Loading story…
The Silent Lynx advanced persistent threat (APT) group has conducted targeted espionage campaigns against Central Asian diplomatic entities, leveraging malicious LNK files to deploy reverse shells via GitHub and custom implants. Security researchers identified multiple attack waves, including the use of spear-phishing emails with fake RAR archives and the deployment of a variety of malware such as the SILENT LOADER, LAPLAS implant, and SilentSweeper. The campaigns focused on exploiting relationships between Azerbaijan and Russia, as well as targeting China-Central Asian entities, with the primary objective of intelligence gathering.
Technical analysis revealed that Silent Lynx utilized both custom-made and open-source offensive tools, adapting their infection chains over time and occasionally making operational security mistakes that aided attribution. The group is known for posing as government officials and targeting think tanks and government employees, with infrastructure and tactics mapped to MITRE ATT&CK techniques. Indicators of compromise and early remediation steps have been published to assist defenders in mitigating these threats.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
Public reporting revealed technical details of the campaign's attack chain, including exploitation of LNK file weaknesses to deploy reverse shells and use GitHub as part of the delivery or command infrastructure. This disclosure provided new insight into the tactics and tooling used by Silent Lynx in the operation.
Seqrite and Security Online report an espionage campaign dubbed Operation Peek-a-Baku in which the Silent Lynx APT targeted diplomatic or government-related entities in Dushanbe, Tajikistan. The operation focused on Central Asian diplomatic interests and used malware delivery through malicious shortcut files.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 16 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourceseqrite.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A suspected Chinese-speaking threat actor has run a cyber-espionage campaign against government and public-sector organizations in Central Asia since at least January 2025, using the newly identified **OctLurk** and **SilkLurk** malware families to maintain persistent access and steal sensitive data. Kaspersky reported victims in Afghanistan, Kazakhstan, Kyrgyzstan, Tajikistan, Uzbekistan, and Syria, and said the modular, largely memory-resident toolset was paired with **LurkProxy** to support reconnaissance, credential theft, lateral movement, remote access, keylogging, and staged exfiltration with tools such as **WinRAR** and **7-Zip**. Investigators also observed use of **secretsdump.py**, **Fscan**, **Pandora RC**, **PlugX**, and browser credential theft, while noting infrastructure overlaps with the earlier SilentRaid campaign without making a firm attribution. Zscaler ThreatLabz said the same activity expanded into the Middle East in July 2026, targeting government entities and the energy sector with **BINDCLOAK**, a previously undocumented 64-bit Windows backdoor assessed with high confidence to be a variant of **OctLurk**. Delivered by the **MIXEDKEY** loader, BINDCLOAK uses TLS over TCP, zlib compression, and dual rolling-XOR message protection, while supporting token theft and impersonation, reflective plugin loading, process discovery, and EDR evasion through indirect import resolution with `RtlQueueWorkItem` and `LoadLibraryW`. Researchers linked the operations through shared command-and-control infrastructure and certificate reuse, including domains such as `cert.hypersnet[.]com`, `about.blsouqs[.]com`, and `ssl.blsouqs[.]com`.
Aug 6, 2026
A sophisticated cyberespionage campaign has been uncovered targeting telecommunications and manufacturing organizations across Central and South Asia. The campaign is attributed to Chinese nation-state actors, specifically the Naikon and BackdoorDiplomacy groups, and leverages a combination of the RainyDay and Turian backdoors alongside a novel variant of the PlugX remote access Trojan. Researchers from Cisco Talos identified that the attackers are exploiting DLL search order hijacking vulnerabilities in Windows to deploy illicit loaders, allowing malicious DLLs to be executed under the guise of legitimate processes. This technique provides the attackers with a stealthy execution context, making detection by security systems more difficult. The malware payloads utilize the GetModuleFileNameA API to acquire executable paths and read encrypted data, employing consistent RC4 encryption keys and a unique XOR-RC4-RtlDecompressBuffer decryption algorithm across all samples. The PlugX variant observed in this campaign is configured in a way that suggests the attackers have access to its original source code, enabling novel deployment methods. The campaign has been active since at least 2022, with PlugX itself having a long history of use in high-profile attacks, including those against the U.S. Office of Personnel Management and European diplomatic agencies. The targeting patterns and malware configurations link this activity to the Naikon group, a unit believed to operate out of Chengdu, China, and associated with the People's Liberation Army. The campaign's focus on telecom and manufacturing sectors indicates a likely intent to gather intelligence and disrupt critical infrastructure in the region. U.S. federal law enforcement has also taken action against PlugX, recently deleting over 4,000 instances of the malware from computers in the United States, highlighting its widespread use. The attackers' use of multiple backdoors and advanced evasion techniques demonstrates a high level of sophistication and persistence. The campaign's reliance on DLL search order hijacking underscores the importance of securing application loading processes and monitoring for anomalous DLL activity. The use of shared encryption keys and decryption algorithms across different malware families suggests coordinated development and operational control. The involvement of both Naikon and BackdoorDiplomacy groups points to collaboration or shared resources among Chinese state-linked threat actors. The campaign's longevity and evolving tactics reflect the ongoing threat posed by Chinese cyberespionage operations to organizations in Asia and beyond. Organizations in targeted sectors are advised to review their security controls, especially around DLL loading and process monitoring, to detect and mitigate similar threats. The discovery of this campaign adds to the growing body of evidence of sustained, state-sponsored cyber operations targeting strategic industries in Asia.
Jun 29, 2026
The threat actor known as Transparent Tribe, or APT36, has launched a new wave of cyber espionage campaigns targeting Indian government, academic, and strategic organizations. These attacks leverage spear-phishing emails containing ZIP archives with Windows LNK shortcut files disguised as legitimate PDF documents. When opened, these shortcuts execute remote HTML Application (HTA) scripts using `mshta.exe`, which in turn decrypt and load a .NET-based Remote Access Trojan (RAT) directly into memory, providing the attackers with persistent remote control, data theft, and surveillance capabilities. The campaigns employ sophisticated evasion techniques, such as embedding full PDF content and images within the LNK files to avoid suspicion, and adapting persistence methods based on detected antivirus solutions. Researchers from Cyfirma have detailed how the malware communicates with its command-and-control infrastructure over encrypted channels and uses trusted Windows tools to evade detection. The infection chain is designed for long-term spying, with the attackers able to profile the victim's environment and manipulate runtime execution for reliability. The use of double extension tricks and abnormal file sizes further enhances the campaign's effectiveness in deceiving targets. These campaigns highlight the evolving tactics of APT36 and the ongoing threat posed to Indian governmental and strategic sectors by state-sponsored cyber espionage groups.
Jun 29, 2026