SilkParasite Espionage Targets Central Asian Governments

Bitdefender researchers have identified a new China-nexus threat cluster dubbed SilkParasite targeting government organizations in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, Kazakhstan, and Georgia. The operation, active since at least late 2025, is characterized by its high degree of professional engineering and evidence of AI-assisted development, specifically in the creation of phishing lures and architectural design for its modular implants.

The SilkParasite arsenal includes seven Remote Access Tools (RATs), five of which are new: DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, and NodeEdgeRAT. The campaign extensively leverages DLL sideloading of legitimate binaries (e.g., Windows Defender, Calibre, Mp3tag) to drop modular payloads. Notably, the DriveSilkRAT family utilizes Google Drive for command-and-control (C2), blending malicious traffic with legitimate cloud service usage to evade detection.

This campaign reflects a broader geopolitical trend of increased Chinese intelligence focus on Central Asia. The modularity of the toolsets and the sharing of malware lineages like BloodAlchemy (related to Deed RAT and ShadowPad) across threat clusters like FamousSparrow and SneakyChef highlight the collaborative nature of the China-nexus ecosystem, posing a significant risk to government and economic sectors in the region.