SilkParasite: Tracking a China-Nexus APT Across Central Asia

SilkParasite is a cyberespionage operation assessed with medium confidence as China-nexus, targeting government bodies across Central Asia. It deploys seven remote access tool families, five of which are newly identified: DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, and NodeEdgeRAT. Initial access is gained through spear-phishing with malicious Microsoft Office documents using regionally tailored lures impersonating government ministries. The campaign uses DLL sideloading as the main delivery mechanism and leverages Google Drive for command-and-control communications to blend into trusted services. Infrastructure analysis links the operation to China Unicom's backbone network, and operational patterns suggest a functioning software organization with maintained build pipelines and strong operational security.

The campaign enables persistent remote access to targeted government networks in Central Asia, facilitating espionage activities. The use of multiple RAT families, including novel tools, and sophisticated delivery and communication techniques increases the difficulty of detection and mitigation. The operation's ties to a major network backbone and professional operational security indicate a sustained threat capable of long-term intelligence gathering.

No specific patch or remediation is indicated for this campaign. Defenders should focus on detecting and blocking spear-phishing attempts, especially those involving malicious Microsoft Office documents. Monitoring for DLL sideloading behaviors and unusual use of cloud services like Google Drive for command-and-control may help identify infections. Since this is an active espionage campaign rather than a software vulnerability, standard endpoint protection and user awareness are key mitigations.