Malware News Kaspersky discovers OctLurk and SilkLurk, newly identified tailored backdoors in cyber-espionage campaign in Central Asia.

[Khushal]

Content source

https://securelist.com/octlurk-silklurk-backdoors-central-asia/120840/

Introduction​

We have been tracking two new backdoors, OctLurk and SilkLurk, observed in attacks against government organizations primarily in Central Asia since January 2025. Identified victims are located in Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and the Syrian Arab Republic. These organizations operate across several sectors, including healthcare, research, government offices, ministries of foreign affairs, logistics, law‑enforcement agencies, urban planning and facilities management, and public educational establishments.

The backdoor loaders are customized for each victim and use information from the victim’s machine to decrypt the payload. Both the loaders and the backdoors are heavily obfuscated, making analysis more complicated. OctLurk and SilkLurk can download and inject additional plugins to perform further malicious actions, including launching command shells, performing file system activity, synthesizing keyboard and mouse events, network scanning, credential dumping, keylogging, password theft from browsers, email collection, and remote access. Furthermore, the attackers deployed a specialized utility we named LurkProxy, which we also cover in this report. While it has a highly similar architecture to the OctLurk backdoor, it is not a backdoor itself.

Our investigation shows that the same threat actor operates both SilkLurk and OctLurk , and some victims infected with SilkLurk also contain OctLurk. We assess with medium confidence that the same actor is behind both backdoors, and that they are Chinese‑speaking. However, at the time of publication, we couldn’t attribute this activity to any known group.

OctLurk and SilkLurk: new Backdoors in Central Asia

Our experts discovered OctLurk and SilkLurk, backdoors operating primarily in memory, targeting Central Asia. They inject plugins to launch shells, scan networks, dump credentials, and keylogging.

securelist.com

The emergence of the OctLurk and SilkLurk multi‑plugin malware framework highlights how threat actors continuously refine their tactics to evade detection and maintain control over compromised networks. Both families operate primarily in memory, leaving only a minimalistic loader on disk that relies on machine‑specific data (OctLurk uses the drive serial number, and SilkLurk uses the computer name) to decode payload locations and contents. This victim‑specific encoding makes reverse engineering and automated detection considerably harder.

In addition to sophisticated obfuscation, the attackers establish redundant access channels, harvest credentials, and deploy well‑known remote access and monitoring tools. These secondary pathways ensure persistence even if the original infection vector is discovered or neutralized.

 

[Bot]

Key defensive implications

This report describes a flexible, victim-specific malware framework rather than a single conventional backdoor. The most important points for defenders are:

• The loaders use host-specific data, such as a drive serial number or computer name, to decode payload information. This can reduce the usefulness of samples collected from another system and complicate automated analysis.
• The backdoors primarily operate in memory, so file-based antivirus detection alone may not be sufficient. Endpoint telemetry, script-blocking, memory scanning, and behavior monitoring are particularly important.
• The plugin architecture allows the attackers to add capabilities after initial compromise, including credential theft, keylogging, browser-password theft, network discovery, and remote access.
• LurkProxy appears to provide an additional access or proxy capability, increasing the risk that removing one component may not fully remove the attacker’s access.
• Deployment of legitimate remote-access and monitoring tools creates a potential “living off the land” problem. Organizations should maintain an approved-software inventory and investigate unexpected tools, unusual parent-child process relationships, and unauthorized remote sessions.

The medium-confidence assessment regarding a Chinese-speaking actor should not be treated as attribution to a specific known group. Language clues and tooling similarities can be useful, but they are not conclusive on their own.

Organizations in the affected regions and sectors should prioritize endpoint telemetry, review persistence mechanisms, inspect unusual in-memory or reflective-loading behavior, rotate credentials after suspected compromise, and investigate outbound connections from administrative systems. Any suspected samples should be preserved and submitted to reputable antivirus vendors or VirusTotal, while avoiding execution on production systems.

The report’s central defensive lesson is that removing the visible loader may not be enough; responders should also search for injected processes, plugins, secondary remote-access tools, stolen credentials, and other persistence mechanisms.