdgeRATNomadRAT
- Organizations
- CAICTRTX Corporation
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | devon.com | gy (sanly.oilgas‑tm[.]com), Uzbek administration (azure.adm‑devon[.]com), and even the Kyrgyz president’s residence (data.yntymak |
| domain | galkynysh.net | fic ministries and state enterprises. Examples include help.galkynysh[.]net (Galkynysh gas field, Turkmenistan), tmgaz‑server[.]com ( |
| domain | it.com | a deliberate procurement channel. Requests to ns2.asiainfo.it[.]com on 188.190.29[.]126 returned a full copy of RTX Corporati |
| domain | kg.com | e parent domains and certificates. For example, help.hoster‑kg[.]com (on 193.29.58[.]192) presented the same railway‑spoofing |
| domain | mfa.com | s field, Turkmenistan), tmgaz‑server[.]com (Türkmengaz), tm‑mfa[.]com (Turkmenistan’s Ministry of Foreign Affairs), and tojikte |
| domain | ordo.com | m), and even the Kyrgyz president’s residence (data.yntymak‑ordo[.]com). Bitdefender’s targeting came from lures and infection t |
| domain | server.com | .galkynysh[.]net (Galkynysh gas field, Turkmenistan), tmgaz‑server[.]com (Türkmengaz), tm‑mfa[.]com (Turkmenistan’s Ministry of Fo |
| domain | tdtu.org | tion of hoster‑kg[.]com, not a shared server. Similarly, kg.tdtu[.]org shares a parent domain with mineconom.tdtu[.]org, a Nomad |
| domain | tm.com | Additional domains impersonate Turkmen energy (sanly.oilgas‑tm[.]com), Uzbek administration (azure.adm‑devon[.]com), and even |
| domain | tojiktelecomtj.com | mfa[.]com (Turkmenistan’s Ministry of Foreign Affairs), and tojiktelecomtj[.]com (Tojiktelecom, Tajikistan). Additional domains impersonat |
| domain | uzrailwaystax.com | It impersonates Uzbekistan’s state railway authority (azure.uzrailwaystax[.]com) and was issued by TLC DV TLS CA, a CA wholly funded by C |
| ipv4 | 171.22.16.187 | 188.190.29[.]126 , 193.29.59[.]159 , 31.58.220[.]250 , and 171.22.16[.]187 . The five were active together in mid-March 2026, across |
| ipv4 | 188.190.29.126 | e procurement channel. Requests to ns2.asiainfo.it[.]com on 188.190.29[.]126 returned a full copy of RTX Corporation’s homepage, compl |
| ipv4 | 193.29.58.192 | ins and certificates. For example, help.hoster‑kg[.]com (on 193.29.58[.]192) presented the same railway‑spoofing certificate, while B |
| ipv4 | 193.29.59.159 | tive SpiceRAT servers: 46.30.191[.]230 , 188.190.29[.]126 , 193.29.59[.]159 , 31.58.220[.]250 , and 171.22.16[.]187 . The five were a |
| ipv4 | 31.58.220.250 | ers: 46.30.191[.]230 , 188.190.29[.]126 , 193.29.59[.]159 , 31.58.220[.]250 , and 171.22.16[.]187 . The five were active together in |
| ipv4 | 46.30.191.230 | 026, we observed a cluster of five active SpiceRAT servers: 46.30.191[.]230 , 188.190.29[.]126 , 193.29.59[.]159 , 31.58.220[.]250 , |
From the original article
4 min read at securityaffairs.com
Hunt. io links SpiceRAT, NodeEdgeRAT and NomadRAT to a four-year SilkParasite campaign targeting governments and critical sectors in Central Asia. Hunt.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.