MystRodX Infrastructure Linked to OctLurk and SilkLurk Espionage Campaigns

Researchers reported that a cyber-espionage operation targeting government and public-sector organizations in Central Asia, with additional victims in Syria, deployed two newly identified backdoors, OctLurk and SilkLurk, alongside a proxy implant called LurkProxy and post-compromise tools including Impacket secretsdump, Browser Password Decryptor, Fscan, WinRAR, 7-Zip, a keylogger, Pandora RC agent, and in one case PlugX. The activity, active since January 2025, used victim-specific decryption, in-memory execution, obfuscation, and plugin-based modules to support command execution, file theft, surveillance, credential access, and remote administration, and is assessed with medium confidence to be operated by the same Chinese-speaking threat actor.

The campaign appears connected through infrastructure overlap to MystRodX, a previously undocumented Linux C++ backdoor delivered by an ELF dropper and initially misclassified as Mirai. MystRodX uses layered encryption, configurable TCP/HTTP communications, and a passive raw-socket “wake-up” mode triggered by crafted DNS or ICMP packets, allowing it to avoid open listening ports; it also maintains persistence through a dual-process guardian mechanism. Prior analysis identified multiple active C2 servers and distinct campaigns tied to separate RSA public keys, and the newly reported overlap with TrustFall, MystRodX, and SilentRaid infrastructure suggests a broader multi-platform espionage ecosystem spanning both Windows and Linux operations.