SilkParasite Campaign Targets Central Asia with New RATs

Executive Summary

Researchers at Bitdefender have published a report on a sophisticated cyberespionage campaign dubbed SilkParasite. The operation, which began as early as October 2025, targets government organizations in Central Asia, with a focus on entities involved in economic policy. Bitdefender attributes the campaign with medium confidence to a China-nexus threat actor. The attackers employ a custom, modular malware arsenal, including five previously unknown Remote Access Trojans (RATs). A key feature of the campaign is the use of legitimate cloud services, specifically Google Drive, for command and control (C2) communications, making the malicious traffic difficult to distinguish from benign activity.

Threat Overview

The SilkParasite campaign is characterized by its stealth and use of advanced, custom tooling. The primary targets are government bodies in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, and Kazakhstan. The goal appears to be long-term espionage to gather intelligence on economic matters.

Initial access is achieved via spear-phishing emails containing password-protected RAR archives. Inside the archives are malicious Microsoft Office documents crafted to be relevant to the target ministry or official. When the victim opens the document, a multi-stage infection process begins, ultimately deploying one of several RATs.

The attackers use seven different RAT families, with five being newly discovered: DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, and NodeEdgeRAT. The malware shows links to known China-nexus toolsets like ShadowPad and Deed RAT, suggesting a connection to established APT actors.

Technical Analysis

The campaign's infection chain is designed for stealth and persistence.

1. Initial Access: The attack starts with a T1566.001 - Spearphishing Attachment. The use of password-protected archives helps bypass initial email gateway scans.
2. Execution: Upon opening the malicious document, a loader component is executed. A key technique used is T1574.002 - DLL Side-Loading, where a legitimate application is tricked into loading a malicious DLL.
3. Command and Control: The most innovative TTP is the use of Google Drive for C2 by the DriveSilkRAT. The malware uses the Google Drive API to download new plugins and receive commands, which are stored in files within the attacker's cloud storage. This is a form of T1071.001 - Web Protocols combined with T1102 - Web Service to hide C2 traffic within legitimate, encrypted web traffic.
4. Espionage: Once active, the RATs provide the attackers with full control over the compromised system, allowing them to perform file exfiltration, keylogging, screen capture, and other intelligence-gathering activities (T1056 - Input Capture, T1113 - Screen Capture).

MITRE ATT&CK Techniques

• T1566.001 - Spearphishing Attachment
• T1574.002 - DLL Side-Loading
• T1071.001 - Web Protocols
• T1102 - Web Service
• T1056 - Input Capture
• T1113 - Screen Capture
• T1041 - Exfiltration Over C2 Channel

Impact Assessment

The SilkParasite campaign represents a significant threat to the national security and economic stability of the targeted Central Asian nations. By infiltrating government bodies responsible for economic decisions, the threat actor can gain advance knowledge of policy changes, trade negotiations, and other sensitive information. This intelligence can provide a significant economic and geopolitical advantage. The use of stealthy, custom malware and legitimate services for C2 makes detection and attribution challenging, allowing the campaign to persist for long periods.

IOCs — Directly from Articles

No specific file hashes, C2 domains, or IP addresses were provided in the source articles.

Cyber Observables — Hunting Hints

Security teams can hunt for signs of SilkParasite activity by looking for:

Detection & Response

• Network Traffic Analysis: Use D3-NTA: Network Traffic Analysis with SSL/TLS inspection to monitor for anomalous patterns in traffic to legitimate cloud services like Google Drive. Look for periodic, small data transfers from unusual processes.
• Endpoint Monitoring: Deploy EDR to detect DLL side-loading. Monitor for legitimate applications loading DLLs from non-standard paths or unsigned DLLs. This aligns with D3-PA: Process Analysis.
• Email Security: Enhance email security gateways to better detect sophisticated spear-phishing attempts, including analysis of attachments within encrypted archives.

Mitigation

• Application Control: Use application control policies to prevent legitimate applications from loading untrusted DLLs. This is a form of M1038 - Execution Prevention.
• User Training: Train users, especially those in high-risk government roles, to be suspicious of unsolicited emails, even if they appear to be from a legitimate source. This aligns with M1017 - User Training.
• Restrict Web-Based Content: If feasible, restrict or monitor access to personal cloud storage services from government networks to limit the channels available for C2 and exfiltration. This is an application of M1021 - Restrict Web-Based Content.