New Backdoors OctLurk and SilkLurk Linked to Chinese-Speaking Hackers Hitting Central Asian Governments

A suspected Chinese-speaking threat actor has been running targeted intrusions against government bodies across Central Asia since at least January 2025. Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and Syria have all been hit, with victims spanning healthcare, law enforcement, foreign ministries, logistics, education, and urban planning.

Kaspersky published the findings this week, noting the campaign doesn't match any previously tracked group. The activity is being attributed to a Chinese-speaking actor based on tooling and behavioural indicators rather than a formal attribution.

The operation introduces two previously undocumented backdoors: OctLurk and SilkLurk. Both are heavily obfuscated, run almost entirely in memory, and support plugin architectures that extend their capabilities well beyond basic remote access. A third component, LurkProxy, handles network traffic routing.

Neither backdoor leaves much on disk. OctLurk decodes its payload using the infected machine's drive serial number; SilkLurk uses the computer name. This victim-specific encoding makes automated detection considerably harder and adds friction for anyone attempting reverse engineering.

How attackers initially gain access remains unknown. What Kaspersky's researchers did establish is that OctLurk is injected directly into memory via a loader. Before executing, the malware checks internet connectivity through the domain dns.ssentialserv[.]xyz, then runs a batch script that launches LurkProxy. That tool connects back to a remote server at 154.196.162[.]76 for command-and-control.

Once running, OctLurk phones home to a hardcoded C2 server, sends encrypted system information, and begins pulling plugins into memory. The capabilities those plugins unlock are fairly comprehensive: command shell access, file system operations, clipboard monitoring, screenshots, and mouse simulation.

The attackers used OctLurk's command shell plugin to carry out a fairly methodical post-compromise routine. They fingerprinted hosts, pulled logon event logs for specific users, and used Impacket's secretsdump.py to harvest password hashes from domain controllers. A keylogger was dropped and disguised as AnyDesk to avoid raising alarms. Chrome and Firefox passwords were decrypted and extracted. Remote access was established via Pandora RC. Internal and public networks were scanned with Fscan, targeting SSH on port 22 and MySQL on port 3306, with credentials attempted from a file called pp.txt. The attackers also connected to email servers and issued commands to collect messages.

LurkProxy operates in one of two modes at any given time: either as a SOCKS5 proxy or a transparent proxy. The choice of mode determines how traffic is routed through the target address.

SilkLurk is deployed through a DLL side-loading chain and establishes its own TCP connection to a C2 server specified in its configuration. After sending system information, it waits for commands, which can include adjusting its polling interval, updating its configuration, or receiving additional plugins. Post-compromise activity tied to SilkLurk involved staging and archiving confidential documents from network shares using WinRAR and 7-Zip, along with dropping PlugX, a backdoor with a well-established history among Chinese threat groups.

Kaspersky also identified infrastructure overlaps between this campaign and an earlier set of attacks involving a C++-based implant known as SilentRaid, also tracked as MystRodX and TrustFall. Whether the two campaigns ran simultaneously or sequentially isn't clear yet.

The broader picture here is a well-resourced actor quietly working through Central Asian government networks using purpose-built tools designed to minimise forensic traces and frustrate detection. The plugin-based architecture means capabilities can be swapped in and out without touching the core implant, which is a sensible approach if you want to stay resident on a network for an extended period without being noticed.