MalwarePublished 3 Nov 2025Updated 3 Dec 2025

Operation Peek-a-Baku: APT Targets Dushanbe with Espionage Campaign

Source AlienVault OTX General

Description

The Silent Lynx APT group has been conducting espionage campaigns targeting diplomatic entities and critical infrastructure in Central Asia, Russia, and China. Two major campaigns were identified: one focused on Russia-Azerbaijan relations and another on China-Central Asia relations. The group used various malware tools including PowerShell scripts, .NET implants, and C++ reverse shells. They leveraged spear-phishing emails with malicious attachments and GitHub-hosted payloads. Key targets included government think-tanks, diplomats, and entities in mining, transport and communication industries. The campaigns coincided with important summits and meetings between the targeted countries. Attribution was based on similarities in tactics, tools, and victimology to previous Silent Lynx operations.

Impact

For European organizations, the primary impact of Operation Peek-a-Baku lies in espionage and intelligence theft, particularly for entities involved in diplomatic relations, international trade, or sectors linked to mining, transport, and communications. Confidentiality of sensitive diplomatic communications and strategic economic information could be compromised, potentially undermining national security and economic interests. The campaign’s use of sophisticated malware and living-off-the-land techniques increases the risk of prolonged undetected presence, enabling extensive data exfiltration. Although the campaign currently focuses on Central Asia, Russia, and China, European diplomatic missions, think tanks, and companies with ties to these regions could be secondary targets or collateral victims. The timing around summits suggests attackers aim to gain intelligence advantages during critical negotiations or geopolitical events. Disruption to availability or integrity is less likely, but the loss of confidentiality alone can have severe strategic consequences. Additionally, the use of GitHub-hosted payloads and spear-phishing indicates that European organizations with less mature email and endpoint defenses may be vulnerable to initial compromise. Overall, the threat underscores the need for vigilance in protecting diplomatic and critical infrastructure sectors from advanced persistent threats with geopolitical motivations.

Defensive guidance

European organizations should implement targeted defenses against spear-phishing, including advanced email filtering, user awareness training focused on detecting malicious attachments and links, and strict policies on opening unsolicited emails. Monitoring and restricting PowerShell usage and other scripting environments can reduce the risk of living-off-the-land exploitation; enable logging and alerting on suspicious PowerShell commands and network connections. Network segmentation and strict egress filtering can limit the ability of reverse shells to communicate with external command and control servers. Since attackers use GitHub-hosted payloads, organizations should monitor and restrict downloads from external code repositories and implement application whitelisting where feasible. Endpoint detection and response (EDR) solutions should be tuned to detect .NET implants and unusual process behaviors. Regular threat hunting exercises focusing on indicators of compromise related to Silent Lynx TTPs (e.g., Ligolo-ng, SilentLoader) can help identify early signs of intrusion. Diplomatic and critical infrastructure entities should coordinate with national cybersecurity centers for threat intelligence sharing and incident response support. Finally, maintaining up-to-date backups and incident response plans tailored to espionage scenarios will aid in rapid containment and recovery if compromise occurs.

Indicators of compromise

Domains 2

catalog-update-update-microsoft.serveftp.com
updates-check-microsoft.ddns.net

IP addresses 3

37.18.27.27
62.113.66.137
62.113.66.7

Hashes 50

121ed107b6faa57634ea2039e2feba2e
123f6b5b0b4220a30cc1605b144ff69e
21ea02342c9ab5510201e5776dd518da
3552fb1c5a7ef8b30afa3aa1027bd298
473949798b06cf667bdd198c894e89a2
56db53cdaf0f2b4b35a3112d75535fd3
77ef95fbb1df302f18e7de1f74a7e18f
97fa48a29a56a0e769a21968c9960a26
a4840200cdc6fc37beabc18abb061df5
c2cc85e71cd58a78d2c1f336771533a9

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 3 Nov 2025, 20:18 UTC

MITRE ATT&CK techniques11 from threat tags

Technical details

Indicators of compromise

Domains 2

IP addresses 3

Hashes 50

Community reviews

Related threats