Chinese-Speaking Hackers Target Central Asian Governments with OctLurk and SilkLurk

A sophisticated Chinese-speaking threat actor has been conducting targeted cyber espionage operations against government organizations in Central Asia and Syria using a newly identified custom malware suite containing the OctLurk and SilkLurk backdoors. Active since at least January 2025, the campaign focuses heavily on public sector infrastructure across Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and the Syrian Arab Republic. Targeted organizations span critical sovereign functions, including ministries of foreign affairs, law enforcement agencies, healthcare systems, research facilities, logistics providers, and public education systems.

While Kaspersky researchers have not yet tied this activity to a previously assigned APT moniker, the campaign exhibits the operational hallmarks, staging mechanisms, and toolsets typical of established East Asian espionage clusters.

The Modular In-Memory Backdoors: OctLurk and SilkLurk

The attack framework revolves around two primary in-memory implants designed to minimize host footprints and thwart static detection analysis: OctLurk and SilkLurk. Both backdoors rely on victim-specific hardware fingerprinting to decrypt their payload content, preventing security analysts from easily executing or reverse-engineering payloads outside the intended target environment.

OctLurk is deployed via a minimalistic loader that uses the host system’s primary hard drive serial number to decode its operational logic in memory. Before establishing command-and-control (C2) communication, the malware verifies outward internet connectivity by pinging dns.ssentialserv[.]xyz. Once active, it initiates a stream socket connection to a hard-coded C2 domain, dns.multitoconference[.]com, transmitting encrypted host metadata. OctLurk relies on dynamic plugin loading, injecting additional functional modules straight into system memory without writing artifacts to disk.

SilkLurk functions similarly as a modular memory implant but relies on a DLL side-loading sequence for execution. The side-loading execution technique takes advantage of how Windows applications resolve dynamic-link libraries, placing a malicious DLL into a directory alongside a trusted, legitimate executable so the system automatically loads the malicious payload into a trusted memory space. SilkLurk derives its decryption key from the target machine’s host computer name. Upon establishing a TCP socket connection with its configured C2 server, it receives operational directives, manages polling sleep intervals, and executes dynamically injected memory plugins.

Post-Exploitation Tactics and Tooling

Once a machine is compromised, the threat actor leverages OctLurk and SilkLurk to perform exhaustive host reconnaissance, privilege escalation, and lateral movement across internal networks.

Key post-exploitation activities observed during these intrusions include:

• Credential Harvesting and AD Compromise: The actors use a custom keylogger masquerading under the binary name of AnyDesk to evade security software. To elevate privileges across the network, they deploy Impacket’s secretsdump.py script against Domain Controllers to extract NT directory password hashes, as well as decrypting stored credentials directly from Google Chrome and Mozilla Firefox browsers.
• Internal Network Scanning: Attackers deploy Fscan—an open-source network scanner widely used by Chinese-speaking actors—to identify open ports across internal and public subnets. Specifically, the operators probe for SSH (port 22) and MySQL (port 3306) services, attempting automated brute-force access using a dedicated credential dictionary file named pp.txt.
• Traffic Proxying via LurkProxy: To hide direct connections to internal target nodes, the threat actor deploys a specialized utility called LurkProxy. Executed via batch scripts, LurkProxy functions in either a transparent proxy mode or a SOCKS5 proxy mode, routing malicious traffic through an infected intermediate host back to a C2 IP address at 154.196.162[.]76.
• Data Staging and Email Collection: Operators execute commands targeting internal mail servers directly to authenticate, filter, and exfiltrate user emails. For file exfiltration, SilkLurk invokes cmd.exe to spawn PowerShell instances, connecting to administrative network shares (C$, ADMIN$) using compromised domain credentials. Staged confidential documents are compressed into archives using command-line instances of WinRAR and 7-Zip before exfiltration.
• Secondary Payload Staging: In several instances, SilkLurk was observed spawning secondary DLL side-loading chains to drop PlugX, a ubiquitous Remote Access Trojan (RAT) long associated with Chinese state-sponsored cyber-espionage operations.

Infrastructure Overlaps and Strategic Impact

Analyst telemetry revealed direct infrastructure overlaps between this campaign and prior malicious activity involving a C++ implant tracked as SilentRaid (also known by the names MystRodX and TrustFall). This shared operational infrastructure indicates a continuous, evolving development effort designed to sustain long-term persistence within diplomatic and administrative networks in Central Asia.

From a blast radius perspective, the compromise of domain controllers and foreign affairs communications represents a catastrophic failure of primary administrative boundaries. By acquiring Active Directory credentials via secretsdump.py and establishing persistent SOCKS5 proxy channels through LurkProxy, the threat actors gain unrestricted administrative access to internal networks. This grants them the ability to inspect sensitive diplomatic communications, monitor border and logistics movements, and maintain quiet persistence across critical government institutions across the region.

Threat Hunting and Detection Directives

Defenders monitoring networks in targeted regions should search host and network telemetry for indicators associated with this campaign:

• Network Indicators: Block and investigate traffic to domains dns.ssentialserv[.]xyz and dns.multitoconference[.]com, as well as direct IP connections to 154.196.162[.]76.
• Host Telemetry: Monitor endpoint detection and response (EDR) feeds for instances of Python or command-line scripts invoking secretsdump.py, anomalous executions of Fscan, and the presence of pp.txt files on disk.
• Process Behavior: Audit DLL side-loading indicators where legitimate binaries spawn unassigned PowerShell commands targeting network shares or execution of Pandora RC agents.
• Memory Inspection: Because OctLurk and SilkLurk operate entirely in host memory, perform volatile memory analysis on suspicious hosts looking for unbacked memory pages containing executable code segments within standard host processes.