A recent wave of cyberattacks, active since January 2025, has been attributed to a Chinese-speaking threat actor. The primary targets are government organizations in Central Asia, including Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and the Syrian Arab Republic. These entities span critical sectors such as healthcare, research, foreign affairs ministries, law enforcement, and public education. Cybersecurity firm **Kaspersky** is tracking this activity, noting that it has not yet been linked to any known advanced persistent threat (APT) group. The attacks are characterized by the deployment of two novel, highly obfuscated backdoors, **OctLurk** and **SilkLurk**, along with a network traffic proxy tool named **LurkProxy**.  ### Sophisticated Backdoors for Comprehensive Compromise **OctLurk** and **SilkLurk** are designed to be extensible, capable of downloading and injecting additional plugins to execute a wide array of malicious actions. These include launching command shells, manipulating file systems, synthesizing keyboard and mouse events, network scanning, credential dumping, keylogging, and even stealing passwords from web browsers and email clients. They also facilitate remote access to compromised systems. Kaspersky researchers Saurabh Sharma and Yaroslav Kikel highlighted the extensive capabilities of these tools, emphasizing their ability to maintain control and perform deep reconnaissance. ### Initial Access and Execution Chain The initial access vector for these attacks remains unknown. However, analysis reveals that **OctLurk** is injected directly into memory via a loader. Before execution, the attackers verify internet connectivity to a domain (`dns.ssentialserv[.]xyz`), then launch a batch script responsible for deploying **LurkProxy**. This proxy then establishes contact with a command-and-control (C2) server at `154.196.162[.]76`. Upon execution, **OctLurk** gathers system information, encrypts it, and transmits it to a hard-coded C2 server (`dns.multitoconference[.]com`) over a stream socket. It is equipped to load plugins received from the C2 server directly into memory, enabling command execution, file operations, clipboard manipulation, screenshot capture, and mouse movement control. ### Post-Compromise Activities of OctLurk The threat actors leverage **OctLurk**'s command shell plugin for a series of intrusive actions: * **Host Fingerprinting:** Gathering extensive data about the compromised system. * **Logon Event Harvesting:** Exporting and querying successful remote interactive logon events for specific users. * **Credential Dumping:** Harvesting password hashes from domain controllers using **Impacket**'s `secretsdump.py` tool. * **Keylogging:** Deploying a keylogger disguised as **AnyDesk** to evade detection. * **Browser Password Theft:** Decrypting and extracting passwords from **Google Chrome** and **Mozilla Firefox**. * **Remote Access:** Establishing remote access using the **Pandora RC** agent. * **Network Scanning:** Utilizing **Fscan** to identify services on internal and public networks (e.g., SSH on port 22, MySQL on port 3306) and attempting access with credentials from a file named `pp.txt`. * **Email Collection:** Connecting to email servers, authenticating, and issuing commands to collect or manipulate emails. ### LurkProxy and SilkLurk's Role **LurkProxy** functions as a reverse proxy, operating in either SOCKS5 or transparent proxy mode to route network traffic. Only one mode is active at any given time. **SilkLurk** is launched via a DLL executed through a DLL side-loading sequence. It then creates a TCP socket to connect to a C2 server specified in its configuration, collects victim information, and transmits it. The C2 server responds with commands, which can include retrieving local system time, setting polling intervals, updating configuration, and injecting additional plugins into memory. Post-compromise activities linked to **SilkLurk** include: * **Data Exfiltration Preparation:** Using `cmd.exe` to launch PowerShell commands to connect to shared network resources with administrative credentials, search for and stage confidential documents, disconnect from shares, and archive stolen data using legitimate tools like **WinRAR** and **7-Zip**. * **Malware Deployment:** Initiating a DLL side-loading chain to drop **PlugX**, a well-known backdoor frequently used by Chinese hacking groups. ### Infrastructure Overlaps and Evasion Tactics **Kaspersky** identified infrastructure overlaps between this campaign and previous attacks involving a C++-based implant known as **SilentRaid** (also called MystRodX and TrustFall). This suggests shared infrastructure, though it's unclear if these campaigns ran concurrently or at different times. “The emergence of the **OctLurk** and **SilkLurk** multi-plugin malware framework highlights how threat actors continuously refine their tactics to evade detection and maintain control over compromised networks,” Kaspersky stated. Both malware families operate primarily in memory, leaving minimal forensic traces on disk. They employ victim-specific encoding (using drive serial numbers for **OctLurk** and computer names for **SilkLurk**) to decode payload locations, significantly hindering reverse engineering and automated detection efforts.