OctLurk and SilkLurk Campaign in Central Asia

Since January 2025, a Chinese-speaking threat actor has been conducting a cyber-espionage campaign across Central Asia, targeting government ministries, healthcare providers, and research institutions. The campaign utilizes two newly identified backdoors, OctLurk and SilkLurk, which are heavily obfuscated and employ victim-specific encryption to evade automated analysis. These tools are designed to remain primarily in memory, using minimalistic loaders to decrypt and inject functional modules.

The attack chain involves the creation of scheduled tasks and services to execute loaders that verify machine-specific hardware IDs (such as drive serial numbers) before activating the backdoor. Once established, the actors deploy a wide range of second-stage tools including PlugX, Impacket for credential harvesting, and specialized network proxies like LurkProxy. This redundant infrastructure allows for persistent access and deep lateral movement within compromised networks.

The campaign's significance lies in its highly tailored nature and technical sophistication, particularly the use of multi-plugin frameworks for task-specific actions like filesystem manipulation, keylogging, and email harvesting. Overlaps in infrastructure with the TrustFall (MystRodX) malware suggest this group may be part of a broader network of Chinese-speaking espionage operations targeting the region.