Loading story…
A suspected Chinese-speaking threat actor has run a cyber-espionage campaign against government and public-sector organizations in Central Asia since at least January 2025, using the newly identified OctLurk and SilkLurk malware families to maintain persistent access and steal sensitive data. Kaspersky reported victims in Afghanistan, Kazakhstan, Kyrgyzstan, Tajikistan, Uzbekistan, and Syria, and said the modular, largely memory-resident toolset was paired with LurkProxy to support reconnaissance, credential theft, lateral movement, remote access, keylogging, and staged exfiltration with tools such as WinRAR and 7-Zip. Investigators also observed use of secretsdump.py, Fscan, Pandora RC, PlugX, and browser credential theft, while noting infrastructure overlaps with the earlier SilentRaid campaign without making a firm attribution.
Zscaler ThreatLabz said the same activity expanded into the Middle East in July 2026, targeting government entities and the energy sector with BINDCLOAK, a previously undocumented 64-bit Windows backdoor assessed with high confidence to be a variant of OctLurk. Delivered by the MIXEDKEY loader, BINDCLOAK uses TLS over TCP, zlib compression, and dual rolling-XOR message protection, while supporting token theft and impersonation, reflective plugin loading, process discovery, and EDR evasion through indirect import resolution with RtlQueueWorkItem and LoadLibraryW. Researchers linked the operations through shared command-and-control infrastructure and certificate reuse, including domains such as cert.hypersnet[.]com, about.blsouqs[.]com, and ssl.blsouqs[.]com.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
ThreatLabz reported that the actor previously observed targeting Central Asia since early 2025 expanded in July 2026 to target government entities in the Middle East, with a focus on the energy sector. This marked a geographic escalation of the campaign beyond Central Asia.
Kaspersky said the cyber espionage activity using the newly identified OctLurk and SilkLurk malware families has been ongoing since at least January 2025. The campaign affected government and public-sector organizations in Afghanistan, Kazakhstan, Kyrgyzstan, Tajikistan, Uzbekistan, and the Syrian Arab Republic.
Kaspersky disclosed a cyber espionage campaign using the newly identified OctLurk and SilkLurk malware families to maintain persistent access in sensitive networks across Central Asia. Investigators said a Chinese-speaking actor was likely responsible, though they did not definitively attribute the operation to a known threat group.
ThreatLabz assessed with high confidence that the newly identified BINDCLOAK backdoor is a variant of OctLurk based on code similarities and shared command-and-control infrastructure. The report tied the Middle East activity to the same threat actor behind the earlier OctLurk campaign.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcezscaler.com
Open sourcecysecurity.news
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that a cyber-espionage operation targeting government and public-sector organizations in Central Asia, with additional victims in Syria, deployed two newly identified backdoors, **OctLurk** and **SilkLurk**, alongside a proxy implant called **LurkProxy** and post-compromise tools including Impacket `secretsdump`, Browser Password Decryptor, Fscan, WinRAR, 7-Zip, a keylogger, Pandora RC agent, and in one case **PlugX**. The activity, active since January 2025, used victim-specific decryption, in-memory execution, obfuscation, and plugin-based modules to support command execution, file theft, surveillance, credential access, and remote administration, and is assessed with medium confidence to be operated by the same Chinese-speaking threat actor. The campaign appears connected through infrastructure overlap to **MystRodX**, a previously undocumented Linux C++ backdoor delivered by an ELF dropper and initially misclassified as Mirai. MystRodX uses layered encryption, configurable TCP/HTTP communications, and a passive raw-socket “wake-up” mode triggered by crafted DNS or ICMP packets, allowing it to avoid open listening ports; it also maintains persistence through a dual-process guardian mechanism. Prior analysis identified multiple active C2 servers and distinct campaigns tied to separate RSA public keys, and the newly reported overlap with TrustFall, MystRodX, and SilentRaid infrastructure suggests a broader multi-platform espionage ecosystem spanning both Windows and Linux operations.
Jul 31, 2026
Arctic Wolf reported an **India-nexus espionage campaign** attributed to **SloppyLemming** (aka *Outrider Tiger* / *Fishing Elephant*) targeting government entities and critical infrastructure operators in **Pakistan and Bangladesh** (with additional reporting noting **Sri Lanka**). The activity, tracked from **January 2025 to January 2026**, used two main infection chains: (1) **PDF lure documents** that redirected victims to **ClickOnce** manifests, deploying a **DLL sideloading** package using a legitimate `.NET` runtime executable (`NGenTask.exe`) alongside a malicious loader (`mscorsvc.dll`) that decrypted and executed a custom x64 shellcode implant dubbed **BurrowShell**; and (2) **macro-enabled Excel** lures delivering a **Rust-based** keylogger/recon tool with capabilities including port scanning and network enumeration. BurrowShell was described as a full-featured backdoor enabling file operations, screenshot capture, remote shell execution, and **SOCKS proxy** tunneling, while attempting to blend in by masquerading C2 as **Windows Update** traffic and using **RC4** with a 32-character key for payload protection. Infrastructure analysis tied the campaign to **112 Cloudflare Workers domains** registered during the tracking period—an expansion in scale compared to prior public reporting—and included government-themed domain naming intended to increase victim trust. Reported targets included Pakistani nuclear regulatory and defense-adjacent organizations (e.g., the **Pakistan Nuclear Regulatory Authority**, **Pakistan Navy**, and logistics/telecom entities) and Bangladeshi energy and financial-sector organizations (including power grid/utility operators). Arctic Wolf assessed the actor as moderately capable, citing multi-stage execution and defense evasion knowledge alongside operational security lapses (e.g., exposed directories), and noted the activity as an expansion of threat activity previously identified publicly by Cloudflare.
Jun 29, 2026
Government entities in the Middle East were targeted in a July 2026 intrusion campaign that researchers linked with moderate-to-high confidence to an East Asia-based threat actor. The attack chain began with `ISO` or `IMG` lure files containing a legitimate ASUSTek executable, `RegSchdTask.exe`, which sideloaded a malicious DLL, `AsTaskSched.dll`, to deploy a newly documented backdoor called **TELESHIM**. Researchers said TELESHIM used heavy obfuscation, anti-analysis checks, and scheduled-task persistence, while abusing the Telegram API for command-and-control to blend malicious traffic with legitimate services. The operation then used a reflective loader named **MIXEDKEY** to decrypt and launch the final **BINDCLOAK** implant, with decryption tied to the victim machine through environmental keying based on the volume serial number. Investigators also observed hands-on-keyboard activity after compromise, including reconnaissance, persistence creation, connectivity checks, and staged delivery of follow-on payloads, with command activity concentrated between 4 AM and 12 PM UTC. The campaign has not been attributed to a known APT group, but the malware set and tradecraft indicate a targeted espionage operation against regional government networks.
Jul 27, 2026