Key Takeaways
- A Chinese‑speaking threat actor has been conducting a sustained cyber‑espionage campaign against government entities in Central Asia and Syria since January 2025.
- The attacks deploy two novel memory‑resident backdoors—OctLurk and SilkLurk—along with a traffic‑proxy utility dubbed LurkProxy.
- OctLurk focuses on credential theft, remote command execution, and network reconnaissance, while SilkLurk enables data staging, archiving, and the delivery of additional payloads such as PlugX.
- LurkProxy operates as a switchable SOCKS5 or transparent proxy, allowing attackers to route malicious traffic through compromised hosts.
- The malware relies on victim‑specific encoding (drive serial number for OctLurk, computer name for SilkLurk) to hide payloads in memory, making detection and reverse engineering considerably harder.
- Infrastructure overlaps with earlier SilentRaid/MystRodX/TrustFall campaigns suggest the actor reuses resources across multiple operations.
Campaign Overview and Timeline
Since the start of 2025, Kaspersky researchers have observed a fresh wave of cyber intrusions aimed primarily at government‑linked organizations across Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and the Syrian Arab Republic. The activity is attributed to a Chinese‑speaking threat actor that has not yet been tied to any known APT group. The campaign appears to be ongoing, with victims spotted in multiple sectors over several months, indicating a deliberate, long‑term espionage effort rather than a opportunistic burst of activity.
Targeted Sectors and Victim Profile
The compromised entities span a broad range of critical functions: healthcare facilities, research institutes, government offices, ministries of foreign affairs, logistics companies, law‑enforcement agencies, urban‑planning departments, facilities‑management firms, and public educational establishments. By hitting such diverse yet strategically valuable targets, the actor seeks to gather intelligence on diplomatic relations, infrastructure projects, public health data, and law‑enforcement capabilities—information that can be leveraged for political, economic, or military advantage.
Malware Arsenal: OctLurk, SilkLurk, and LurkProxy
Kaspersky has identified three core tools in the actor’s toolkit. OctLurk and SilkLurk are newly discovered obfuscated backdoors, while LurkProxy serves as a specialized utility for proxying network traffic. Both backdoors are designed to load additional plugins directly into memory, enabling a modular approach to post‑exploitation tasks. LurkProxy complements the backdoors by providing a covert channel for command‑and‑control (C2) communications, allowing the attacker to blend malicious traffic with legitimate network flows.
Initial Access and Deployment Mechanism
Although the exact initial infection vector remains unknown, analysis shows that OctLurk is injected into memory via a loader program. Before execution, the loader checks connectivity to the domain dns.ssentialserv[.]xyz. If reachable, it runs a batch script that launches LurkProxy, which then establishes a C2 session with the server at 154.196.162[.]76. OctLurk subsequently encrypts harvested system information and transmits it to a hard‑coded C2 endpoint (dns.multitoconference[.]com) over a stream socket, setting the stage for further plugin‑based operations.
OctLurk Capabilities and Post‑Exploitation Actions
Once active, OctLurk executes a versatile command‑shell plugin that enables the attacker to: fingerprint the host and collect detailed system data; export and query successful logon events for specific users; dump password hashes from domain controllers using Impacket’s secretsdump.py; drop a keylogger masquerading as AnyDesk to evade detection; decrypt and extract stored credentials from Google Chrome and Mozilla Firefox; establish remote access via the Pandora RC agent; scan internal and public networks with Fscan to locate services such as SSH (port 22) and MySQL (port 3306), then attempt login using credentials from a file named pp.txt; and connect to email servers to harvest or manipulate messages. This broad functionality lets the actor move laterally, harvest credentials, and maintain persistent control over compromised machines.
SilkLurk Post‑Compromise Activities
SilkLurk is delivered through a DLL side‑loading chain. After establishing a TCP socket to its configured C2 server, it gathers victim information and awaits commands. Upon receiving instructions, SilkLurk can: launch cmd.exe to invoke PowerShell, connect to shared network resources with administrative privileges, locate and stage confidential documents, disconnect from shares, and archive the stolen data using legitimate tools like WinRAR and 7‑Zip; and initiate another DLL side‑loading sequence to drop PlugX, a well‑known backdoor frequently associated with Chinese hacking groups. These actions underscore SilkLurk’s role in data exfiltration and the installation of additional persistent implants.
LurkProxy Functionality
LurkProxy operates as a flexible network‑traffic relay capable of functioning in either SOCKS5 or transparent proxy mode, but only one mode at a time. By acting as a reverse proxy, it lets the attacker route C2 communications—or even lateral movement traffic—through the compromised host, effectively masking the true origin of malicious packets. This capability enhances stealth, as security appliances may see only benign‑looking proxy traffic rather than direct connections to attacker‑controlled infrastructure.
Infrastructure Overlap and Evasion Techniques
Kaspersky noted infrastructural similarities between the current campaign and a prior set of attacks involving the C++‑based implant SilentRaid (also known as MystRodX and TrustFall). The overlap suggests the threat actor reuses certain servers, domains, or certificates across multiple operations, though it is unclear whether the campaigns ran concurrently or sequentially. Both OctLurk and SilkLurk operate primarily in memory, leaving only a minimalistic loader on disk. OctLurk derives its decryption key from the drive’s serial number, while SilkLurk uses the computer name. This victim‑specific encoding hinders automated detection and complicates reverse‑engineering efforts, as analysts must first obtain the unique host attribute to unpack the payloads.
Conclusion and Implications
The emergence of the OctLurk/SilkLurk/LurkProxy toolkit illustrates a growing trend among espionage‑focused actors to adopt modular, memory‑resident malware that leverages legitimate system tools and victim‑specific obfuscation to evade detection. By targeting a wide array of government and critical‑infrastructure sectors across Central Asia and Syria, the actor aims to accumulate a comprehensive intelligence picture that could inform strategic decision‑making. Organizations in the region should prioritize network segmentation, monitor for anomalous proxy or SOCKS5 traffic, enforce strict credential‑management policies, and employ behavior‑based detection solutions capable of identifying memory‑only malicious activity. Continued threat‑intelligence sharing and vigilant hunting for the indicators associated with OctLurk, SilkLurk, and LurkProxy will be essential to mitigate the risk posed by this persistent campaign.