OctLurk and SilkLurk Target Central Asian Governments

Since January 2025, a suspected Chinese-speaking threat actor has targeted government organizations in Central Asia, including Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and the Syrian Arab Republic. The campaign targets diverse sectors such as healthcare, research, foreign affairs, and law enforcement. The attackers utilize two sophisticated, multi-plugin backdoors, OctLurk and SilkLurk, alongside a network proxy tool named LurkProxy.

Technical analysis reveals that these backdoors are highly obfuscated and utilize victim-specific machine data (such as drive serial numbers and computer names) to decrypt payloads, complicating automated detection and reverse engineering. The attack chain involves service creation for persistence, DLL side-loading of legitimate binaries, and the deployment of additional tools like PlugX, Impacket's secretsdump, and the Pandora RC agent for remote control.

The business impact is significant due to the breadth of compromised sectors and the depth of exfiltration capabilities. The attackers have demonstrated the ability to harvest domain credentials, decrypt browser passwords, and manipulate email servers. The overlap in infrastructure with previous campaigns involving the SilentRaid (MystRodX) implant indicates a persistent and evolving threat landscape in the region.