OctLurk Espionage Campaign Expanded From Central Asia to Middle East Governments

A suspected Chinese-speaking threat actor has run a cyber-espionage campaign against government and public-sector organizations in Central Asia since at least January 2025, using the newly identified OctLurk and SilkLurk malware families to maintain persistent access and steal sensitive data. Kaspersky reported victims in Afghanistan, Kazakhstan, Kyrgyzstan, Tajikistan, Uzbekistan, and Syria, and said the modular, largely memory-resident toolset was paired with LurkProxy to support reconnaissance, credential theft, lateral movement, remote access, keylogging, and staged exfiltration with tools such as WinRAR and 7-Zip. Investigators also observed use of secretsdump.py, Fscan, Pandora RC, PlugX, and browser credential theft, while noting infrastructure overlaps with the earlier SilentRaid campaign without making a firm attribution.

Zscaler ThreatLabz said the same activity expanded into the Middle East in July 2026, targeting government entities and the energy sector with BINDCLOAK, a previously undocumented 64-bit Windows backdoor assessed with high confidence to be a variant of OctLurk. Delivered by the MIXEDKEY loader, BINDCLOAK uses TLS over TCP, zlib compression, and dual rolling-XOR message protection, while supporting token theft and impersonation, reflective plugin loading, process discovery, and EDR evasion through indirect import resolution with RtlQueueWorkItem and LoadLibraryW. Researchers linked the operations through shared command-and-control infrastructure and certificate reuse, including domains such as cert.hypersnet[.]com, about.blsouqs[.]com, and ssl.blsouqs[.]com.