Loading story…
A previously unreported cyberespionage campaign dubbed SilkParasite has targeted government bodies across Central Asia, with researchers assessing the activity with medium confidence as having a China nexus. The operation, first identified in late 2025, used spear-phishing emails carrying password-protected RAR archives and malicious Microsoft Office documents that triggered DLL sideloading to deploy malware. Lures were tailored to government entities in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, Kazakhstan, and one Georgian government organization.
Bitdefender linked the campaign to a small, modular, professionally engineered toolset spanning .NET, C++, Go, and JavaScript, including seven remote access trojan families and five newly documented strains: DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, and NodeEdgeRAT. Attribution was further supported by the use of BLOODALCHEMY and an updated SpiceRAT variant associated with Chinese-speaking threat activity. Researchers said the malware ecosystem showed signs of AI-assisted development, including phishing content and coding artifacts, while one implant used Google Drive for command-and-control; the most consistent detection opportunity was DLL sideloading by legitimately signed applications launched from unusual locations.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
Bitdefender said the previously unreported SilkParasite cyberespionage campaign was first discovered in late 2025. The operation targeted government bodies in Central Asia.
Elastic Security Labs first documented the BLOODALCHEMY backdoor, a malware family later cited as one indicator linking SilkParasite to China-nexus activity.
Bitdefender reported on the SilkParasite operation and identified seven RAT families used in the campaign, including five previously undocumented families: DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, and NodeEdgeRAT. The report also assessed the operation with medium confidence as having a China nexus and noted signs of AI-assisted development.
Bitdefender said SilkParasite successfully infected one unnamed Central Asian government institution involved in economic decision-making. The report did not disclose what data was on the system, whether data was stolen, or how long access was maintained.
The campaign used tailored spear-phishing lures against government entities in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, Kazakhstan, and at least one Georgian government entity. The lures used password-protected RAR archives with malicious Office documents that triggered DLL sideloading.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
10 references tracked. Mallory keeps watching after this page renders.
timesca.com
Open sourcetimesca.com
Open sourcecybersecuritynews.com
Open sourcetherecord.media
Open sourcethehackernews.com
Open sourcebusinessinsights.bitdefender.com
Open sourcebitdefender.com
Open sourcetechzone.bitdefender.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple reports detailed **state-linked intrusion activity** relying on social engineering and trusted delivery mechanisms to gain initial access and establish remote control. Researchers reported a suspected state-affiliated espionage operation targeting government and financial organizations in **Kazakhstan and Afghanistan**, built around a previously unreported Windows DLL implant dubbed **KazakRAT** delivered via malicious `MSI` installers and decoy documents (e.g., a fake Kazakh presidential letter and an Afghan provincial memo). The malware was described as relatively unsophisticated—unencrypted HTTP beaconing and minimal obfuscation—yet capable of host reconnaissance, file search/exfiltration, and downloading/executing additional payloads, enabling long-running access since at least 2022. Separately, Insikt Group described **North Korean** operators (tracked as **PurpleBravo**) running the “**Contagious Interview**” campaign, using fake recruiter personas and weaponized “coding tests” hosted on platforms like GitHub to trick software developers into executing malware on corporate devices, supporting software supply-chain targeting. The toolset reportedly includes **BeaverTail** (JavaScript infostealer) and newly identified RATs **PylangGhost** and **GolangGhost**. In another supply-chain style incident, Trend research and an Emurasoft advisory reported the **official EmEditor download** being tampered with to serve a trojanized `MSI` whose `CustomAction` launched PowerShell to fetch staged payloads from lookalike domains (e.g., `EmEditorjp[.]com`, `EmEditorgb[.]com`, `EmEditorde[.]com`), followed by environment fingerprinting and geofencing checks—highlighting ongoing risk from compromised public software distribution channels.
Jun 29, 2026
Kaspersky reported that the threat actor **Bloody Wolf**—tracked by the vendor as **Stan Ghouls**—is running a spear-phishing campaign primarily targeting organizations in **Uzbekistan** and **Russia**, with additional, lower-volume activity observed in other countries. The activity, ongoing since at least 2023, has targeted sectors including manufacturing, finance, and IT, and has also been observed hitting government, logistics, healthcare, and education entities. Reported victim counts for the current wave are on the order of **50+ in Uzbekistan** and **~10 in Russia**, with the actor assessed as likely financially motivated, though the heavy use of remote-access tooling may also support espionage objectives. The intrusion chain relies on phishing emails carrying **malicious PDF lures** (e.g., court/government-themed documents) that embed links leading to a downloader/loader, after which the actor deploys **NetSupport RAT** (a legitimate remote administration tool) for remote control—representing a shift from prior use of **STRRAT**. Kaspersky noted the loader’s behavior includes user-deception (fake error messages) and basic execution controls (e.g., limiting repeated installation attempts), while another reported lure uses a social-engineering pretext that victims must install a **Java Runtime Environment update**, ultimately delivering a **malicious JAR**—a technique Kaspersky described as a distinctive fingerprint for this actor. Prior related reporting cited phishing activity in Kyrgyzstan distributing similar tooling, indicating a broader regional focus beyond the current Uzbekistan/Russia emphasis.
Jun 29, 2026
Hunt.io identified a 13-server suspected command-and-control cluster associated with **SpiceRAT** targeting government, telecommunications, and energy organizations across Uzbekistan, Turkmenistan, Tajikistan, Kyrgyzstan, and Kazakhstan. The servers impersonated regional government agencies, telecom providers, and energy entities, using cloned RTX Corporation web content alongside shared domains, TLS certificates, registration relationships, and recurring hosting patterns. Researchers expanded the SilkParasite-linked infrastructure by pivoting from a shared page hash and TLS certificate, finding overlaps with infrastructure previously reported for **NodeEdgeRAT** and **NomadRAT**. Passive-DNS records indicate related subdomains may extend to mid-2022, but the findings are infrastructure-based rather than evidence of confirmed intrusions or malware-sample linkage; they support either a common operator or shared support infrastructure, without definitive attribution.
Sep 16, 2026