OctLurk and SilkLurk Target Government Organizations Across Central Asia and Syria
Summary
Kaspersky reports a campaign targeting government-related organizations across Central Asia and Syria since January 2025. A Chinese-speaking actor is suspected but not linked to a known group; the activity uses OctLurk, SilkLurk, and LurkProxy.
Key points
- Kaspersky reports targeting of government and public-sector organizations since January 2025; the suspected Chinese-speaking actor has not been linked to a known group.
- OctLurk is deployed through a loader, runs primarily in memory, and collects system information before loading plugins. The initial access method is unknown.
- OctLurk plugins support command execution, credential theft, keylogging, browser password theft, network scanning, email access, and remote control.
- LurkProxy routes traffic as either a SOCKS5 or transparent proxy. The article identifies dns[.]ssentialserv[.]xyz and dns[.]multitoconference[.]com, as well as C2 IP 154.196.162[.]76.
- SilkLurk is launched through DLL side-loading, communicates with a configured C2 server, and can receive and inject plugins into memory.
- Reported SilkLurk activity includes staging confidential documents from network shares, archiving them, and launching PlugX through another DLL side-loading chain.
- Kaspersky found infrastructure overlap with SilentRaid, MystRodX, and TrustFall, but says the timing and relationship between the campaigns remain unclear.
Article Details
- Attack Vectors
- The initial access vector is unknown.
- OctLurk is deployed by a loader and operates primarily in memory; its plugins can be downloaded from a server and loaded into memory.
- SilkLurk is launched through a DLL side-loading sequence and can receive and inject additional plugins.
- Post-compromise activity includes credential theft, keylogging, network scanning, remote access, email collection or manipulation, and staging and archiving confidential documents.
- Defensive Notes
- The article reports that machine-specific encoding of payload locations and contents makes reverse engineering and automated detection more difficult.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | dns[.]multitoconference[.]com | Hard-coded OctLurk command-and-control server receiving encrypted system information. |
| IPV4 | 154[.]196[.]162[.]76 | Remote server contacted by LurkProxy for command and control. |
MITRE ATT&CK
T1003 · OS Credential DumpingThe attackers use Impacket's secretsdump.py to harvest password hashes from domain controllers.T1027 · Obfuscated Files or InformationThe article describes OctLurk and SilkLurk as obfuscated backdoors and reports machine-specific encoding of payload locations and contents.T1046 · Network Service DiscoveryFscan is used to scan internal and public networks for services on ports such as SSH 22 and MySQL 3306.T1056.001 · KeyloggingThe attackers drop and execute a keylogger that masquerades as AnyDesk.T1059.001 · PowerShellPowerShell commands are used to connect to shared network resources, search and stage documents, and disconnect from shares.T1059.003 · Windows Command ShellThe attackers use cmd.exe to run commands, including launching PowerShell and initiating a DLL side-loading chain.T1082 · System Information DiscoveryOctLurk collects system information, and SilkLurk collects victim information.T1090 · ProxyLurkProxy routes network traffic through a target address as either a SOCKS5 proxy or a transparent proxy.T1105 · Ingress Tool TransferOctLurk and SilkLurk receive additional plugins from their servers.T1113 · Screen CaptureOctLurk plugins can capture screenshots.T1114 · Email CollectionThe attackers connect to an email server and issue commands to collect or manipulate emails.T1115 · Clipboard DataOctLurk plugins can gather and modify clipboard content.T1555.003 · Credentials from Web BrowsersThe attackers decrypt and extract passwords stored by Google Chrome and Mozilla Firefox.T1560.001 · Archive via UtilityThe attackers use WinRAR and 7-Zip to archive staged confidential documents.T1574.002 · DLL Side-LoadingSilkLurk is launched through a DLL side-loading sequence; the attackers also use a DLL side-loading chain to drop PlugX.
People
Malware
MystRodXThe malware operates largely in memory, supports extensive post-compromise activity, and shows infrastructure overlap with the SilentRaid, MystRodX, and TrustFall campaigns.OctLurkgovernment-related organizations across Central Asia and the Syrian Arab Republic using the backdoors OctLurk and SilkLurk, alongside the proxying tool LurkProxy.PlugXRun “cmd.exe” to initiate a DLL side-loading chain to drop PlugX, a known backdoor used by Chinese hacking groups.SilentRaidThe malware operates largely in memory, supports extensive post-compromise activity, and shows infrastructure overlap with the SilentRaid, MystRodX, and TrustFall campaigns.SilkLurkorganizations across Central Asia and the Syrian Arab Republic using the backdoors OctLurk and SilkLurk, alongside the proxying tool LurkProxy.TrustFallThe malware operates largely in memory, supports extensive post-compromise activity, and shows infrastructure overlap with the SilentRaid, MystRodX, and TrustFall campaigns.
Products
Tools
7-Zipdocuments, disconnect from the network shares, and use legitimate archiving tools like WinRAR and 7-Zip to archive the stolen data.fscanScan internal and public networks using Fscan to identify services running on specific ports, such as Secure Shell (SSH) on portâ¯22 and MySQL on portâ¯3306, and then attempt to access these services using credentialsImpacketHarvest password hashes from domain controllers using Impacket’s “secretsdump.py” tool.LurkProxyAsia and the Syrian Arab Republic using the backdoors OctLurk and SilkLurk, alongside the proxying tool LurkProxy.Pandora RCEstablish remote access to the victim machine using Pandora RC agent.secretsdumpHarvest password hashes from domain controllers using Impacket’s “secretsdump.py” tool.WinRARstage confidential documents, disconnect from the network shares, and use legitimate archiving tools like WinRAR and 7-Zip to archive the stolen data.
Countries
Afghanistanwave of cyber attacks targeting government organizations mainly located in Central Asia, including Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and the Syrian Arab Republic, since Januaryâ¯2025.Kazakhstanmainly located in Central Asia, including Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and the Syrian Arab Republic, since Januaryâ¯2025.Kyrgyzstancyber attacks targeting government organizations mainly located in Central Asia, including Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and the Syrian Arab Republic, since Januaryâ¯2025.Syrian Arab Republichas launched a new campaign against government-related organizations across Central Asia and the Syrian Arab Republic using the backdoors OctLurk and SilkLurk, alongside the proxying tool LurkProxy.Tajikistantargeting government organizations mainly located in Central Asia, including Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and the Syrian Arab Republic, since Januaryâ¯2025.Uzbekistangovernment organizations mainly located in Central Asia, including Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and the Syrian Arab Republic, since Januaryâ¯2025.
Industries
Foreign affairsoperate across several sectors, such as healthcare, research, government offices, ministries of foreign affairs, logistics, law-enforcement agencies, urban planning and facilities management, and publicGovernmentA suspected Chinese-speaking threat actor has launched a new campaign against government-related organizations across Central Asia and the Syrian Arab Republic using the backdoors OctLurk and SilkLurk, alongside theHealthcareThese targeted organizations operate across several sectors, such as healthcare, research, government offices, ministries of foreign affairs, logistics, law-enforcement agencies, urban planning and facilitieslogisticsseveral sectors, such as healthcare, research, government offices, ministries of foreign affairs, logistics, law-enforcement agencies, urban planning and facilities management, and public educationalResearchThese targeted organizations operate across several sectors, such as healthcare, research, government offices, ministries of foreign affairs, logistics, law-enforcement agencies, urban planning and facilitiesUrban planning and facilities managementgovernment offices, ministries of foreign affairs, logistics, law-enforcement agencies, urban planning and facilities management, and public educational establishments, per Kaspersky.