Do Son 
At a glance
| Field | Detail |
|---|---|
| Malware family | OctLurk (plugin-based backdoor); SilkLurk (plugin-based backdoor); LurkProxy (network proxy utility) |
| Threat actor | Unknown group; assessed with medium confidence to be Chinese-speaking |
| Targets | Government organizations in Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and the Syrian Arab Republic |
| Delivery vector | Admin-credential-based remote scheduled tasks; DLL sideloading via legitimate NVIDIA and Realtek binaries |
| Key capabilities | Remote shell, file management, screen capture, keylogging, browser credential theft, AD recon, email harvesting, secondary payload delivery |
| Source | Kaspersky GReAT (Saurabh Sharma and Yaroslav Kikel) |
TL;DR
Kaspersky’s GReAT team uncovered two previously undocumented backdoors, OctLurk and SilkLurk, actively targeting government networks across Central Asia since January 2025. Both families run almost entirely in memory and customize each loader using the victim’s own machine data. Kaspersky assesses with medium confidence that a Chinese-speaking actor operates both families, though the group remains unattributed.
Why it matters
The campaign hits sensitive sectors: ministries of foreign affairs, law-enforcement agencies, healthcare bodies, research institutes, logistics, and schools. Six countries: Afghanistan, Kazakhstan, Kyrgyzstan, Tajikistan, Uzbekistan, and Syria, have confirmed victims. Cyber Security News, which reviewed the Kaspersky report, notes the intrusion shows how a determined espionage team can turn one compromised machine into a doorway to a wider government network.
Delivery
OctLurk reaches new machines using existing admin credentials. The actor creates a remote scheduled task that executes a batch script with System privileges. That script registers a Windows service that loads a malicious loader DLL disguised with names borrowed from legitimate Windows components. SilkLurk takes a different path. Its loader hides inside services that run legitimate NVIDIA and Realtek signed binaries, which then sideload a malicious DLL into process memory.
Infection chain
OctLurk: victim-specific decryption
The OctLurk loader uses double-XOR decryption combined with zlib decompression to recover the backdoor. Crucially, one of the two XOR keys derives from the C: drive serial number. This means the payload decrypts correctly only on the intended machine. The backdoor then injects itself into memory and reaches a C2 server over port 443. It collects hostname, username, IP, OS version, and timestamp, then awaits commands and plugins.
SilkLurk: computer-name-keyed decryption
SilkLurk’s loader verifies it is running inside the expected host process before acting. Next, it creates a persistence service and decrypts the payload using a hash of the victim’s computer name. Kaspersky describes this victim-specific encoding, noting it “makes reverse engineering and automated detection considerably harder.” The decrypted shellcode then reflectively injects the SilkLurk backdoor into memory.
LurkProxy
A third implant, LurkProxy, uses the same OctLurk-style loader but acts as a network proxy rather than a backdoor. It listens on a hard-coded port and tunnels traffic to the C2 over TLS. It supports both a SOCKS5 mode and a transparent proxy mode, giving the operator flexible routing options.
C2 and post-compromise activity
OctLurk downloads plugins from the C2 directly into memory. Three core plugins handle command shell access, file system operations, and screen or keyboard interaction. After establishing a foothold, the actor deploys a victim-fingerprinting script that maps hardware, running processes, Defender state, and event logs to three output files. Then come credential-harvesting tools: a portable version of Impacket’s secretsdump extracts domain controller password hashes, a keylogger captures keystrokes and clipboard content, and a browser-decryption tool targets Chrome and Firefox credential stores.
SilkLurk-based intrusions follow a different exfiltration path. Operators connect to internal network shares with admin credentials, search for confidential documents, archive them with WinRAR or 7-Zip, then clean up the share connection. In one incident, SilkLurk delivered PlugX as a second stage, configured with the campaign ID KG_MFA.
Attribution
Kaspersky confirmed the same actor operates both families. In one incident, the attacker used an OctLurk shell to drop the SilkLurk loader. In a second, both loader DLLs appeared in the same staging directory. The deployment of PlugX, a RAT historically linked to Chinese-speaking actors, further supports the attribution. However, Kaspersky states it “cannot attribute this activity to any known group.” The Chinese-speaking assessment is therefore suspected, not confirmed.
Detection and defense
Defenders should hunt for suspicious scheduled tasks using admin credentials to reach remote machines, Windows services that load DLLs from unusual paths alongside legitimate NVIDIA or Realtek executables, and unexpected in-memory process injection. Monitor for Impacket activity against domain controllers and watch for network connections from svchost to external C2 addresses. Full indicators of compromise, including hashes, file paths, and C2 domains, appear in the Kaspersky GReAT report. Restrict outbound connections from servers in your environment and enforce least-privilege controls on scheduled-task creation.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
