Loading story…
Researchers reported that a cyber-espionage operation targeting government and public-sector organizations in Central Asia, with additional victims in Syria, deployed two newly identified backdoors, OctLurk and SilkLurk, alongside a proxy implant called LurkProxy and post-compromise tools including Impacket secretsdump, Browser Password Decryptor, Fscan, WinRAR, 7-Zip, a keylogger, Pandora RC agent, and in one case PlugX. The activity, active since January 2025, used victim-specific decryption, in-memory execution, obfuscation, and plugin-based modules to support command execution, file theft, surveillance, credential access, and remote administration, and is assessed with medium confidence to be operated by the same Chinese-speaking threat actor.
The campaign appears connected through infrastructure overlap to MystRodX, a previously undocumented Linux C++ backdoor delivered by an ELF dropper and initially misclassified as Mirai. MystRodX uses layered encryption, configurable TCP/HTTP communications, and a passive raw-socket “wake-up” mode triggered by crafted DNS or ICMP packets, allowing it to avoid open listening ports; it also maintains persistence through a dual-process guardian mechanism. Prior analysis identified multiple active C2 servers and distinct campaigns tied to separate RSA public keys, and the newly reported overlap with TrustFall, MystRodX, and SilentRaid infrastructure suggests a broader multi-platform espionage ecosystem spanning both Windows and Linux operations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Kaspersky reported a cyber-espionage campaign active since January 2025 using the newly identified OctLurk and SilkLurk backdoors against government and public-sector organizations primarily in Central Asia, with additional victims in Syria. The activity also used LurkProxy and other post-exploitation tools, and in at least one case deployed PlugX as a second-stage payload.
XLab assessed that the previously undocumented MystRodX backdoor may have been present since at least an activation timestamp of January 7, 2024. The malware was identified as a stealthy C++ backdoor delivered by a Linux ELF dropper and initially mislabeled as Mirai by antivirus tools.
Kaspersky assessed with medium confidence that the same actor operates both OctLurk and SilkLurk and said the activity is likely tied to a Chinese-speaking threat actor. The report also noted infrastructure overlap with TrustFall, MystRodX, and SilentRaid activity observed by Kazakhstan’s State Technical Service.
XLab disclosed MystRodX as a previously undocumented dual-mode backdoor, detailing its layered encryption, TCP/HTTP communications, passive DNS/ICMP wake-up mode, and dual-process persistence. The researchers also reported three active C2 servers responding to probes and linked observed infrastructure to multiple campaigns, including two named campaigns and additional uncaptured activity.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcesecurelist.com
Open sourceblog.xlab.qianxin.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A suspected Chinese-speaking threat actor has run a cyber-espionage campaign against government and public-sector organizations in Central Asia since at least January 2025, using the newly identified **OctLurk** and **SilkLurk** malware families to maintain persistent access and steal sensitive data. Kaspersky reported victims in Afghanistan, Kazakhstan, Kyrgyzstan, Tajikistan, Uzbekistan, and Syria, and said the modular, largely memory-resident toolset was paired with **LurkProxy** to support reconnaissance, credential theft, lateral movement, remote access, keylogging, and staged exfiltration with tools such as **WinRAR** and **7-Zip**. Investigators also observed use of **secretsdump.py**, **Fscan**, **Pandora RC**, **PlugX**, and browser credential theft, while noting infrastructure overlaps with the earlier SilentRaid campaign without making a firm attribution. Zscaler ThreatLabz said the same activity expanded into the Middle East in July 2026, targeting government entities and the energy sector with **BINDCLOAK**, a previously undocumented 64-bit Windows backdoor assessed with high confidence to be a variant of **OctLurk**. Delivered by the **MIXEDKEY** loader, BINDCLOAK uses TLS over TCP, zlib compression, and dual rolling-XOR message protection, while supporting token theft and impersonation, reflective plugin loading, process discovery, and EDR evasion through indirect import resolution with `RtlQueueWorkItem` and `LoadLibraryW`. Researchers linked the operations through shared command-and-control infrastructure and certificate reuse, including domains such as `cert.hypersnet[.]com`, `about.blsouqs[.]com`, and `ssl.blsouqs[.]com`.
Aug 3, 2026
VMRay Labs detailed **Operation STANDOFF**, a previously unattributed Russian-speaking cybercriminal campaign that delivers multiple payloads through a pay-per-install `NSIS` loader masquerading as `setup_x86_x64_install.exe`. The operation has been observed deploying **Raccoon Stealer, RedLine Stealer, Amadey, SmokeLoader, Socelars, Glupteba, XMRig**, and **WebBrowserPassView**, combining credential theft, botnet activity, and cryptomining in a single infection chain. Researchers said the operators used layered evasion and persistence techniques, including disabling Microsoft Defender, anti-VM and anti-debug checks, scheduled tasks, registry `Run` keys, fake VirtualBox-named services, and a masqueraded `csrss.exe` path, while a gaming-themed **“Mobile Arena”** lure targeted young Russian-speaking users. The campaign’s infrastructure included command-and-control systems hosted on **TimeWeb Ltd.**, a broader 44-server cluster, and dead-drop resolvers on **Telegram, Mastodon, and Pastebin**. Additional reporting tied the operation to command-and-control traffic concealed behind **GitHub redirects** and exposed indicators including suspicious installer filenames, hashes, domains, IP addresses, Telegram and social-media handles, anti-virtualization artifacts, and **Monero** mining infrastructure such as `pool.supportxmr.com:3333`. VMRay also identified **STANDOFF COORD**, a Russian-language multi-operator console designed for **Active Directory** intrusion, alongside a separate AI-enabled influence platform used for Telegram account farming and mass messaging.
Jul 28, 2026
Reporting across multiple research teams described a surge of distinct, ongoing intrusion campaigns rather than a single unified incident. **Check Point** reported on **Silver Dragon**, a Chinese-aligned activity cluster assessed as operating under the broader **APT41** umbrella, targeting organizations in **Southeast Asia and Europe** (notably government) via exploitation of public-facing servers and phishing, then deploying **Cobalt Strike**, **DNS tunneling**, and a new Google Drive–based backdoor (**GearDoor**) alongside custom tools (**SSHcmd** and **SliverScreen**) for remote access and screen capture. **Microsoft** detailed separate February 2026 phishing campaigns by an unknown actor that used meeting/invoice-style lures and **EV code-signed** malware (certificate issued to **TrustConnect Software PTY LTD**) masquerading as common workplace apps (e.g., `msteams.exe`, `adobereader.exe`, `zoomworkspace.clientsetup.exe`) to install legitimate **RMM** tooling (**ScreenConnect**, **Tactical RMM**, **Mesh Agent**) for persistent access and lateral movement. Other reporting highlighted additional, unrelated campaigns and tradecraft: **ClearSky** described a Russian-aligned operation targeting **Ukraine** using a phishing-delivered ZIP/HTA chain that drops a .NET loader (**BadPaw**) and backdoor (**MeowMeow**) with **.NET Reactor** obfuscation, parameter-gated execution, and sandbox/tooling checks (with low-confidence linkage to **APT28**). **Cofense**-reported activity (via SC Media) showed phishing that weaponizes **Windows File Explorer + WebDAV** using URL/LNK shortcuts to pull payloads (notably **AsyncRAT**, **XWorm**, **DcRAT**) and infrastructure including **Cloudflare Tunnel** domains hosting WebDAV servers. **Cisco Talos**-reported **Dohdoor** activity (UAT-10027) targeted US **education and healthcare**, using PowerShell→batch→DLL sideloading via legitimate executables (e.g., `Fondue.exe`, `mblctr.exe`, `ScreenClippingHost.exe`) and **DNS-over-HTTPS** to Cloudflare for C2 discovery and tunneling. Separately, **Zscaler** reported **ScarCruft**’s *Ruby Jumper* campaign using **Zoho WorkDrive** for C2 and removable media components to reach air-gapped systems, while another Zscaler report analyzed **Dust Specter** targeting Iraqi government officials with password-protected RAR delivery and modular implants. **Qianxin XLab** assessed sanctioned infrastructure provider **Funnull** resurfacing to support scam/criminal supply chains and potential **MacCMS**-related supply-chain activity, and **F5 Labs** summarized **APT42**’s **TAMECAT** PowerShell backdoor focused on Edge/Chrome credential theft with C2 over Telegram/Discord/HTTPS and specific file/hash indicators. (A separate Help Net Security item on a Microsoft Defender onboarding tool is product/administrative news and not part of the threat-campaign reporting.)
Jun 29, 2026