SilkParasite Infrastructure: SpiceRAT Servers Tied to Energy and Government Targets Across Central Asia

A cluster of command and control servers linked to the SpiceRAT malware family has been active from late 2025 through August 2026, targeting energy and government entities across Central Asia. The infrastructure uses shared TLS certificates, domain registrations, and a cloned corporate webpage to support multiple RAT families, including SpiceRAT, NodeEdgeRAT, NomadRAT, and BloodAlchemy. Notably, a TLS certificate impersonating Uzbekistan's railway authority was issued by a Chinese state-affiliated certificate authority. Domains spoof various Central Asian government organizations, indicating a focused regional targeting campaign. Passive DNS data shows the infrastructure has been operational since mid-2022, suggesting a long-term espionage operation. The infrastructure shares characteristics with known China-nexus threat actors FamousSparrow and IndigoZebra. No known exploits in the wild or patches are applicable as this is an active threat infrastructure rather than a software vulnerability.

• SilkParasite: Tracking a China-Nexus APT Across Central AsiaMalware2026-08-20
• Phishing in the Balkans: Fake Traffic Fines, Real LossesPhishing2026-07-01
• Operation TaxShadow: Multi-Region Tax Phishing & In-Memory Malware CampaignCampaign2026-06-04
• Exposing a Global Smishing Operation Across 19 Countries: Governments, Postal Services, and Telecoms TargetedCampaign2026-05-27
• Middle East Crisis Exploited by Fraudsters: Government Impersonation and Evacuation Scam Infrastructure IdentifiedCampaign2026-03-11