China's AI-Enabled APT Operations Are Getting Interesting
Bitdefender links seven RAT families, five previously undocumented, to China-nexus espionage actor SilkParasite using AI-assisted malware development against Central Asian governments.
A Bitdefender report attributes seven remote access tool families to a single actor dubbed SilkParasite, with medium confidence a China-nexus group targeting governments in Uzbekistan, Turkmenistan and Kazakhstan. The RATs are written in .NET, C++, Go and JavaScript, use C2 via Google Drive and protocols like HTTP, DNS and TCP, and employ modular plugin architectures with regular rotation of infrastructure, encryption material and persistence artifacts. Evidence of AI-assisted development includes leftover test functions, placeholder encryption keys, and GoginRAT and NomadRAT sharing a high-level architecture despite different languages, suggesting a specification implemented twice with AI. The newsletter also covers the US Operation Economic Outcast sanctioning six MOIS-linked Iranian hackers, including hands-on-keyboard operators who targeted US critical infrastructure.
- Five of seven RAT families were previously undocumented; implants include GoginRAT (Go) and NomadRAT (C++)
- Modular plugin design, infrastructure rotation and rotating IoCs complicate forensics and full remediation
- Leftover test functions and placeholder keys indicate AI-assisted malware development workflows
- US sanctioned six Iranian MOIS hackers, naming two leaders and hands-on operators targeting US organizations
- Bitdefender published indicators of compromise for all seven malware families
- Vendors
- Bitdefender
- Organizations
- US Treasury
From the original article
8 min read at news.risky.biz
Your weekly dose of Seriously Risky Business news is written by Tom Uren and edited by Amberleigh Jack and Patrick Gray. This week's edition is sponsored by Push Security. You can hear a podcast discussion of this newsletter by searching for "Risky Business News" in your
By Tom Uren · news.risky.biz
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.