Chinese APT Deploys OctLurk and SilkLurk in Central Asia

Kaspersky researchers Saurabh Sharma and Yaroslav Kikel have detailed a previously undocumented espionage campaign operating across Central Asia since at least January 2025, built around two new malware families: OctLurk and SilkLurk. The targets span six countries—Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and Syria—and a sector list that covers the full breadth of how states function: government offices, foreign affairs ministries, healthcare, law enforcement, research institutions, logistics, urban planning, and public education.

That’s not financial crime. It’s a picture of systematic intelligence collection.

Two Backdoors, One Toolkit

OctLurk arrives through in-memory injection; SilkLurk via DLL side-loading. Both communicate with attacker infrastructure over TCP, accept plugins dynamically to extend their capabilities, and maintain a minimal disk presence designed to frustrate forensic recovery. The full capability set maps cleanly to a long-running intelligence operation: credential dumping through Impacket’s secretsdump.py, keylogging, browser password extraction across Chrome and Firefox, network scanning with Fscan, and systematic SSH and MySQL service probing to map target environments.

A third tool, LurkProxy, operates as a SOCKS5 or transparent proxy, routing C2 traffic through the victim’s own network infrastructure—a technique that raises the cost of detection by blending attacker traffic with legitimate network activity.

The wrinkle that makes both backdoors harder to detect at scale is victim-specific encoding. OctLurk keys its payload to the target machine’s drive serial number; SilkLurk uses the computer name. Signature-based detection that might catch a shared binary across deployments gets far less purchase here—each deployment looks different.

The Attribution Picture

Kaspersky identified infrastructure overlaps between this campaign and prior activity tracked under the SilentRaid name—also known as MystRodX and TrustFall—which used C++ implants in earlier operations targeting some of the same regions. The campaign also includes deployment of PlugX, a backdoor with extensive documented use across multiple China-linked intrusion sets going back well over a decade.

“Suspected” is the appropriate word, and Kaspersky uses it. Attribution in the Chinese APT ecosystem is complicated by shared tooling, infrastructure reuse across different operators, and the persistent possibility of deliberate misdirection. But the combination of PlugX, the SilentRaid infrastructure overlap, and the regional focus makes a China-nexus a reasonable working hypothesis. A similar pattern emerged last month from Iranian APT Nimbus Manticore’s NightLedger operations in MENA—different actor, same logic of persistent modular backdoors against government and research targets.

The Geography as Signal

Central Asia doesn’t get the same coverage in Western threat reporting that Europe or North America does, but the region has been a consistent target for state-sponsored intelligence collection for years. The six countries named—and Syria as the geographic outlier—sit at the intersection of China’s Belt and Road Initiative, contested Russian influence, and active internal instability that makes foreign affairs and government data strategically valuable.

Afghanistan post-2021 is worth specific note. The continued presence of international humanitarian and research operations there, alongside the new Afghan government’s uncertain alignment, makes it an unusually intelligence-rich environment. Foreign affairs ministries and law enforcement agencies are the institutions most likely to hold information that matters to a long-horizon state actor.

This campaign is one of several Chinese threat actor disclosures in recent weeks. Separately, Unit 42 documented a Chinese actor using DeepSeek AI to autonomously attack internet-facing infrastructure after a single Telegram command—a related but distinct vector, and a sign of both the breadth and the variety of Chinese cyber operations activity currently being reported.

What Defenders Can Act On

Kaspersky’s most immediately actionable indicators: the C2 domain dns.ssentialserv[.]xyz and IP address 154.196.162[.]76. Block both and hunt for outbound SOCKS5 proxy traffic from devices that have no legitimate reason to act as network proxies.

The attacker’s use of legitimate administrative tooling—Impacket, Fscan, WinRAR, 7-Zip, and AnyDesk (used as keylogger cover)—means signature detection carries limited weight here. Behavioral detection tuned for these tools appearing in unusual execution contexts is the higher-value investment, particularly in healthcare, government ministry, or foreign affairs environments in the targeted regions.

Kaspersky’s full technical writeup includes YARA rules and a complete indicator list; the Hacker News report links to it directly.