A previously unidentified Chinese-speaking threat actor is believed to be behind an ongoing cyber espionage campaign targeting government organizations across Central Asia and parts of the Middle East since January 2025.
The campaign has primarily targeted organizations in Afghanistan, Kazakhstan, Kyrgyzstan, Tajikistan, Uzbekistan, and the Syrian Arab Republic. Victims span a wide range of sectors, including healthcare, research, government agencies, ministries of foreign affairs, law enforcement, logistics, urban planning, facilities management, and public education.
Researchers have not linked the activity to any previously known threat group.
New Malware Framework Identified
The campaign relies on two newly identified backdoors, OctLurk and SilkLurk, along with a custom network proxy utility named LurkProxy.
Both malware families use a modular architecture that allows attackers to download and inject additional plugins directly into memory, enabling a wide range of post-compromise capabilities.
The malware can:
- Execute remote command shells
- Perform file system operations
- Simulate keyboard and mouse activity
- Scan internal networks
- Dump credentials
- Capture keystrokes
- Steal browser passwords
- Collect emails
- Maintain persistent remote access
Initial Access Still Unknown
The exact method used to compromise victim organizations remains under investigation.
Analysis indicates that OctLurk is injected directly into memory by a lightweight loader. Before activating, the malware checks internet connectivity using the domain:
dns.ssentialserv[.]xyz
If connectivity is confirmed, a batch script launches LurkProxy, which then connects to its command-and-control (C2) server at:
154.196.162[.]76
How OctLurk Works
After execution, OctLurk gathers system information, encrypts the collected data, and transmits it to a hard-coded C2 server:
dns.multitoconference[.]com
The backdoor can receive additional plugins from the server and load them directly into memory, allowing attackers to execute commands without leaving significant traces on disk.
Its capabilities include:
- Remote command execution
- File management
- Clipboard monitoring and modification
- Screenshot capture
- Mouse control
Extensive Post-Compromise Operations
Investigators observed attackers using OctLurk’s command shell plugin to perform extensive reconnaissance and credential theft across compromised environments.
Activities included:
- Fingerprinting compromised systems
- Exporting successful remote interactive logon events
- Searching authentication logs for specific user accounts
- Dumping Active Directory password hashes using Impacket’s secretsdump.py
- Installing a keylogger disguised as AnyDesk
- Extracting saved passwords from Google Chrome and Mozilla Firefox
- Deploying the Pandora RC remote administration tool
- Scanning internal and external networks with Fscan
- Attempting SSH and MySQL logins using credentials stored in a file named pp.txt
- Connecting to email servers to collect or manipulate messages
LurkProxy Conceals Attacker Traffic
The campaign also employs LurkProxy, a specialized proxy tool designed to relay attacker communications through compromised systems.
The utility supports two operating modes:
- SOCKS5 proxy
- Transparent proxy
Only one mode is active at a time, allowing attackers to route network traffic while concealing the true origin of their communications.
SilkLurk Delivered Through DLL Side-Loading
A second backdoor, SilkLurk, is delivered using a DLL side-loading technique.
Once executed, SilkLurk establishes a TCP connection with its configured command-and-control server before collecting victim information and transmitting it back to the attackers.
The malware can then receive commands to:
- Retrieve local system time
- Adjust polling intervals
- Update malware configuration
- Download additional plugins
- Inject code directly into memory
Data Theft and PlugX Deployment
Following successful compromise, attackers use SilkLurk to steal sensitive information from victim networks.
Observed activity includes:
- Launching PowerShell through cmd.exe
- Accessing shared network resources using administrative credentials
- Searching for confidential documents
- Compressing stolen files with WinRAR and 7-Zip
- Disconnecting from network shares after data collection
Researchers also observed attackers initiating another DLL side-loading sequence to deploy PlugX, a well-known backdoor frequently associated with Chinese cyber espionage operations.
Infrastructure Linked to Earlier Campaigns
The campaign shares infrastructure with an earlier operation involving the C++-based implant SilentRaid, also known as MystRodX or TrustFall.
While the infrastructure overlap suggests a possible operational relationship, it remains unclear whether the campaigns were conducted simultaneously or by the same threat actors.
Memory-Resident Malware Designed for Stealth
Both OctLurk and SilkLurk are engineered to minimize their footprint on infected systems.
Instead of storing the complete malware on disk, only a minimal loader is written to the endpoint. The actual payload is decoded using machine-specific identifiers, making analysis and detection significantly more difficult.
- OctLurk derives its decoding key from the victim’s drive serial number.
- SilkLurk uses the infected computer’s name.
This victim-specific encoding helps evade automated analysis, complicates reverse engineering, and enhances the malware’s ability to remain undetected during long-term espionage operations.
Conclusion
The emergence of OctLurk, SilkLurk, and LurkProxy highlights the growing sophistication of modern cyber espionage campaigns. Their modular design, memory-only execution, and advanced evasion techniques enable attackers to maintain long-term access while stealing credentials, sensitive documents, and other valuable intelligence.
Although the campaign has been attributed to a Chinese-speaking threat actor, it has not yet been linked to any publicly known hacking group. The findings underscore the need for organizations—particularly government agencies—to strengthen endpoint monitoring, restrict DLL side-loading opportunities, and closely monitor network activity for signs of stealthy, memory-resident malware.
