SilkParasite-Linked Malware Infrastructure Traced Back Four Years Across Central Asia
AI summary · glm-5.3-flashSummaries by Vani AI
Hunt.io links SpiceRAT C2 servers to China-nexus SilkParasite espionage targeting Central Asian governments, with related infrastructure active since 2022.
Hunt.io and researcher Guy Yasur traced a cluster of SpiceRAT command-and-control servers active from late 2025 to August 2026 to infrastructure linked to the China-nexus SilkParasite espionage operation. Shared parent domains, a certificate resembling an Uzbek railway entity, and a cloned RTX Corporation homepage appearing on 13 servers connect SpiceRAT systems to NodeEdgeRAT and NomadRAT infrastructure. Passive DNS records show related subdomains as early as mid-2022, suggesting the infrastructure has existed for at least four years. Hostnames impersonate government, energy and telecom targets across Turkmenistan, Tajikistan, Uzbekistan, Kyrgyzstan and Kazakhstan.
Key facts
- Hunt.io and Guy Yasur tied SpiceRAT servers to the SilkParasite espionage operation via infrastructure analysis.
- Shared domains, reused certificates and a cloned RTX homepage connect SpiceRAT, NodeEdgeRAT and NomadRAT systems.
- Passive DNS extends the timeline to mid-2022, suggesting SilkParasite is a newer label for a longer-running effort.
- Infrastructure names impersonate government, energy and telecom organizations in five Central Asian countries.
- Defenders are advised to hunt published IoCs in DNS and certificate data and restrict remote-access exposure.
- ATT&CK
- T1566.001 Spearphishing AttachmentT1204.002 User Execution: Malicious FileT1219 Remote Access Software
- Vendors
- Hunt.io
- Products
- SpiceRATNodeEdgeRATNomadRAT
- Threat actors
- SilkParasiteIndigoZebraFamousSparrow
- Organizations
- RTX Corporation
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | adm-devon.com | ated with Uzbek administration-themed spoofing Domain azure.adm-devon[.]com Uzbek administration-themed domain IP Address 5.183.95[.] |
| domain | cwisuz.com | ]net Domain impersonating the Galkynysh gas field Domain kg.cwisuz[.]com Domain observed on the same host IP Address 45.153.127[.] |
| domain | devon-uz.com | .]com NodeEdgeRAT-related sibling hostname Domain uzrailway.devon-uz[.]com BloodAlchemy-related railway-themed domain SHA-256 Hash 2 |
| domain | dushanbeidc.org | sharing the LokiDev self-signed certificate Domain normativ.dushanbeidc[.]org Domain impersonating Tajikistan’s national IT hub project |
| domain | galkynysh.net | ciated with Central Asian energy-themed domains Domain help.galkynysh[.]net Domain impersonating the Galkynysh gas field Domain kg.cw |
| domain | hoster-kg.com | Host presenting the spoofed railway certificate Domain help.hoster-kg[.]com Domain linked to NodeEdgeRAT registration activity Domain |
| domain | hpsupporter.com | Host with high-numbered remote desktop exposure Domain api.hpsupporter[.]com Support-themed infrastructure domain IP Address 46.30.191 |
| domain | infocomkg.org | st with high-numbered remote desktop exposure Domain center.infocomkg[.]org Kyrgyzstan communications-themed domain Domain kg.tdtu[.] |
| domain | it.com | e RTX Corporation impersonation page hosted on ns2.asiainfo.it[.]com (Source – Hunt.io) The certificate was issued by TLC, a c |
| domain | minings.blog | eRAT host serving the copied RTX page Domain infrastructure.minings[.]blog Domain observed on copied RTX page infrastructure IP Addr |
| domain | mpekz.online | ssociated with Kazakh government-themed spoofing Domain gov.mpekz[.]online Kazakhstan government-themed domain IP Address 46.30.191[ |
| domain | natcommunzu.com | st associated with Uzbek telecom-themed spoofing Domain tmk.natcommunzu[.]com Uzbekistan communications-themed domain IP Address 46.30. |
| domain | oilgas-tm.com | associated with Turkmen energy-themed spoofing Domain sanly.oilgas-tm[.]com Turkmen energy-themed domain IP Address 45.86.162[.]141 H |
| domain | panterstationary.online | 31.59.185[.]224 Host serving the copied RTX page Domain ns.panterstationary[.]online Domain observed on copied RTX page infrastructure Domain |
| domain | plan-mail.com | 58.209[.]28 Host serving the copied RTX page Domain infoxxe.plan-mail[.]com Domain observed on copied RTX page infrastructure Domain |
| domain | postmfa.com | Host with high-numbered remote desktop exposure Domain mail.postmfa[.]com Foreign affairs-themed mail domain IP Address 45.153.127[ |
| domain | presldent.info | t associated with presidential-themed spoofing Domain state.presldent[.]info Presidential-themed typosquatting domain IP Address 46.30 |
| domain | skycom.support | torical resolution for ns2.asiainfo.it[.]com Domain manager.skycom[.]support SpiceRAT-related hostname IP Address 194.68.225[.]168 His |
| domain | sozandagon.org | associated with Tajikistan-themed spoofing Domain normativ.sozandagon[.]org Tajikistan-themed domain IP Address 192.121.87[.]172 Host |
| domain | taustas.com | omain observed on copied RTX page infrastructure Domain pro.taustas[.]com Domain observed on copied RTX page infrastructure IP Addr |
| domain | tdtu.org | mkg[.]org Kyrgyzstan communications-themed domain Domain kg.tdtu[.]org Domain sharing a parent domain with NomadRAT infrastructu |
| domain | tmgaz-server.com | serving copied RTX page and spoofed certificate Domain www.tmgaz-server[.]com Domain impersonating Türkmengaz IP Address 46.30.188[.]54 |
| domain | tojiktelecomtj.com | 46.30.188[.]54 Host serving the copied RTX page Domain www.tojiktelecomtj[.]com Domain impersonating Tojiktelecom IP Address 31.58.209[.] |
| domain | uzrailwaystax.com | ss 2.58.14[.]95 Hunt.io-detected SpiceRAT host Domain azure.uzrailwaystax[.]com Spoofed Uzbek railway-themed domain IP Address 31.59.185[ |
| domain | www.tm-mfa.com | s 185.243.114[.]124 Host serving the copied RTX page Domain www[.]tm-mfa[.]com Domain observed on copied RTX page infrastructure IP Ad |
| domain | yntymak-ord.com | ciated with Kyrgyz presidential-themed spoofing Domain data.yntymak-ord[.]com Kyrgyz presidential residence-themed domain IP Address 19 |
| domain | yntymak-ordo.com | ated with Kyrgyz presidential-themed spoofing Domain center.yntymak-ordo[.]com Kyrgyz presidential residence-themed domain IP Address 45 |
| domain | ytnymak-ord.com | ciated with Kyrgyz presidential-themed spoofing Domain link.ytnymak-ord[.]com Kyrgyz presidential residence-themed domain IP Address 19 |
| ipv4 | 171.22.16.187 | iceRAT server observed in the March 2026 cluster IP Address 171.22.16[.]187 SpiceRAT server observed in the March 2026 cluster Domain |
| ipv4 | 185.122.185.36 | Hostname associated with SpiceRAT infrastructure IP Address 185.122.185[.]36 Historical resolution for ns2.asiainfo.it[.]com IP Addres |
| ipv4 | 185.243.112.220 | Earliest related subdomain observed in July 2022 IP Address 185.243.112[.]220 Historical infrastructure host Domain support.natcommunzu |
| ipv4 | 185.243.112.253 | Subdomain under the communications-themed domain IP Address 185.243.112[.]253 Historical SpiceRAT-related infrastructure host Domain st |
| ipv4 | 185.243.114.124 | 9382 Hash of the copied RTX Corporation web page IP Address 185.243.114[.]124 Host serving the copied RTX page Domain www[.]tm-mfa[.]co |
| ipv4 | 185.243.114.238 | s 31.57.92[.]84 Host serving the copied RTX page IP Address 185.243.114[.]238 Host sharing the LokiDev self-signed certificate Domain n |
| ipv4 | 185.243.115.156 | omain observed on copied RTX page infrastructure IP Address 185.243.115[.]156 Host serving the copied RTX page IP Address 45.153.125[.] |
| ipv4 | 185.253.116.145 | Kyrgyzstan communications-themed service domain IP Address 185.253.116[.]145 Infrastructure host associated with related domains Domai |
| ipv4 | 185.253.117.32 | info Presidential-themed typosquatting subdomain IP Address 185.253.117[.]32 Historical host for presidential-themed spoofing Domain i |
| ipv4 | 188.190.18.208 | s 2.58.15[.]172 Host serving the copied RTX page IP Address 188.190.18[.]208 Host serving copied RTX page and spoofed certificate Doma |
| ipv4 | 188.190.29.126 | iceRAT server observed in the March 2026 cluster IP Address 188.190.29[.]126 SpiceRAT infrastructure and cloned RTX page host IP Addre |
| ipv4 | 192.121.87.172 | rmativ.sozandagon[.]org Tajikistan-themed domain IP Address 192.121.87[.]172 Host associated with Kyrgyz presidential-themed spoofing |
| ipv4 | 193.29.56.119 | Host presenting the spoofed railway certificate IP Address 193.29.56[.]119 Host presenting the spoofed railway certificate IP Addres |
| ipv4 | 193.29.57.159 | info Presidential-themed typosquatting subdomain IP Address 193.29.57[.]159 Host associated with Uzbek telecom-themed spoofing Domain |
| ipv4 | 193.29.57.182 | Host presenting the spoofed railway certificate IP Address 193.29.57[.]182 Host presenting the spoofed railway certificate Domain he |
| ipv4 | 193.29.58.217 | ]com Kyrgyz presidential residence-themed domain IP Address 193.29.58[.]217 Host associated with Kyrgyz presidential-themed spoofing |
| ipv4 | 193.29.59.159 | SpiceRAT infrastructure and cloned RTX page host IP Address 193.29.59[.]159 SpiceRAT server observed in the March 2026 cluster IP Add |
| ipv4 | 193.29.59.248 | .]org Related domain under the tdtu[.]org parent IP Address 193.29.59[.]248 Infrastructure host associated with related domains Domai |
| ipv4 | 194.14.217.119 | storical resolution for manager.skycom[.]support IP Address 194.14.217[.]119 Historical resolution for manager.skycom[.]support SHA-25 |
| ipv4 | 194.14.217.199 | ing a parent domain with NomadRAT infrastructure IP Address 194.14.217[.]199 Infrastructure host associated with Kyrgyzstan-themed spo |
| ipv4 | 194.68.225.168 | nager.skycom[.]support SpiceRAT-related hostname IP Address 194.68.225[.]168 Historical resolution for manager.skycom[.]support IP Add |
| ipv4 | 194.68.44.133 | ported SpiceRAT host serving the copied RTX page IP Address 194.68.44[.]133 Reported SpiceRAT host serving the copied RTX page Domain |
| ipv4 | 194.71.107.243 | Historical resolution for ns2.asiainfo.it[.]com IP Address 194.71.107[.]243 Historical resolution for ns2.asiainfo.it[.]com Domain ma |
| ipv4 | 195.88.191.250 | m-devon[.]com Uzbek administration-themed domain IP Address 195.88.191[.]250 Host associated with Turkmen energy-themed spoofing Domai |
| ipv4 | 195.88.191.70 | ]com Kyrgyz presidential residence-themed domain IP Address 195.88.191[.]70 Host associated with Kyrgyz presidential-themed spoofing |
| ipv4 | 2.58.14.95 | omain observed on copied RTX page infrastructure IP Address 2.58.14[.]95 Hunt.io-detected SpiceRAT host Domain azure.uzrailwaystax |
| ipv4 | 2.58.15.101 | info Presidential-themed typosquatting subdomain IP Address 2.58.15[.]101 Historical host for presidential-themed spoofing Domain c |
| ipv4 | 2.58.15.129 | orter[.]com Support-themed infrastructure domain IP Address 2.58.15[.]129 Infrastructure host associated with support-themed spoofi |
| ipv4 | 2.58.15.172 | omain observed on copied RTX page infrastructure IP Address 2.58.15[.]172 Host serving the copied RTX page IP Address 188.190.18[.] |
| ipv4 | 31.57.92.84 | .]20 Reported SpiceRAT host and certificate host IP Address 31.57.92[.]84 Host serving the copied RTX page IP Address 185.243.114[. |
| ipv4 | 31.58.209.28 | elecomtj[.]com Domain impersonating Tojiktelecom IP Address 31.58.209[.]28 Host serving the copied RTX page Domain infoxxe.plan-mail |
| ipv4 | 31.58.220.250 | iceRAT server observed in the March 2026 cluster IP Address 31.58.220[.]250 SpiceRAT server observed in the March 2026 cluster IP Add |
| ipv4 | 31.59.185.224 | aystax[.]com Spoofed Uzbek railway-themed domain IP Address 31.59.185[.]224 Host serving the copied RTX page Domain ns.panterstationa |
| ipv4 | 45.153.125.20 | omain observed on copied RTX page infrastructure IP Address 45.153.125[.]20 Reported SpiceRAT host and certificate host IP Address 31 |
| ipv4 | 45.153.125.200 | 5.243.115[.]156 Host serving the copied RTX page IP Address 45.153.125[.]200 Reported SpiceRAT host serving the copied RTX page IP Add |
| ipv4 | 45.153.127.186 | kg.cwisuz[.]com Domain observed on the same host IP Address 45.153.127[.]186 Host associated with Kazakh government-themed spoofing Do |
| ipv4 | 45.153.127.38 | ]com Kyrgyz presidential residence-themed domain IP Address 45.153.127[.]38 Host associated with Uzbek administration-themed spoofing |
| ipv4 | 45.153.127.99 | postmfa[.]com Foreign affairs-themed mail domain IP Address 45.153.127[.]99 Host with high-numbered remote desktop exposure Domain ce |
| ipv4 | 45.67.230.185 | zu[.]com Related communications-themed subdomain IP Address 45.67.230[.]185 Historical infrastructure host Domain uz.natcommunzu[.]co |
| ipv4 | 45.86.162.141 | nly.oilgas-tm[.]com Turkmen energy-themed domain IP Address 45.86.162[.]141 Host with high-numbered remote desktop exposure Domain ma |
| ipv4 | 45.86.162.249 | orter[.]com Support-themed infrastructure domain IP Address 45.86.162[.]249 Infrastructure host associated with support-themed spoofi |
| ipv4 | 45.86.163.87 | info Presidential-themed typosquatting subdomain IP Address 45.86.163[.]87 Historical host for presidential-themed spoofing Domain c |
| ipv4 | 46.30.188.54 | gaz-server[.]com Domain impersonating Türkmengaz IP Address 46.30.188[.]54 Host serving the copied RTX page Domain www.tojiktelecomt |
| ipv4 | 46.30.189.191 | Serial number of the spoofed railway certificate IP Address 46.30.189[.]191 Host associated with presidential-themed spoofing Domain |
| ipv4 | 46.30.190.170 | zu[.]com Uzbekistan communications-themed domain IP Address 46.30.190[.]170 Historical host for Uzbek telecom-themed spoofing Domain |
| ipv4 | 46.30.191.214 | [.]info Presidential-themed typosquatting domain IP Address 46.30.191[.]214 Historical host for presidential-themed spoofing Domain c |
| ipv4 | 46.30.191.230 | f compromise (IoCs):- Type Indicator Description IP Address 46.30.191[.]230 SpiceRAT server observed in the March 2026 cluster IP Add |
| ipv4 | 46.30.191.232 | ekz[.]online Kazakhstan government-themed domain IP Address 46.30.191[.]232 Host associated with Tajikistan-themed spoofing Domain no |
| ipv4 | 46.30.191.90 | orter[.]com Support-themed infrastructure domain IP Address 46.30.191[.]90 Infrastructure host associated with support-themed spoofi |
| ipv4 | 5.183.95.49 | m-devon[.]com Uzbek administration-themed domain IP Address 5.183.95[.]49 Host associated with Uzbek administration-themed spoofing |
| ipv4 | 5.183.95.7 | .]org Related domain under the tdtu[.]org parent IP Address 5.183.95[.]7 Host with high-numbered remote desktop exposure Domain ap |
| ipv4 | 83.242.96.242 | org Kyrgyzstan communications-themed mail domain IP Address 83.242.96[.]242 Infrastructure host associated with Kyrgyzstan-themed spo |
| ipv4 | 91.132.94.36 | zu[.]com Related communications-themed subdomain IP Address 91.132.94[.]36 Host associated with Central Asian energy-themed domains |
| ipv4 | 92.243.66.71 | personating Tajikistan’s national IT hub project IP Address 92.243.66[.]71 Host presenting the spoofed railway certificate IP Addres |
| sha1 | 9297d5fd21ef21b16f5880cd4faea2ad1fb9ee39 | 6 fingerprint of the spoofed railway certificate SHA-1 Hash 9297D5FD21EF21B16F5880CD4FAEA2AD1FB9EE39 SHA-1 fingerprint of the spoofed railway certificate JA4X F |
| sha256 | 27e072b92b5ac9e3e2a6770bef3e84bdf864b0611d3bc9caca12be2b1a63dae4 | com BloodAlchemy-related railway-themed domain SHA-256 Hash 27E072B92B5AC9E3E2A6770BEF3E84BDF864B0611D3BC9CACA12BE2B1A63DAE4 SHA-256 fingerprint of the spoofed railway certificate SHA- |
| sha256 | e9d0e8b8a33858a7a5a46f78d7a78f9aa7f9b029348d9b618c6a6a1937a39382 | orical resolution for manager.skycom[.]support SHA-256 Hash E9D0E8B8A33858A7A5A46F78D7A78F9AA7F9B029348D9B618C6A6A1937A39382 Hash of the copied RTX Corporation web page IP Address 185. |
From the original article
7 min read at cybersecuritynews.com
SilkParasite is a cyberespionage operation aimed at government, energy and telecommunications interests in Central Asia. New infrastructure analysis indicates that the activity behind the campaign may be older and broader than its recent name suggests. The operation has used spear-phishing emails carrying convincing government-themed documents and trusted Windows programs to plant remote-access malware.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.