Loading malware…
OctLurk is a modular Windows backdoor used in cyber-espionage operations observed since January 2025. Its campaigns have targeted government and public-sector organizations in Afghanistan, Kazakhstan, Kyrgyzstan, Tajikistan, Uzbekistan, and Syria, including foreign ministries, law enforcement, healthcare, research, logistics, urban planning, and education institutions. It has been deployed alongside SilkLurk and the separate traffic-relay implant LurkProxy. The activity has not been conclusively attributed to a named threat group, and the initial access vector remains unknown.
OctLurk uses victim-specific loader DLLs that decrypt the payload using hard-coded key material combined with the system drive's serial number. Its main component and additional plugins execute in memory, limiting disk artifacts and complicating analysis. Observed deployments establish persistence through Windows services and scheduled tasks, including tasks running with SYSTEM privileges. The backdoor collects operating-system, computer, user, and network information and transmits it through protected command-and-control communications using compression and layered XOR encoding.
Its plugins provide interactive command execution, extensive filesystem management, screenshot capture, clipboard access and modification, and simulated keyboard and mouse input. Operators have used OctLurk access to conduct host reconnaissance, collect event logs, deploy keyloggers, extract browser passwords, dump domain-controller credentials, scan networks, collect email, and install additional remote-access tools. These operations combine the backdoor's extensible functionality with auxiliary utilities rather than relying exclusively on built-in modules.
BINDCLOAK is a closely related variant identified through substantial code similarities and shared command-and-control infrastructure. It supports reflective plugin loading, process and token discovery, and Windows access-token duplication and impersonation to execute modules under more privileged security contexts. BINDCLOAK has been observed in Middle Eastern government-targeting operations with an energy-sector focus.
31 distinct techniques documented for this family, organized by ATT&CK tactic.
On infected computers, OctLurk is installed through scheduled tasks and malicious Windows services after the attacker obtains administrative credentials.
OctLurk is a modular backdoor delivered through customized loader DLLs that establish persistence using Windows services and scheduled tasks.
This design allows the attackers to add capabilities as needed, including command execution...
These plugins provide command shell access, filesystem management, screenshot capture, clipboard interaction, keyboard and mouse simulation, and additional remote administration capabilities.
retrieves plugins that are executed entirely in memory
On infected computers, OctLurk is installed through scheduled tasks and malicious Windows services after the attacker obtains administrative credentials.
OctLurk is a modular backdoor delivered through customized loader DLLs that establish persistence using Windows services and scheduled tasks.
OctLurk is a modular backdoor delivered through customized loader DLLs that establish persistence using Windows services and scheduled tasks.
On infected computers, OctLurk is installed through scheduled tasks and malicious Windows services after the attacker obtains administrative credentials.
OctLurk is a modular backdoor delivered through customized loader DLLs that establish persistence using Windows services and scheduled tasks.
Each loader decrypts its payload using a combination of hard-coded keys and the victim system's drive serial number before reflectively injecting the backdoor into memory.
OctLurk is a modular backdoor delivered through customized loader DLLs that establish persistence using Windows services and scheduled tasks.
Both the loaders and the backdoors are heavily obfuscated, making analysis more complicated.
Each loader decrypts its payload using a combination of hard-coded keys and the victim system's drive serial number before reflectively injecting the backdoor into memory.
Each loader decrypts its payload using a combination of hard-coded keys and the victim system's drive serial number before reflectively injecting the backdoor into memory.
During post-compromise activity, operators expanded their foothold using legitimate administration software alongside publicly available offensive tools, including Impacket's SecretsDump
including command execution, file manipulation, screenshot capture, clipboard monitoring, keyboard and mouse simulation
operators used OctLurk to perform extensive host reconnaissance, collect event logs, harvest credentials, deploy keyloggers
operators used OctLurk to perform extensive host reconnaissance, collect event logs, harvest credentials, deploy keyloggers, extract browser passwords
During post-compromise activity, operators expanded their foothold using legitimate administration software alongside publicly available offensive tools, including ... Browser Password Decryptor ...
reg query HKLM /s /f “ProfileImagePath” /t REG_EXPAND_SZ
During OctLurk infections, Kaspersky observed the attackers collecting system and network details before deploying tools such as Impacket’s secretsdump...
During observed intrusions, operators used OctLurk to perform extensive host reconnaissance
During post-compromise activity, operators expanded their foothold using legitimate administration software alongside publicly available offensive tools, including Impacket's SecretsDump, Browser Password Decryptor, Pandora RC, Fscan, WinRAR, 7-Zip, and PlugX.
powershell Get-NetTCPConnection Retrieves information about TCP connections.
TASKLIST /V Lists all running tasks with detailed information.
Once active, OctLurk collects host information, establishes encrypted communications with its C2 infrastructure, and downloads plugins directly into memory from the C2 server.
collecting confidential documents
WMIC /Node:localhost /Namespace:\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List | findstr “=” Retrieves information about installed antivirus software.
After establishing the connection, they searched the shared drives for confidential documents to exfiltrate. | wevtutil qe Security /f:text /c:5 /rd:true /q:”*[System[(EventID=4624)]] and *[EventData[Data[@Name=’LogonType’]=10]]” Retrieves the last 5 events from the Security event log
including command execution, file manipulation, screenshot capture, clipboard monitoring, keyboard and mouse simulation
operators used OctLurk to perform extensive host reconnaissance, collect event logs, harvest credentials, deploy keyloggers
These plugins provide command shell access, filesystem management, screenshot capture, clipboard interaction
These components give the operator command-shell access, file management, keyboard and mouse control, network scanning, credential dumping, keylogging, browser password theft, email collection and remote access. They also installed Pandora remote-control agents and connected directly to email servers using account credentials.
These plugins provide command shell access, filesystem management, screenshot capture, clipboard interaction
Once active, OctLurk collects host information, establishes encrypted communications with its C2 infrastructure
BINDCLOAK communicates with its command server through TLS over TCP, using a custom message-routing system.
Once active, OctLurk collects host information, establishes encrypted communications with its C2 infrastructure, and downloads plugins directly into memory from the C2 server.
BINDCLOAK uses two layers of XOR encoding for C2 communication
31 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.