A Chinese-speaking threat actor has launched a fresh wave of cyber attacks targeting government organizations across Central Asia since January 2025, according to a report published this week by Kaspersky. The offensive hit victims in Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and the Syrian Arab Republic, affecting agencies spanning healthcare, research, government offices, foreign affairs ministries, logistics, law enforcement, urban planning, facilities management, and public education. The activity hasn't been tied to any known hacking group.

The attacks relied on two previously unknown obfuscated backdoors that Kaspersky calls OctLurk and SilkLurk, plus a specialized tool named LurkProxy designed to relay network traffic. Both backdoors can download and inject plugins that enable command shells, file system operations, simulated keyboard and mouse actions, network scanning, credential theft, keylogging, browser password extraction, email harvesting, and remote access, researchers Saurabh Sharma and Yaroslav Kikel wrote. The initial entry point remains unclear, but OctLurk is injected into memory via a loader, with attackers first testing internet connectivity to a specific domain before running a batch script that launches LurkProxy. Once active, OctLurk gathers system information, encrypts it, and transmits it to a hard-coded command-and-control server over a stream socket. The tool loads plugins directly into memory to execute commands, manage files, capture and alter clipboard data, take screenshots, and control mouse movements. Hackers used the backdoor's command shell plugin to fingerprint infected machines and pull extensive system data, run commands to export successful remote logon events and query them for specific users, steal password hashes from domain controllers using Impacket's secretsdump.py tool, deploy a keylogger disguised as AnyDesk to avoid detection, decrypt and lift passwords from Chrome and Firefox, establish remote access via Pandora RC agent, scan internal and public networks with Fscan to find services on specific ports like SSH on port 22 and MySQL on port 3306 and attempt access using credentials from a password file, and connect to email servers to collect or manipulate messages.

"Both families operate primarily in memory, leaving only a minimalistic loader on disk that relies on machine-specific data (OctLurk uses the drive serial number, and SilkLurk uses the computer name) to decode payload locations and contents," the report states. This victim-specific encoding makes reverse engineering and automated detection considerably harder, the researchers added. SilkLurk is launched through a DLL executed via a DLL side-loading sequence, then creates a TCP socket and connects to a command-and-control server specified in its configuration before collecting victim details and sending them to the server. The server responds with commands that can retrieve the system's local time, set a sleep interval determining how often the backdoor checks in with the server, send or update backdoor settings, and receive and inject additional plugins into memory. Post-compromise actions tied to SilkLurk included using cmd.exe to launch PowerShell and run commands that connect to shared network resources with admin credentials, search and stage confidential documents, disconnect from network shares, and use WinRAR and 7-Zip to archive stolen data, plus running cmd.exe to start a DLL side-loading chain that drops PlugX, a known backdoor used by Chinese hacking groups.

Kaspersky found infrastructure overlaps between this campaign and earlier attacks involving a C++-based implant called SilentRaid, also known as MystRodX and TrustFall. The overlap points to shared infrastructure across campaigns targeting multiple operating systems, though it's unclear whether these activities ran at the same time or during different periods. The emergence of the OctLurk and SilkLurk multi-plugin frameworks highlights how threat actors continuously refine their tactics to evade detection and maintain control over compromised networks, the researchers concluded.