cyber.hendryadrian.com
Threat Research · therecord.media

Bitdefender Links SilkParasite Campaign to China, Finds AI-Assisted Malware

· Original article ↗

Summary

Bitdefender reports that SilkParasite targeted government bodies across Central Asia for nearly a year, using seven malware families. Its investigation found spearphishing delivery, DriveSilkRAT’s Google Drive command channel, and evidence of AI-assisted development.

Key points

  • Bitdefender investigated a suspicious infection at an unnamed Central Asian government institution and tracked the operation for nearly a year.
  • The campaign used seven malware families; five were previously undocumented.
  • Spearphishing emails delivered malicious Microsoft Office documents inside archives, with lures tailored to government agencies.
  • DriveSilkRAT used a shared Google Drive folder for command traffic rather than a dedicated command-and-control server.
  • Bitdefender counted 65 infections involving DriveSilkRAT, most in Asia.
  • The researchers found two AI-generated email lures and code artifacts they interpreted as evidence of AI-assisted malware development.
  • Bitdefender linked the campaign to China based on a malware connection to another China-based espionage group and campaign IP addresses associated with Chinese telecommunications companies.

Article Details

Attack Vectors
  • Spearphishing emails delivered malicious Microsoft Office documents packaged in archives to bypass email-gateway scanning.
  • DriveSilkRAT used a shared Google Drive folder for command traffic, blending it with ordinary Google Drive activity.

MITRE ATT&CK

T1102 · Web ServiceDriveSilkRAT used a shared Google Drive folder for command traffic instead of a dedicated command-and-control server.T1566.001 · Spearphishing AttachmentSilkParasite operators used spearphishing emails to deliver malicious Microsoft Office documents in archives.

Malware

DriveSilkRATBitdefender uncovered SilkParasite, a China-linked espionage campaign targeting government bodies across Central Asia with seven malware families, including the newly observed DriveSilkRAT.

Products

Google DriveThe operation used spearphishing documents, Google Drive-based command traffic, and signs of AI-assisted malware development to hide its activity across the region.Microsoft OfficeAttackers used spearphishing emails with malicious Microsoft Office documents in archives.

Countries

ChinaBitdefender uncovered SilkParasite, a China-linked espionage campaign targeting government bodies across Central Asia with seven malware families, including the newly observed DriveSilkRAT.Georgia#SilkParasiteKazakhstan#SilkParasiteKyrgyzstan#SilkParasiteTajikistan#SilkParasiteTurkmenistan#SilkParasiteUzbekistan#SilkParasite

Industries

GovernmentBitdefender uncovered SilkParasite, a China-linked espionage campaign targeting government bodies across Central Asia with seven malware families, including the newly observed DriveSilkRAT.

Related Articles