SilkParasite TLC DV TLS CA certificate impersonating Central Asian entity

Arnold Chan@slaz

•updated Sep 19, 2026•0•0•0

Detects TLS connections using suspicious certificates identified as belonging to the SilkParasite threat actor. The rule monitors for specific certificate issuer strings paired with either malicious subject domain patterns (targeting Central Asian entities) or specific JA4X fingerprints associated with known malicious activity.