SilkParasite Hackers Use SpiceRAT Infrastructure to Target Central Asian Governments and Energy Firms
Hunt.io links SpiceRAT C2 infrastructure to the China-nexus SilkParasite espionage cluster targeting Central Asian governments, telecoms, and energy firms.
Hunt.io analysis expanded the SpiceRAT command-and-control footprint tied to SilkParasite, a China-nexus espionage cluster (medium confidence per Bitdefender) targeting government, telecommunications, and energy entities across Central Asia. Five active servers coordinated from mid-March 2026 were clustered via reused hostnames, TLS certificates, and a byte-identical clone of RTX Corporation's webpage found on 13 IPs; a certificate for azure.uzrailwaystax[.]com appeared across eight servers. Domains impersonated Türkmengaz, Tojiktelecom, Turkmenistan's Foreign Ministry, and Uzbek and Kyrgyz bodies, with passive DNS history dating to mid-2022. Impersonated organizations were not confirmed as compromised; Cisco Talos previously linked SpiceRAT to SneakyChef's LNK/HTA infection chains.
- Five active SpiceRAT C2 servers emerged mid-March 2026 across European hosting networks
- TLS certificate for azure.uzrailwaystax[.]com appeared on eight servers, impersonating Uzbekistan's state railway
- Byte-identical RTX Corporation webpage clone found on 13 IPs, all tied to the cluster
- Hostnames pivot to NodeEdgeRAT and NomadRAT infrastructure, suggesting shared operators
- Defenders should hunt certificate fingerprints, page hashes, and RDP on high ports (64330-65535)
- ATT&CK
- T1204.002 Malicious FileT1071.001 Web ProtocolsT1583.001 DomainsT1583.004 ServerT1021.001 Remote Desktop Protocol
- Threat actors
- SilkParasiteSneakyChef
- Organizations
- Cisco TalosBitdefenderHunt.ioRTX Corporation
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | hoster-kg.com | NodeEdgeRAT and NomadRAT. A sibling domain associated with hoster-kg[.]com was listed by Bitdefender as NodeEdgeRAT infrastructure, |
| domain | it.com | seller brands differ. A notable pivot involved ns2.asiainfo.it[.]com , which resolved to SpiceRAT servers in Estonia, Bulgaria |
| domain | skycom.support | and elsewhere during early 2026. Another hostname, manager.skycom[.]support , appeared in Bitdefender’s SilkParasite indicators and a |
| domain | tdtu.org | sted by Bitdefender as NodeEdgeRAT infrastructure, while kg.tdtu[.]org shared a parent-domain relationship with a NomadRAT C2 in |
| domain | uzrailwaystax.com | cant link. Multiple hosts presented a certificate for azure.uzrailwaystax[.]com , an attacker-controlled domain impersonating Uzbekistan’ |
| ipv4 | 185.122.185.36 | he SpiceRAT command channel operated separately over HTTPS. 185.122.185.36 IP intelligence data showing a SpiceRat detection on port 8 |
| ipv4 | 188.190.29.126 | 191[.]230 – 80, 443 GWY IT PTY LTD CrownCloud NL 2026-02-09 188.190.29[.]126 ns2.asiainfo.it[.]com 80 EDIS GmbH – BG 2026-02-26 193.29 |
| ipv4 | 193.29.59.159 | 29[.]126 ns2.asiainfo.it[.]com 80 EDIS GmbH – BG 2026-02-26 193.29.59[.]159 – 80, 443 IP-Project CrownCloud DE 2026-03-02 31.58.220[. |
| ipv4 | 194.14.217.119 | rs absent from BitDefender’s IoC list: 194.68.225[.]168 and 194.14.217[.]119, both detected in late January 2026, exposing ports 80 an |
| ipv4 | 194.68.225.168 | resolves to two servers absent from BitDefender’s IoC list: 194.68.225[.]168 and 194.14.217[.]119, both detected in late January 2026, |
| ipv4 | 31.58.220.250 | 3.29.59[.]159 – 80, 443 IP-Project CrownCloud DE 2026-03-02 31.58.220[.]250 – 443 AS56971 Cloud CloudBackbone NL 2026-03-04 Note: IP |
| ipv4 | 46.30.191.230 | omise IP Hostname Ports AS Name Reseller Country First Seen 46.30.191[.]230 – 80, 443 GWY IT PTY LTD CrownCloud NL 2026-02-09 188.190 |
From the original article
4 min read at gbhackers.com
A wider cluster of SpiceRAT command-and-control infrastructure has been linked to the SilkParasite cyber-espionage activity targeting government, telecommunications, and energy-related entities across Central Asia.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.