SilkParasite: China-Nexus Espionage Campaign in Central Asia

Bitdefender Labs has identified a sustained cyber-espionage campaign, designated SilkParasite, targeting government entities in Central Asia, including Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, and Kazakhstan. Active since at least late 2025, the threat actor demonstrates high operational discipline, utilizing a diverse toolset of seven distinct malware families (DriveSilkRAT, SpiceRAT, CookiETagRAT, BloodAlchemy, NomadRAT, GoginRAT, and NodeEdgeRAT). The campaign is assessed with medium confidence to be a China-nexus activity cluster, with technical overlaps to known groups such as SneakyChef and the ShadowPad/Deed RAT ecosystem.

The intrusion lifecycle typically begins with regionally tailored spear-phishing lures, some suspected to be AI-generated, which deploy malicious DLL sideloading chains through legitimate signed binaries (e.g., Calibre, WinRAR, Quick Heal). A primary characteristic of this threat is its heavy reliance on modular, plugin-based architectures and the use of trusted cloud services like Google Drive for command-and-control (C2), which effectively blinds traditional network reputation monitoring. Technical artifacts, including sequential placeholder keys and leftover testing functions, suggest the adversary may be utilizing AI-assisted development workflows to accelerate tool iteration.

SilkParasite represents a significant regional threat focused on economic decision-making bodies. The actor’s ability to rotate infrastructure, encryption materials, and persistence mechanisms highlights a mature development pipeline. Organizations in the affected sectors should prioritize detections for unusual DLL loads from non-standard directories and anomalous outbound traffic to cloud storage services.