MalwareUsed by 2 actors

DriveSilkRAT

DriveSilkRAT is a modular remote-access trojan used as the principal implant in the SilkParasite cyberespionage operation. Implemented in .NET and C++ variants, it polls a shared Google Drive folder for tasking, executes commands through in-memory .NET plugins, and uploads execution results and collected data through the same cloud service. Its plugin set supports host and network discovery, IP-configuration collection, directory and process enumeration, file display, copying, deletion, execution, and process termination. DriveSilkRAT also deployed other malware families within the SilkParasite toolset. SilkParasite targeted government and economic decision-making entities in Central Asia and Georgia, primarily using spear-phishing Office-document lures, password-protected archives, and DLL sideloading chains. The operation is assessed with medium confidence as China-nexus activity, without attribution to a specific named threat actor.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

SilkParasite

DriveSilkRAT is represented by GoogleDriveClient.exe samples, mutexes, an attacker email address, RC4 keys, and plugins for host/network discovery, file operations, command execution, and process termination.

via github webgithub.com

Salt Typhoon

One of the new tools, DriveSilkRAT, uses Google Drive to exchange data with an infected machine, allowing some malicious traffic to be disguised as communication with a legitimate cloud service.

via timescatimesca.com

MITRE ATT&CK

Techniques & procedures

19 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1566PhishingEvidence1

The attackers appear to have gained access through targeted phishing emails containing malicious Microsoft Office documents, sometimes hidden inside password-protected archives.

T1566.001Spearphishing AttachmentEvidence5

Initial access ran through malicious Microsoft Office documents, most likely delivered by spear-phishing email.

Execution

6 techniques

T1047Windows Management InstrumentationEvidence1

The command-execution plugin runs processes through Windows Management Instrumentation rather than spawning cmd.exe directly.

T1059Command and Scripting InterpreterEvidence1

DriveSilkRAT ... run it through an in-memory .NET plugin system ... NodeEdgeRAT ... spanning command execution ... SpiceRAT ... equipped to download and run executable binaries and arbitrary commands.

T1059.005Visual BasicEvidence3

Once opened, the document ran a macro that dropped a signed-application sideloading chain to disk.

T1129Shared ModulesEvidence1

downloaded plugins into memory

T1204User ExecutionEvidence1

The documents were designed to look legitimate and trick recipients into opening files that could infect their computers. Once opened, the documents can run malicious code that installs software giving the attackers remote access to the computer.

T1204.002Malicious FileEvidence3

Once opened, the document ran a macro that dropped a signed-application sideloading chain to disk and launched the first-stage payload.

Stealth

2 techniques

T1036MasqueradingEvidence2

DriveSilkRAT uses Google Drive to exchange data with an infected machine, allowing some malicious traffic to be disguised as communication with a legitimate cloud service.

T1620Reflective Code LoadingEvidence2

SpiceRAT [uses] DLL plugins fetched from C2 and reflectively loaded; CookiETagRAT [uses] PE plugins pulled from C2, mapped in memory.

Discovery

3 techniques

T1046Network Service DiscoveryEvidence1

It supports 12 plugins for process listing, system and network enumeration, file management, and command execution.

T1057Process DiscoveryEvidence1

It supports 12 plugins for process listing, system and network enumeration, file management, and command execution.

T1082System Information DiscoveryEvidence1

The malware supports basic commands to gather host information... It supports 12 plugins for process listing, system and network enumeration, file management, and command execution.

Command and Control

5 techniques

T1071Application Layer ProtocolEvidence5

One of the new tools, DriveSilkRAT, uses Google Drive to exchange data with an infected machine, allowing some malicious traffic to be disguised as communication with a legitimate cloud service.

T1102Web ServiceEvidence4

One of the new tools, DriveSilkRAT, uses Google Drive to exchange data with an infected machine, allowing malicious traffic to blend in with traffic from a legitimate cloud service.

T1102.002Bidirectional CommunicationEvidence2

DriveSilkRAT operators drop command files into a shared Google Drive folder. The infected host polls that folder, downloads its tasking ... and uploads results back to the same folder.

T1105Ingress Tool TransferEvidence3

Nearly every family in SilkParasite is built around plugin architecture: the implant loads additional capabilities on demand from its command-and-control server rather than shipping them all at once.

T1219Remote Access ToolsEvidence3

Bitdefender found seven families of remote access trojans, or RATs, five of which had not previously been documented. RATs are programs that allow attackers to control an infected device from a distance, including running commands and accessing files.

Exfiltration

1 technique

T1567Exfiltration Over Web ServiceEvidence1

DriveSilkRAT ... uses Google Drive as command-and-control (C2) to poll a specific folder for tasking ... and upload the results of the execution back to the same folder.

INDICATORS OF COMPROMISE

IOCs tracked for this family

49 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

48 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

hash.md5●●●●●●●●●●●●View more in app2 months ago

ACTIVITY FEED

Recent activity

10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

10 SOURCESView more in app

security online infoNews

Aug 27, 2026

SilkParasite APT Hits Central Asia With 7 RATs

A remote-access trojan serving as the primary SilkParasite payload and distributor for the other six RAT families. It uses a shared Google Drive folder for command-and-control.

timescaNews

Aug 21, 2026

Central Asian Government Agencies Targeted in New Cyberespionage Campaign - The Times Of Central Asia

A remote access trojan used in the SilkParasite cyberespionage campaign. It enables command execution, file operations, and persistent remote access, and uses Google Drive as a communication channel to blend malicious traffic with legitimate cloud activity.

timescaNews

Aug 21, 2026

SilkParasite Cyberespionage Campaign Targets Central Asian Governments - The Times Of Central Asia

A remote access trojan used in the SilkParasite cyberespionage campaign. It provides remote access to infected systems and uses Google Drive as a communication channel to blend malicious traffic with legitimate cloud service activity.

cyber security newsNews

Aug 21, 2026

China-Linked Spy Campaign Uses Five New Malware Families Against Central Asian Governments

Remote access trojan that served as the backbone of the SilkParasite campaign, using Google Drive for command exchange, in-memory plugin loading, and data exfiltration.

+5 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching49

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping19

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

DriveSilkRAT