- A Chinese-speaking threat actor has targeted government organizations in Central Asia and Syria since January 2025, using two new backdoors.
- Kaspersky researchers identified the malware as OctLurk and SilkLurk, which operate in memory to evade detection and can download additional malicious plugins.
- Post-compromise activities include credential dumping, password theft from browsers, and deploying a known backdoor called PlugX.
Since January 2025, a suspected Chinese-speaking threat actor has launched a wave of cyberattacks targeting government organizations in Central Asia and the Syrian Arab Republic. Kaspersky researchers have identified the primary tools as two new obfuscated backdoors tracked as OctLurk and SilkLurk, alongside a proxy utility called LurkProxy.
The attacks focus on sectors like healthcare, research, and government offices, but have not been officially linked to any known hacking group. Initial access methods remain unknown, but Kaspersky discovered that OctLurk is injected into memory using a loader.
Consequently, the malware establishes contact with a remote server for command-and-control functions. OctLurk collects system information and can load plugins to perform actions including command execution, file operations, and screenshot capture.
Meanwhile, the threat actors have been observed using the backdoor to fingerprint hosts and harvest password hashes from domain controllers using Impacket’s “secretsdump.py” tool. They also drop a keylogger that masquerades as AnyDesk to avoid detection and extract passwords from Google Chrome and Mozilla Firefox.
LurkProxy functions as a reverse proxy, routing network traffic in either SOCKS5 or transparent mode. SilkLurk, the third tool, is deployed via a DLL side-loading sequence and connects to a C2 server to execute received commands.
Kaspersky researchers Saurabh Sharma and Yaroslav Kikel said, “OctLurk and SilkLurk can download and inject additional plugins to perform further malicious actions, including launching command shells, performing file system activity, synthesizing keyboard and mouse events, network scanning, credential dumping, keylogging, password theft from browsers, email collection, and remote access.”
Post-compromise activity for SilkLurk includes invoking “cmd.exe” to launch PowerShell for connecting to shared network resources and using legitimate archiving tools like WinRAR to stage stolen data. A detailed investigation according to a report by Kaspersky found infrastructure overlaps between this campaign and prior attacks using a C++-based implant codenamed SilentRaid.
These overlaps suggest shared infrastructure across multiple campaigns targeting different operating systems. The memory-resident nature of the new backdoors makes them particularly difficult to reverse engineer and detect.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
