Executive Summary
Analysis of the SilkParasite campaign reveals a long-standing operation targeting government, energy, and telecommunications sectors in Uzbekistan, Tajikistan, Turkmenistan, and Kazakhstan since at least mid-2022. The campaign is linked to suspected China-nexus actors, with infrastructure including a TLS certificate issued by a Chinese state-affiliated authority (TLC) impersonating the Uzbekistan state railway authority.
Technical findings demonstrate a high degree of infrastructure reuse across multiple malware families, including SpiceRAT, NodeEdgeRAT, and NomadRAT. Attackers utilized a cloned version of the RTX Corporation homepage as a default template across 13 distinct C2 servers. The overlap in registration-level data and naming conventions suggests a unified support function or a single operator managing diverse toolsets for espionage across the region.
This intelligence matters due to the persistent targeting of critical infrastructure, including national natural gas fields (Galkynysh) and state ministries. The use of localized spoofing and Chinese-issued certificates highlights a sophisticated procurement and targeting strategy aimed at regional dominance.