Suspected Chinese-Speaking Hackers Target Central Asian Governments With Oct Lurk and Silk Lurk
Summary: Kaspersky attributes a campaign since January 2025 against government and other organizations mainly in Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and Syria to a suspected Chinese-speaking threat actor, using two new obfuscated backdoors tracked as OctLurk and SilkLurk plus a proxy utility codenamed LurkProxy. The backdoors load plugins from command-and-control servers to run command shells, dump credentials, log keystrokes, steal browser passwords and email, and enable remote access, with the initial access vector still unknown.
What you should know: Both backdoors run primarily in memory, leaving only a minimal loader on disk that decodes payloads using machine-specific data - the drive serial number for OctLurk and the computer name for SilkLurk - which Kaspersky says makes reverse engineering and automated detection considerably harder.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026