MalwareUsed by 1 actor

CookiETagRAT

CookiETagRAT is a C++ remote-access trojan used in the SilkParasite cyberespionage operation. It receives and executes operator commands concealed in HTTP Cookie and ETag response headers, using per-host ChaCha20-derived cryptographic material. It has been deployed in intrusions against government organizations in Central Asia. SilkParasite is assessed with medium confidence to be China-nexus activity, although it has not been conclusively attributed to a single named threat actor. CookiETagRAT was one of five previously undocumented RAT families identified in this operation and was deployed through DLL sideloading involving a legitimate signed Windows application.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

SilkParasite

CookiETagRAT IOCs include tak_deco_lib.dll, easyhook64.dll, and a filesystem XOR key.

via github webgithub.com

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.001Spearphishing AttachmentEvidence2

Its operators used spear-phishing emails with password-protected RAR archives, then used document macros to trigger malicious code.

Execution

2 techniques

T1059.005Visual BasicEvidence2

Its operators used spear-phishing emails with password-protected RAR archives, then used document macros to trigger malicious code.

T1204.002Malicious FileEvidence1

Targets typically receive messages that include regionally tailored Office documents — sometimes inside password-protected RAR archives — which, when opened, trigger a macro that launches a malware delivery chain to deploy a RAT.

Stealth

2 techniques

T1036MasqueradingEvidence1

This malware is small, modular, and built specifically not to look like malware... hides inside legitimately signed applications, and keeps its footprint deliberately small.

T1620Reflective Code LoadingEvidence1

SpiceRAT [uses] DLL plugins fetched from C2 and reflectively loaded; CookiETagRAT [uses] PE plugins pulled from C2, mapped in memory.

Command and Control

6 techniques

T1001Data ObfuscationEvidence1

CookiETagRAT (C++), which uses HTTP Cookie / ETag response headers as C2 to receive and execute commands.

T1071Application Layer ProtocolEvidence3

Rather than using one noisy implant, the actors maintained several tools, changed their supporting files between builds, and used cloud services and normal-looking traffic to make investigation harder. | CookiETagRAT concealed commands in HTTP Cookie and ETag headers

T1071.001Web ProtocolsEvidence1

CookiETagRAT hides its tasking in the headers instead. Commands arrive inside HTTP Cookie and ETag response headers, with results returned in the body.

T1102Web ServiceEvidence1

It runs its command channel over trusted services like Google Drive, hides inside legitimately signed applications, and keeps its footprint deliberately small.

T1105Ingress Tool TransferEvidence1

Nearly every family in SilkParasite is built around plugin architecture: the implant loads additional capabilities on demand from its command-and-control server rather than shipping them all at once.

T1219Remote Access ToolsEvidence1

Bitdefender Labs found seven remote access tool (RAT) families in use, five of which were previously undocumented; we identified and named them: DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, and NodeEdgeRAT.

INDICATORS OF COMPROMISE

IOCs tracked for this family

4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

4 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app2 months ago

hash.md5●●●●●●●●●●●●View more in app2 months ago

hash.sha256●●●●●●●●●●●●View more in app2 months ago

ACTIVITY FEED

Recent activity

7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

7 SOURCESView more in app

security online infoNews

Aug 27, 2026

SilkParasite APT Hits Central Asia With 7 RATs

A newly named remote-access trojan family used in the SilkParasite cyberespionage campaign against Central Asian government bodies.

cyber security newsNews

Aug 21, 2026

China-Linked Spy Campaign Uses Five New Malware Families Against Central Asian Governments

Remote access trojan that hides command data in HTTP Cookie and ETag headers to blend malicious traffic with normal web communications.

dark readingNews

Aug 19, 2026

SilkParasite Threatens Central Asian Orgs With Flurry of RATs

A previously undocumented remote access Trojan used by SilkParasite in a spear-phishing campaign against Central Asian government organizations to establish and maintain long-term access.

malware newsNews

Aug 19, 2026

SilkParasite: Tracking a China-Nexus APT Across Central Asia - Malware News - Malware Analysis, News and Indicators

A previously undocumented remote access trojan used in the SilkParasite cyberespionage operation targeting government bodies across Central Asia.

+2 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching4

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

CookiETagRAT