OctLurk and SilkLurk used in attacks on Central Asian governments
Kaspersky has identified a cyber campaign targeting government organizations mainly in Central Asia since January 2025. Victims are in Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan and the Syrian Arab Republic. A suspected Chinese-speaking actor uses two new backdoors, OctLurk and SilkLurk, with the LurkProxy traffic-routing utility.
Targets span healthcare, research, foreign affairs, law enforcement, logistics, urban planning and public education. The activity is not tied to a known group; its initial access vector remains unknown.
How the in-memory toolset works
OctLurk is injected into memory by a loader. It collects and encrypts system data, sends them to a hard-coded command-and-control server, and loads plugins directly into memory. The plugins enable command and file operations, clipboard access, screenshots and mouse control.
Observed actions included exporting remote logon events, dumping domain-controller hashes with Impacket's secretsdump.py, and running a keylogger disguised as AnyDesk. The actor also stole browser passwords, deployed Pandora RC, and scanned SSH on port 22 and MySQL on port 3306 with Fscan.
LurkProxy acts as either a SOCKS5 reverse proxy or a transparent proxy, in only one mode at a time. It routes network traffic through a target address and contacts a command-and-control server.
SilkLurk and data staging
SilkLurk starts through DLL side-loading, opens a TCP socket to its configured server, and accepts commands or plugins. Attackers used PowerShell and administrative credentials to search network shares for confidential documents, then archived staged data with WinRAR or 7-Zip. Another side-loading chain installed PlugX.
What defenders should take from the campaign
Both backdoors run mainly in memory and leave a minimal loader on disk. OctLurk uses the drive serial number and SilkLurk the computer name to decode payloads, making automated detection and reverse engineering harder. Infrastructure overlapped with SilentRaid, also known as MystRodX and TrustFall, though the timing was unclear. Security teams should check coverage for memory injection, side-loading, credential access and proxy traffic.
OctLurk: practical investigation points for defenders
The campaign combines memory-resident backdoors, credential access, proxy traffic and data staging. Separating the roles of OctLurk, SilkLurk and LurkProxy can help defenders organize an investigation without assuming that any single indicator confirms attribution.
How the three tools differ
OctLurk receives plugins in memory for surveillance, command execution and file operations. SilkLurk uses DLL side-loading and accepts commands or plugins over a TCP connection. LurkProxy provides SOCKS5 reverse-proxy or transparent-proxy functionality for routing traffic through a compromised environment.
- OctLurk supports modular activity while running mainly in memory.
- SilkLurk starts through DLL side-loading and connects to a configured server.
- LurkProxy routes traffic in one proxy mode at a time.
Investigation priorities from the observed activity
Defenders can review available endpoint and network telemetry for the techniques described in the campaign. Relevant areas include memory injection, DLL side-loading, credential access, unusual proxy connections, document collection and archive creation.
- Check for loaders followed by unexpected in-memory execution.
- Review DLL side-loading around unfamiliar or misplaced components.
- Investigate credential dumping and access to remote logon data.
- Look for unexpected SOCKS5, TCP, SSH and MySQL scanning activity.
- Review PowerShell use, network-share searches and archive creation.
Keep attribution and entry-point uncertainty visible
The initial access vector remains unknown, and the activity has not been tied to a known group. Infrastructure overlap with SilentRaid, MystRodX or TrustFall is investigative context rather than proof that the same actor conducted every observed intrusion.
- Treat infrastructure overlap as a lead, not conclusive attribution.
- Keep findings separated by host, timestamp, tool and observed action.
- Distinguish confirmed evidence from assumptions in incident reporting.
Frequently asked questions
What is OctLurk?
OctLurk is a backdoor described in the campaign as being injected into memory by a loader. It collects encrypted system data and can load plugins for commands, file operations, clipboard access, screenshots and mouse control.
How is SilkLurk different from OctLurk?
SilkLurk starts through DLL side-loading, opens a TCP socket to its configured server and accepts commands or plugins. OctLurk uses a loader for memory injection and a plugin-based toolset.
What does LurkProxy do?
LurkProxy routes network traffic as either a SOCKS5 reverse proxy or a transparent proxy. The reporting summarized on this page states that it operates in only one of those modes at a time.
Is the campaign attributed to a known threat group?
No definitive attribution is stated. The activity is linked to a suspected Chinese-speaking actor, while infrastructure overlap with other named activity remains contextual rather than conclusive.