OctLurk and SilkLurk: a new espionage campaign against Central Asia

Analysts at Kaspersky have documented a series of targeted attacks that, since January 2025, have been directed against government organizations primarily in Central Asia — in Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan and Kazakhstan, as well as in Syria. According to the researchers, the campaign is the work of a Chinese-speaking group that has yet to be linked to any known APT.

The list of victims is broad: healthcare, research centers, government institutions and foreign ministries, logistics, law enforcement, urban planning and education. The initial intrusion vector remains unknown.

Two backdoors and a proxy

The hallmark of the attacks is the use of two new obfuscated backdoors, dubbed OctLurk and SilkLurk, along with the LurkProxy utility for proxying traffic. Both pieces of malware operate largely in memory, leaving only a minimal loader on disk. The location and contents of the payload are encoded using data specific to the particular machine: OctLurk relies on the disk's serial number, SilkLurk on the computer name. This binding to the victim significantly complicates reverse engineering and automated detection.

Both families can load additional plugins straight into memory and use them to carry out a wide range of actions: launching a command shell, file operations, simulating keystrokes and mouse movements, network scanning, credential harvesting, keylogging, stealing passwords from browsers and collecting email.

How the attack unfolds

OctLurk is injected into memory by a loader; before it runs, the availability of one of the domains is checked, after which a batch script spins up LurkProxy, which connects to the command-and-control server. From there, using a command-shell plugin, the operators gather information about the host, export logon events, extract password hashes from domain controllers with secretsdump.py from Impacket, launch a keylogger disguised as AnyDesk, pull passwords from Chrome and Firefox, set up remote access via the Pandora RC agent, and scan the network with the Fscan utility, brute-forcing accounts from a file named pp.txt. Collecting messages from the mail server is also provided for separately.

LurkProxy works as a reverse proxy in two modes — SOCKS5 or transparent. SilkLurk is launched via DLL side-loading, communicates with C2 over TCP, and is capable of stealing documents: through PowerShell it connects to network shares, selects confidential files and packs them with WinRAR or 7-Zip. Also spotted in the chain is the delivery of PlugX — a backdoor long associated with Chinese groups.

The researchers found infrastructure overlaps with earlier attacks that employed the SilentRaid implant (also known as MystRodX and TrustFall). This points to shared infrastructure across several campaigns targeting different operating systems, though it was not possible to establish that they were running simultaneously. The emergence of the multi-plugin OctLurk and SilkLurk framework, the company notes, shows how attackers continuously refine their methods to evade detection and maintain control over compromised networks.

Source: The Hacker News