China’s ‘SilkParasite’ espionage operation targeting Central Asia with AI
Bitdefender attributes the SilkParasite espionage campaign to China-linked actors using five new malware strains and AI-assisted development to target Central Asian governments.
Bitdefender researchers uncovered a nearly year-long espionage operation dubbed SilkParasite targeting government economic institutions in Central Asia and the South Caucasus. The campaign uses seven malware families, five previously undocumented, including DriveSilkRAT, which communicates through a shared Google Drive folder instead of a dedicated C2 server. The attackers gained access via malicious Microsoft Office documents delivered through spearphishing emails packaged in archives. Bitdefender found evidence of AI-generated lures and AI-assisted malware development, tied the campaign to China via infrastructure and malware overlaps, and observed 65 infections across targeted countries.
- Seven malware families used, five previously undocumented, including DriveSilkRAT with Google Drive-based C2
- 65 infections observed across Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, Georgia and Kazakhstan
- Malicious Office documents delivered via spearphishing emails packaged in archives to evade gateways
- AI was used to generate lures and assist malware development, with placeholders left in code
- Attribution to China based on malware links to another China espionage group and Chinese telecom IPs
- ATT&CK
- T1566.001 Spearphishing AttachmentT1204.002 Malicious FileT1071.001 Web ProtocolsT1219 Remote Access Software
- Vendors
- BitdefenderMicrosoft
- Products
- DriveSilkRATSilkParasite
- Threat actors
- SilkParasite
- Organizations
- BitdefenderNSA
From the original article
3 min read at therecord.media
Five previously undocumented strains of malware are being used in attacks on government bodies across Central Asia, threat researchers discovered. The espionage campaign, known as “SilkParasite,” was allegedly launched by military-grade hackers based in China who used artificial intelligence at various points throughout the malware development process.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.