Loading story…
Hunt.io identified a 13-server suspected command-and-control cluster associated with SpiceRAT targeting government, telecommunications, and energy organizations across Uzbekistan, Turkmenistan, Tajikistan, Kyrgyzstan, and Kazakhstan. The servers impersonated regional government agencies, telecom providers, and energy entities, using cloned RTX Corporation web content alongside shared domains, TLS certificates, registration relationships, and recurring hosting patterns.
Researchers expanded the SilkParasite-linked infrastructure by pivoting from a shared page hash and TLS certificate, finding overlaps with infrastructure previously reported for NodeEdgeRAT and NomadRAT. Passive-DNS records indicate related subdomains may extend to mid-2022, but the findings are infrastructure-based rather than evidence of confirmed intrusions or malware-sample linkage; they support either a common operator or shared support infrastructure, without definitive attribution.
TTPs, infrastructure, and targeting history in one profile.
9 events from the most recent confirmed update back to the earliest known activity.
Five SpiceRAT-detected servers were simultaneously active in mid-March 2026: 46.30.191.230, 188.190.29.126, 193.29.59.159, 31.58.220.250, and 171.22.16.187.
The previously reported SpiceRAT indicator manager.skycom.support resolved to 194.68.225.168 and 194.14.217.119 in late January 2026.
The hostname ns2.asiainfo.it.com resolved to SpiceRAT-detected servers in Estonia, Bulgaria, and other provider networks during January and February 2026.
A TLS certificate for azure.uzrailwaystax.com, spoofing Uzbekistan's state railway authority, became valid. The certificate was later observed on eight hosts in the identified infrastructure.
Researchers tracked suspected SpiceRAT command-and-control infrastructure from late 2025 through August 2026.
Passive-DNS history showed related natcommunzu.com infrastructure dating to July 2022, indicating elements of the broader cluster may have operated since then.
Before publication, researchers notified apparent impersonation targets and relevant national CERTs regarding domains spoofing Central Asian government, telecommunications, and energy entities. They emphasized that the notifications did not establish compromise or confirm the named organizations as victims.
Shared domains, certificates, webpage hashes, registration relationships, and hosting patterns linked the SpiceRAT-associated infrastructure with infrastructure reported for NodeEdgeRAT and NomadRAT. Researchers assessed the evidence as consistent with either a common operator using multiple toolsets or shared support infrastructure, without definitive attribution.
Researchers pivoted on an identical cloned RTX Corporation webpage hash and a spoofed TLS certificate to identify 13 linked hosts, including servers previously reported as SpiceRAT command-and-control infrastructure. The RTX content was assessed as static decoy material, with no identified payloads, credential forms, or malicious code.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 113 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
reddit.com
Open sourcehunt.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A previously unreported cyberespionage campaign dubbed **SilkParasite** has targeted government bodies across Central Asia, with researchers assessing the activity with medium confidence as having a China nexus. The operation, first identified in late 2025, used spear-phishing emails carrying password-protected RAR archives and malicious Microsoft Office documents that triggered **DLL sideloading** to deploy malware. Lures were tailored to government entities in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, Kazakhstan, and one Georgian government organization. Bitdefender linked the campaign to a small, modular, professionally engineered toolset spanning **.NET, C++, Go, and JavaScript**, including seven remote access trojan families and five newly documented strains: `DriveSilkRAT`, `CookiETagRAT`, `NomadRAT`, `GoginRAT`, and `NodeEdgeRAT`. Attribution was further supported by the use of **BLOODALCHEMY** and an updated **SpiceRAT** variant associated with Chinese-speaking threat activity. Researchers said the malware ecosystem showed signs of **AI-assisted development**, including phishing content and coding artifacts, while one implant used **Google Drive** for command-and-control; the most consistent detection opportunity was DLL sideloading by legitimately signed applications launched from unusual locations.
Aug 28, 2026
Cisco Talos reported that Chinese-speaking threat actor **UAT-10147** targeted vulnerable internet-facing **Windows IIS** and **Linux** servers worldwide, using publicly disclosed one-day flaws to gain access and then deploying a broad post-compromise toolkit tied to **SEO fraud** and data theft. Talos said the group used AI-assisted workflows to automate reconnaissance, exploit validation, payload deployment, persistence, and operational documentation, and maintained infrastructure suggesting significant scale, including a target list of roughly **170,000 URLs**. On compromised Windows systems, the actor used batch scripts, scheduled tasks, rogue user creation, **EfsPotato**, and Defender exclusions; on Linux, it relied on web shells and local privilege-escalation exploits to obtain root access. A central payload in the campaign was **SPECTRE**, a custom cross-platform backdoor for Windows and Linux that supports HTTP-based command and control, anti-analysis, process injection, credential access, and on Windows a **BYOVD** technique to reduce EDR visibility by unlinking kernel callbacks. On Linux, SPECTRE deployed a rootkit called **Specter**, disguised as `acpi_pad.ko` and persisted through a fraudulent systemd service to hide processes and modules and elevate privileges. Talos also observed **Noodle RAT**, **QuasarRAT**, **Gh0stCringe**, **Meterpreter**, and web shells in the same operations; prior research has linked Noodle RAT variants to multiple Chinese-speaking espionage and financially motivated clusters, including Linux samples that copy themselves to `/tmp/CCCCCCCC`, decrypt configuration with RC4 using the hardcoded key `r0st@#$`, and connect to attacker-controlled C2 servers.
Aug 28, 2026
Researchers linked a cluster of hacktivist activity with medium confidence to **4BID** and associated groups including **Hakerskii Kit**, **C.A.S.**, and **Goffee**, reporting that operations have expanded beyond Russia and Belarus into **Kazakhstan, the UAE, Syria, and Egypt**. The attackers primarily obtained initial access by exploiting **ProxyShell** on vulnerable **Microsoft Exchange** servers, then installed the `fd.aspx` web shell and used custom scripts alongside legitimate remote management and monitoring tools to deepen access and persistence. Post-compromise activity included deployment of **BlackReaperRAT**, **Warp RAT**, **Sliver**, **Havoc**, **Mythic Apollo**, **AdaptixC2**, and a newly documented **BlackSalt** backdoor, as well as utilities such as **AnyDesk**, **Panorama9**, **Dev Tunnels**, **Tactical RMM**, and **Nezha Monitoring**. Investigators also observed **EDR killers**, **ClearWater ransomware**, and an updated **Blackout Locker** variant, indicating that the campaigns have evolved from primarily politically motivated disruption into broader operations with a stronger **financially motivated** component.
Jul 1, 2026