SilkParasite Campaign Targets Central Asian Governments With Five Newly Documented RATs
Summary
Bitdefender describes SilkParasite, an espionage campaign targeting Central Asian governments with seven RAT families, five newly documented. The report details spear-phishing, DLL sideloading, modular implants and evidence suggesting a China-nexus cluster.
Key points
- The campaign targeted government entities in Central Asia; Bitdefender assesses its China-nexus attribution with medium confidence.
- The toolkit includes seven RAT families, five newly documented: DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT and NodeEdgeRAT.
- Attack chains used regionally tailored spear-phishing emails with password-protected RAR archives containing malicious Office documents that triggered macro-based DLL sideloading.
- The RATs use modular, plugin-based designs and varied command-and-control methods; DriveSilkRAT, for example, uses Google Drive to retrieve tasks and return results.
- Bitdefender observed roughly 65 DriveSilkRAT infections, most in Asia. The malware checks for Kaspersky antivirus before execution.
- The report cites BLOODALCHEMY and an updated SpiceRAT as clues to China-nexus links, while describing possible AI assistance as an assessment rather than a confirmed development method.
- Bitdefender recommends detecting the behavior of a signed application loading a nearby library from an unusual location, and monitoring unusual relationships between processes and network services.
Article Details
- Attack Vectors
- Spear-phishing emails likely delivered password-protected RAR archives containing malicious Microsoft Office documents; the archive password was supplied in the email body.
- Opening a document launched a macro that triggered DLL sideloading to drop the first-stage payload. The attackers placed a rogue DLL beside a legitimately signed program and ran it from an unusual location.
- DriveSilkRAT used Google Drive to poll for tasking and upload execution results; CookiETagRAT used HTTP Cookie and ETag response headers for C2.
- The RATs used modular plugins for capabilities including command execution, system and network enumeration, file management, and file transfer.
- Defensive Notes
- Bitdefender identified the pairing of a legitimately signed application loading a library placed beside it while running from an unusual location as a reliable DLL-sideloading detection signal.
- Use behavioral baselines to flag unusual relationships between processes and network services; the article notes that volume-based detection is poorly suited to low-footprint implants communicating through legitimate cloud services.
- The article reports that the macro checked whether Kaspersky antivirus software was installed and running before execution, indicating an attempt to bypass detection.
MITRE ATT&CK
T1016 · System Network Configuration DiscoveryDriveSilkRAT supports network enumeration.T1041 · Exfiltration Over C2 ChannelDriveSilkRAT uploaded the results of plugin execution to its Google Drive C2 folder.T1057 · Process DiscoveryDriveSilkRAT supports a plugin for listing processes.T1059 · Command and Scripting InterpreterThe RATs support command execution, including SpiceRAT's execution of arbitrary commands and NodeEdgeRAT's command-execution capability.T1071.001 · Web ProtocolsCookiETagRAT used HTTP Cookie and ETag response headers to receive and execute commands.T1082 · System Information DiscoveryDriveSilkRAT supports system enumeration, and BLOODALCHEMY can gather host information.T1102.002 · Bidirectional CommunicationDriveSilkRAT polled a specific Google Drive folder for tasking and uploaded execution results to the same folder.T1105 · Ingress Tool TransferThe article says SpiceRAT can download and run executable binaries.T1204.002 · Malicious FileOpening a malicious Office document launched a macro and triggered the DLL-sideloading sequence.T1566.001 · Spearphishing AttachmentThe campaign likely delivered password-protected RAR archives containing malicious Office documents through spear-phishing emails.T1574.002 · DLL Side-LoadingThe attackers placed a rogue DLL beside a legitimately signed program so that the program would load and run the malicious code.
Threat Actors
SilkParasiteBitdefender assessed SilkParasite as a China-nexus threat cluster with medium confidence and reported that it targeted government bodies in Central Asia.SneakyChefThe article says SpiceRAT is attributed to the Chinese-speaking threat actor SneakyChef; it does not state that SneakyChef operated the SilkParasite campaign.
Malware
BloodAlchemy#SilkParasiteCookiETagRAT#SilkParasiteDeed RATOne notable aspect that ties the operation to China is the use of a backdoor dubbed BLOODALCHEMY, which is an updated version of Deed RAT, itself a successor to ShadowPad.DriveSilkRAT#SilkParasiteGoginRAT#SilkParasiteNodeEdgeRAT#SilkParasiteNomadRAT#SilkParasitePlugX#SilkParasiteShadowPad#SilkParasiteSpiceRAT#SilkParasite
Products
Google DriveDriveSilkRAT (.NET/C++), which uses Google Drive as command-and-control (C2) to poll a specific folder for tasking, run it through an in-memory .NET plugin system, and upload the results of the execution back to theKasperskyPerhaps more significantly, the macro checks if Kaspersky’s antivirus software is installed and running on the machine before execution.Microsoft OfficeAttack chains begin with password-protected RAR archives bearing malicious Microsoft Office documents that are likely delivered via spear-phishing emails.
Countries
ChinaThe operation appears China-nexus and uses regional spear-phishing, DLL sideloading, and cloud-based C2 to stay stealthy and adapt quickly.Kazakhstanentities in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, and Kazakhstan, several impersonating specific ministries.Kyrgyzstanentities in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, and Kazakhstan, several impersonating specific ministries.Tajikistanentities in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, and Kazakhstan, several impersonating specific ministries.Turkmenistanentities in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, and Kazakhstan, several impersonating specific ministries.Uzbekistanentities in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, and Kazakhstan, several impersonating specific ministries.