OctLurk and SilkLurk: new Backdoors in Central Asia

Two newly identified backdoors, OctLurk and SilkLurk, have been targeting government organizations across Central Asia since January 2025. Victims span Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and Syria, affecting healthcare, research, government offices, ministries of foreign affairs, logistics, law enforcement, urban planning, and educational institutions. Both backdoors employ heavily obfuscated loaders customized per victim, using machine-specific data for decryption. They deploy multiple plugins for command execution, file manipulation, credential harvesting, keylogging, network scanning, and remote access. The attackers also utilized LurkProxy for network traffic proxying and deployed additional tools including PlugX, Impacket, FSCAN, and Pandora FMS agents. Analysis indicates both backdoors are operated by the same Chinese-speaking threat actor, though attribution to a specific known group remains unconfirmed. The campaigns demonstrate sophisticated persistence mechanisms and ext...

• Analysis of a Modular Cyber Espionage FrameworkMalware2026-08-07
• The banana stand: brokering and managing infections across Asia using MQTTMalware2026-09-16
• Melofee: a look back at a Linux implant and its new variantsMalware2026-09-10
• CoolClient backdoor goes deeper: Windows kernel rootkit addedMalware2026-08-14
• SilkParasite: Tracking a China-Nexus APT Across Central AsiaMalware2026-08-20