Threat researchers have uncovered a new, year-long espionage campaign, **SilkParasite**, targeting government bodies across Central Asia. The campaign, detailed in a recent report by **Bitdefender**, utilizes at least seven malware families, five of which were previously unknown. **Bitdefender**'s investigation began with a suspicious infection at an economic-related government institution in an unnamed Central Asian country. Months of forensic work revealed a widespread operation, with malicious documents tailored to appear relevant to government agencies in countries like **Uzbekistan**, **Turkmenistan**, **Kyrgyzstan**, **Tajikistan**, **Georgia**, and **Kazakhstan**, often impersonating ministries. ### China Nexus and Geopolitical Context **Bitdefender** attributes **SilkParasite** to China-based military-grade hackers, citing links between one malware strain and another known Chinese espionage group, as well as several IP addresses tied to Chinese telecommunications companies. The firm theorizes that China's economic expansion in Central Asia, potentially filling a vacuum left by Russia's declining influence, is a primary motivator for spying on economic arms of regional governments. This campaign follows two other China-nexus operations tracked by **Bitdefender** over the past year, targeting Europe and South Asia, including recent incidents in the South Caucasus. ### Initial Access and Evasion Tactics The attackers gained initial access primarily through spear-phishing emails containing malicious **Microsoft Office** documents. These lure documents were often packaged within archives, a tactic designed to bypass email-gateway scanning and increase the likelihood of successful delivery. Among the seven malware strains, **DriveSilkRAT** was the most prevalent, accounting for 65 infections, mostly within the Asian region. **DriveSilkRAT** stands out for its unique command and control (C2) mechanism: instead of communicating with a dedicated server, it leverages shared **Google Drive** folders. This method allows the malware's traffic to blend with legitimate **Google Drive** activity, making it less conspicuous to network monitors in many corporate environments. ### AI in Malware Development A notable aspect of the **SilkParasite** campaign is the observed use of artificial intelligence. **Bitdefender** found evidence of AI-generated content in two email lures and other indicators pointing to AI assistance in the development of the custom malware strains. Despite the AI integration, **Bitdefender** emphasizes that **SilkParasite** remains a product of skilled human professionals. The firm describes it as "professional espionage tooling optimized to limit volume: minimum footprint, dynamic in-memory execution, and code deliberately built not to resemble previous malware families." "APT-grade malware like this remains firmly the work of human professionals," **Bitdefender** stated. "**SilkParasite** is primarily assisted: capable humans do the engineering and lean on AI to move faster, leaving behind a few tells but none of the degradation." Placeholders found in the malware's code provided clues about the AI's involvement, indicating that even sophisticated state-backed actors are adopting AI-assisted coding practices. **Bitdefender** predicts that advanced threat actors will "adopt AI slowly and selectively, folding it into professional workflows where it helps and keeping it away from the places where machine-made mediocrity would give the operation away." ### Growing Concerns Over AI in Cyber Threats The findings from **SilkParasite** align with increasing warnings about the integration of AI into the cyber threat landscape. Recently, the **National Security Agency (NSA)** issued an urgent warning about unnamed threat actors using AI-generated exploit scripts to target critical industrial technology, potentially enabling dangerous real-world attacks. This followed claims by another company of an automated cyberattack against the government of **Taiwan**, further highlighting the evolving nature of AI-driven cyber threats.