Researchers tracked a cluster of SpiceRAT command and control servers active from late 2025 to August 2026, linked to the SilkParasite campaign targeting Central Asian government and energy sectors. The infrastructure is identified by shared artifacts: a TLS certificate impersonating Uzbekistan's railway authority issued by a Chinese state-affiliated CA, reused hostnames resolving to multiple servers across different countries, and a cloned RTX Corporation homepage serving as a decoy page with a unique SHA-256 hash found on 13 hosts. The cluster overlaps with infrastructure attributed by Bitdefender to multiple malware families including SpiceRAT, NodeEdgeRAT, and NomadRAT. Passive DNS data indicates the infrastructure has been active since at least mid-2022. The report focuses on detection and infrastructure analysis using internet-wide scan data and does not address malware delivery or behavior.

The infrastructure supports command and control operations for multiple malware families, enabling persistent remote access and control over targeted networks in government and energy sectors in Central Asia. The use of legitimate-appearing TLS certificates and cloned web pages aids in evading detection and impersonating trusted entities. While no direct compromise of the named organizations is confirmed, the infrastructure facilitates ongoing espionage and cyber operations against sensitive sectors.

No direct remediation or patch is applicable as this is an adversary infrastructure report rather than a software vulnerability. Defenders should leverage the provided indicators of compromise—such as the specific TLS certificate details, the unique SHA-256 hash of the cloned webpage, and the unusual RDP-over-TLS high ports (e.g., 64350, 64330, 65535, 65111)—to detect and block related network activity. Retroactive network hunts using the HuntSQL queries and IOC tables shared in the report are recommended to identify potential compromises. There is no indication that the targeted organizations are compromised or that immediate action beyond detection and monitoring is required.