OctLurk and SilkLurk Backdoors Target Central Asia and Syria in Espionage Campaign

Jul 30, 2026 · Original article ↗

Summary

Kaspersky researchers detail OctLurk and SilkLurk backdoors used against organizations in Central Asia and Syria since January 2025. Victim-specific loaders, in-memory plugins and related LurkProxy tooling support espionage and persistent access.

Key points

Researchers observed attacks since January 2025 against organizations in Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan and Syria, including government, healthcare and research institutions.
OctLurk loaders use a drive serial number in double-XOR payload decryption; SilkLurk uses a computer-name hash and custom algorithms to decrypt and reflectively load its backdoor.
Attackers deployed OctLurk through scheduled tasks and Windows services, while SilkLurk loaders were side-loaded by legitimate NVIDIA and Realtek executables.
In-memory plugins enable command shells, file operations, screen capture and clipboard access. Observed follow-on activity included domain-controller credential harvesting, keylogging, browser password theft and network scanning.
LurkProxy shares architectural features with OctLurk and supports SOCKS5 or transparent proxy operation through a TLS-encrypted C2 connection.
Researchers observed SilkLurk deploying PlugX and linked the two backdoor families through co-infections, shared staging directories and OctLurk-mediated deployment of a SilkLurk loader.
Kaspersky assesses with medium confidence that a Chinese-speaking actor operates both backdoors, but could not attribute the activity to a known group. Shared C2 infrastructure also overlaps with TrustFall activity.

Article Details

Attack Vectors: Attackers used administrative credentials to create remote scheduled tasks that executed deployment and discovery batch scripts with System privileges.
Windows services loaded OctLurk and LurkProxy DLLs and provided persistence.
SilkLurk deployment used legitimate executables to side-load malicious DLLs, followed by victim-specific payload decryption and reflective in-memory execution.
Backdoors downloaded additional plugins into memory, providing command execution, file access, screen capture, and clipboard access.
Post-compromise activity included domain-controller credential harvesting, browser password theft, keylogging, network scanning, remote-control agent installation, and searches of network shares.
SilkLurk command-shell access was used to execute a dropper that deployed PlugX.
Defensive Notes: OctLurk payload decryption depends on the victim's drive serial number; SilkLurk decryption depends on the computer name, complicating analysis outside the original victim environment.
Both backdoor families operate primarily in memory, leaving limited loader artifacts on disk.
The attackers established redundant remote-access pathways, which could preserve access after the original infection mechanism was neutralized.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`about[.]blsouqs[.]com`	Listed OctLurk C2 domain.
DOMAIN	`api2[.]annoyingremote[.]com`	Listed OctLurk C2 domain.
DOMAIN	`confbase[.]mdpsupport[.]net`	Listed OctLurk C2 domain.
DOMAIN	`ctyuhjerf[.]kozow[.]com`	SilkLurk C2 domain observed in an incident involving subsequent PlugX deployment.
DOMAIN	`digital[.]leroymerling[.]com`	Listed OctLurk C2 domain.
DOMAIN	`dns[.]multitoconference[.]com`	Hard-coded OctLurk C2 address contacted on port 443.
DOMAIN	`dns[.]ssentialserv[.]xyz`	LurkProxy C2 domain whose connectivity attackers checked before deployment.
DOMAIN	`fm01[.]clouddevicemetrics[.]com`	Listed OctLurk C2 domain.
DOMAIN	`gycudore[.]kozow[.]com`	C2 domain configured in the PlugX payload deployed through SilkLurk.
DOMAIN	`rgnojb[.]casacam[.]net`	Listed SilkLurk C2 domain.
DOMAIN	`ssl[.]blsouqs[.]com`	Listed OctLurk C2 domain.
DOMAIN	`tj[.]tajikistandip[.]com`	Listed OctLurk C2 domain.
DOMAIN	`tyhbgtyuj[.]gleeze[.]com`	Listed SilkLurk C2 domain.
DOMAIN	`uyhvfredc[.]accesscam[.]org`	Listed SilkLurk C2 domain.
DOMAIN	`wedfcvbn[.]gleeze[.]com`	Listed SilkLurk C2 domain.
IPV4	`154[.]196[.]162[.]76`	LurkProxy C2 server used for TLS-encrypted proxy communications.
IPV4	`45[.]138[.]157[.]165`	Listed OctLurk C2 IP address.
IPV4	`64[.]7[.]198[.]130`	C2 IP address configured in the deployed PlugX payload.
MD5	`082d49ef9f14e6811d68c7e0e82e5069`	OctLurk loader oleasapi.dll loaded by the NgcCIntSvc service.
MD5	`1415a78b75de7db4ba3d1e61d7db4501`	OctLurk Command Shell plugin.
MD5	`2a571f6cee42a17d873f4c942649813f`	Keylogger disguised as AnyDesk.exe and persisted through a logon-triggered scheduled task.
MD5	`2f18472866f38c1e1c2c5c14b9a6ab56`	SilkLurk loader vulkan-1.dll staged alongside OctLurk loaders.
MD5	`32a5985543433a4f60da2fafd873b927`	Adobe.exe executable version of secretsdump used to harvest domain-controller password hashes.
MD5	`37dc84e4bcad92fa28f1e7778d088283`	Browser Password Decryptor artifact used to extract Chrome and Firefox credentials.
MD5	`3c9a1ba8e0c7475706adc6376e9d7b7c`	kmsonline.exe PlugX dropper executed through SilkLurk command-shell access.
MD5	`7c2f64461bb519c6cbf1fc687675514c`	OctLurk loader mscastrac.dll found in a staging directory also used for SilkLurk.
MD5	`a4d550a3ba0cd073fe3839b99d98a7a8`	OctLurk Interaction Manager plugin supporting screen capture and clipboard access.
MD5	`be4731c09734da2e8eb6814a9c82f266`	SilkLurk loader vulkan-1.dll dropped through an OctLurk command shell.
MD5	`ef59aad625eebda8650aec5820d6ce69`	Malicious RasTls.dll PlugX loader deployed by kmsonline.exe.
MD5	`f4578e869a735cfad691f927bae3e638`	OctLurk loader msbasesysdc.dll found in a staging directory also used for SilkLurk.