Silk Parasite Espionage Campaign Targets Central Asian Governments with Five New RATs
Summary: Bitdefender Labs documented a previously unreported espionage operation, SilkParasite, first discovered in late 2025 and assessed with medium confidence to be a China-nexus cluster targeting government bodies in Central Asia. The campaign uses seven RAT families - DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, and NodeEdgeRAT among the five never previously documented - delivered through password-protected RAR archives with malicious Office documents that trigger DLL sideloading, with lures tailored to Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, Kazakhstan, and Georgia.
What's compelling: The macro checks whether Kaspersky antivirus is installed before executing, and the implants span .NET, C++, Go, and JavaScript with plugin architectures built to keep the detection footprint small - so signature-based defenses keyed to any single artifact are poorly positioned against this actor.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026