SilkParasite Espionage Campaign Targets Central Asian Governments with Five New RATs
Bitdefender reports SilkParasite, a China-nexus espionage cluster targeting Central Asian governments with seven RATs, five newly documented, delivered via spearphished RAR archives.
Bitdefender Labs assesses with medium confidence that SilkParasite, first discovered in late 2025, is a China-nexus cluster targeting government bodies in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, Kazakhstan, and Georgia. Attacks use password-protected RAR archives with malicious Office documents, macro-triggered DLL sideloading, and checks for running Kaspersky AV before execution. The arsenal spans seven RAT families in .NET, C++, Go, and JavaScript with plugin architectures and diverse C2 channels including Google Drive and HTTP cookie/ETag headers; roughly 65 DriveSilkRAT infections were observed, mostly in Asia. Ties to China include BLOODALCHEMY (a Deed RAT/ShadowPad descendant) and an improved SpiceRAT used by SneakyChef, with traces of AI-assisted development in the tooling and lures.
- Five new RAT families: DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, NodeEdgeRAT, plus updated BLOODALCHEMY and SpiceRAT.
- Implants span .NET, C++, Go, and JavaScript with plugin architectures and DLL sideloading delivery.
- Lures impersonate ministries in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, Kazakhstan, and Georgia.
- Macros check for running Kaspersky AV before executing, suggesting detection-evasion efforts.
- AI-assisted development traces include hardcoded weak keys like 'change_this_key' and an AI-generated phishing lure.
- ATT&CK
- T1566.001 Spearphishing AttachmentT1204.002 Malicious FileT1574.002 DLL Side-LoadingT1102.002 Bidirectional Communication
- Threat actors
- SilkParasiteREF5961SneakyChefUAC-0063FamousSparrow
- Organizations
- BitdefenderElastic Security Labs
From the original article
4 min read at thehackernews.com
A previously unreported cyber espionage operation dubbed SilkParasite has been observed targeting government bodies in Central Asia. The intrusion set makes use of seven remote access tool (RAT) families, five of which have never been previously documented: DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, and NodeEdgeRAT.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.