OctLurk and SilkLurk used in attacks on Central Asian governments

Kaspersky has identified a cyber campaign targeting government organizations mainly in Central Asia since January 2025. Victims are in Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan and the Syrian Arab Republic. A suspected Chinese-speaking actor uses two new backdoors, OctLurk and SilkLurk, with the LurkProxy traffic-routing utility.

Targets span healthcare, research, foreign affairs, law enforcement, logistics, urban planning and public education. The activity is not tied to a known group; its initial access vector remains unknown.

How the in-memory toolset works

OctLurk is injected into memory by a loader. It collects and encrypts system data, sends them to a hard-coded command-and-control server, and loads plugins directly into memory. The plugins enable command and file operations, clipboard access, screenshots and mouse control.

Observed actions included exporting remote logon events, dumping domain-controller hashes with Impacket's secretsdump.py, and running a keylogger disguised as AnyDesk. The actor also stole browser passwords, deployed Pandora RC, and scanned SSH on port 22 and MySQL on port 3306 with Fscan.

LurkProxy acts as either a SOCKS5 reverse proxy or a transparent proxy, in only one mode at a time. It routes network traffic through a target address and contacts a command-and-control server.

SilkLurk and data staging

SilkLurk starts through DLL side-loading, opens a TCP socket to its configured server, and accepts commands or plugins. Attackers used PowerShell and administrative credentials to search network shares for confidential documents, then archived staged data with WinRAR or 7-Zip. Another side-loading chain installed PlugX.

What defenders should take from the campaign

Both backdoors run mainly in memory and leave a minimal loader on disk. OctLurk uses the drive serial number and SilkLurk the computer name to decode payloads, making automated detection and reverse engineering harder. Infrastructure overlapped with SilentRaid, also known as MystRodX and TrustFall, though the timing was unclear. Security teams should check coverage for memory injection, side-loading, credential access and proxy traffic.