Malware

SilkLurk

Tracked since Jul 30, 2026 · Updated 3 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

Vulns0Associated

Actors0Associated

ATT&CK26Techniques

IOCs19Tracked

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure

MITRE ATT&CK

Techniques & procedures

26 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

4 techniques

T1059Command and Scripting InterpreterEvidence2

This design allows the attackers to add capabilities as needed, including command execution...

T1059.001PowerShellEvidence3

SilkLurk was used to open PowerShell, connect to shared network resources with administrative credentials and search for confidential documents.

T1059.003Windows Command ShellEvidence1

case 0x3E9: launch cmd.exe as shell.

T1129Shared ModulesEvidence1

retrieves plugins that are executed entirely in memory

Persistence

1 technique

T1543.003Windows ServiceEvidence3

OctLurk is a modular backdoor delivered through customized loader DLLs that establish persistence using Windows services and scheduled tasks.

Privilege Escalation

2 techniques

T1055Process InjectionEvidence2

Each loader decrypts its payload using a combination of hard-coded keys and the victim system's drive serial number before reflectively injecting the backdoor into memory.

T1543.003Windows ServiceEvidence3

OctLurk is a modular backdoor delivered through customized loader DLLs that establish persistence using Windows services and scheduled tasks.

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence1

Both the loaders and the backdoors are heavily obfuscated, making analysis more complicated.

T1055Process InjectionEvidence2

Each loader decrypts its payload using a combination of hard-coded keys and the victim system's drive serial number before reflectively injecting the backdoor into memory.

T1620Reflective Code LoadingEvidence3

Each loader decrypts its payload using a combination of hard-coded keys and the victim system's drive serial number before reflectively injecting the backdoor into memory.

Credential Access

5 techniques

T1003OS Credential DumpingEvidence2

During post-compromise activity, operators expanded their foothold using legitimate administration software alongside publicly available offensive tools, including Impacket's SecretsDump

T1056Input CaptureEvidence1

including command execution, file manipulation, screenshot capture, clipboard monitoring, keyboard and mouse simulation

T1056.001KeyloggingEvidence2

These components give the operator command-shell access, file management, keyboard and mouse control, network scanning, credential dumping, keylogging, browser password theft, email collection and remote access. During OctLurk infections, Kaspersky observed the attackers collecting system and network details before deploying tools such as ... a keylogger ...

T1555Credentials from Password StoresEvidence3

operators used OctLurk to perform extensive host reconnaissance, collect event logs, harvest credentials, deploy keyloggers, extract browser passwords

T1555.003Credentials from Web BrowsersEvidence1

During post-compromise activity, operators expanded their foothold using legitimate administration software alongside publicly available offensive tools, including ... Browser Password Decryptor ...

Discovery

4 techniques

T1046Network Service DiscoveryEvidence2

During post-compromise activity, operators expanded their foothold using legitimate administration software alongside publicly available offensive tools, including Impacket's SecretsDump, Browser Password Decryptor, Pandora RC, Fscan, WinRAR, 7-Zip, and PlugX.

T1082System Information DiscoveryEvidence2

The malware then gathers information about the infected device

T1083File and Directory DiscoveryEvidence2

SilkLurk was used to open PowerShell, connect to shared network resources with administrative credentials and search for confidential documents.

T1135Network Share DiscoveryEvidence2

Investigators observed SilkLurk searching network shares for sensitive documents

Lateral Movement

1 technique

T1021.002SMB/Windows Admin SharesEvidence2

SilkLurk was used to open PowerShell, connect to shared network resources with administrative credentials and search for confidential documents. The attackers compressed collected material with WinRAR or 7-Zip, disconnected from network shares to hide which internal servers had been accessed...

Collection

8 techniques

T1005Data from Local SystemEvidence1

After establishing the connection, they searched the shared drives for confidential documents to exfiltrate.

T1039Data from Network Shared DriveEvidence1

Investigators observed SilkLurk searching network shares for sensitive documents

T1056Input CaptureEvidence1

including command execution, file manipulation, screenshot capture, clipboard monitoring, keyboard and mouse simulation

T1056.001KeyloggingEvidence2

T1113Screen CaptureEvidence1

including command execution, file manipulation, screenshot capture

T1114Email CollectionEvidence2

These components give the operator command-shell access, file management, keyboard and mouse control, network scanning, credential dumping, keylogging, browser password theft, email collection and remote access. They also installed Pandora remote-control agents and connected directly to email servers using account credentials.

T1115Clipboard DataEvidence1

including command execution, file manipulation, screenshot capture, clipboard monitoring

T1560Archive Collected DataEvidence2

Investigators observed SilkLurk searching network shares for sensitive documents, archiving stolen data with WinRAR and 7-Zip

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence5

Once active, OctLurk collects host information, establishes encrypted communications with its C2 infrastructure

T1105Ingress Tool TransferEvidence4

Once active, OctLurk collects host information, establishes encrypted communications with its C2 infrastructure, and downloads plugins directly into memory from the C2 server.

Indicators of compromise

Observables

19 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.

View all in app →

Indicator values are available in Mallory. Pivot on every hash, domain, URL, and IP, or pipe them straight into your SIEM.View all in Mallory

Activity feed

Recent activity

6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

polyswarmNews · Aug 6, 2026OctLurk and SilkLurk: Analysis of a Modular Cyber Espionage FrameworkA modular backdoor that uses DLL sideloading through legitimate NVIDIA and Realtek executables, derives decryption from the victim computer name, persists via Windows services, injects itself into memory, communicates with C2, and executes plugins for espionage, file theft, and broader access operations.Read more ↗hackreadNews · Aug 5, 2026OctLurk and SilkLurk Windows Backdoors Target Governments in 6 CountriesA previously undocumented Windows backdoor used in the same cyber-espionage campaign as OctLurk. It computes a hash from the computer name to unlock its payload path and code, uses legitimate NVIDIA and Realtek programs for DLL side-loading, creates a persistent service, loads its main components into memory, connects to command servers, and can receive plugins enabling command shell access, file management, credential theft, keylogging, browser password theft, email collection, and remote access.Read more ↗cysecurity newsNews · Aug 1, 2026Suspected Chinese-Speaking Threat Actor Targets Central Asian Governments With New OctLurk and SilkLurk Malware - CySecurity News - Latest Information Security and Hacking IncidentsA newly identified malware family in the same espionage framework as OctLurk. It uses DLL side-loading, establishes a TCP connection to its C2 server, collects victim information, receives updated instructions, and loads additional plugins directly into memory to maintain covert access.Read more ↗the hacker newsNews · Jul 31, 2026Suspected Chinese-Speaking Hackers Target Central Asian Governments With OctLurk and SilkLurkAn obfuscated backdoor launched through DLL side-loading. It creates a TCP socket to a configured C2 server, collects victim information, executes server-issued commands, adjusts polling intervals, updates configuration, and receives additional plugins for in-memory injection. Post-compromise activity included staging confidential documents and archiving stolen data.Read more ↗

+2 more in the timeline. Sign up to see them

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start Free Trial Open in App ↗

IOC matching19Match every observed IP, domain, and hash against your live telemetry.

Associated threat actorsGroups linked to this family, with evidence pinned to each claim.

Associated vulnerabilitiesCVEs linked to this family, with the reporting behind each link.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping26Every documented technique, ranked by evidence weight.

Researcher chatterReddit, Mastodon, and CTI community discussion around this family.

SilkLurk

Tracked since Jul 30, 2026 · Updated 3 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

Vulns0Associated

Actors0Associated

ATT&CK26Techniques

IOCs19Tracked

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure