A previously undocumented cyber espionage operation, dubbed SilkParasite, has been observed targeting government organizations across Central Asia.
The threat cluster, first identified in late 2025, is assessed with medium confidence to have links to a China-nexus threat actor. Its operations involve a diverse arsenal of remote access trojans (RATs), including five malware families that had not been previously documented: DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, and NodeEdgeRAT.
Researchers say the campaign stands out for its use of sophisticated espionage tools alongside apparent signs of AI-assisted malware development.
SilkParasite Targets Central Asian Government Organizations
The campaign has primarily targeted government entities in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, and Kazakhstan. One additional malicious document recovered during the investigation was reportedly designed to target a Georgian government organization.
The attackers use regionally tailored phishing lures delivered through password-protected RAR archives containing malicious Microsoft Office documents. The password required to open the archive is provided within the phishing email.
Once the victim opens the malicious document, a macro initiates a DLL sideloading sequence that ultimately delivers the first-stage malware.
Five Previously Undocumented RAT Families
SilkParasite’s toolkit consists of seven RAT families, five of which had not previously been publicly documented.
The malware is written across four programming languages — .NET, C++, Go, and JavaScript — and relies heavily on modular, plugin-based architectures.
The identified tools include:
DriveSilkRAT (.NET/C++): Uses Google Drive as its command-and-control (C2) infrastructure. It monitors a designated folder for commands, executes tasks through an in-memory .NET plugin system, and uploads results back to the same location. It includes plugins for process discovery, system and network enumeration, file operations, and command execution.
CookiETagRAT (C++): Uses HTTP Cookie and ETag response headers to communicate with its C2 infrastructure and receive commands.
NomadRAT (C++): Features a central orchestrator and a dedicated library for C2 communications. Additional plugins are downloaded from the server using numerical identifiers when required.
GoginRAT (Go): Shares architectural similarities with NomadRAT and separates C2 communication from its core functionality. File-system and shell capabilities are implemented as individual plugins.
NodeEdgeRAT (JavaScript): Contains functionality for command execution, file management, and file transfers within a single JavaScript script.
Two other previously known RAT families are also associated with the operation.
China-Nexus Links Emerge
Several elements of the campaign point toward a possible China-nexus connection.
One of the most notable indicators is the deployment of BLOODALCHEMY, a C-based backdoor that is considered an updated version of Deed RAT, which itself succeeded ShadowPad. ShadowPad evolved from PlugX, a malware family historically associated with Chinese hacking groups.
BLOODALCHEMY can collect information about compromised systems and perform operations such as modifying or replacing malware components and terminating or removing itself.
The campaign also uses an updated version of SpiceRAT, a backdoor associated with a Chinese-speaking threat actor known as SneakyChef. The malware can download and execute executable files as well as arbitrary commands.
DLL Sideloading Used as a Primary Delivery Technique
DLL sideloading is a central component of the SilkParasite attack chain.
Rather than relying on a legitimate application already installed on a victim’s system, the attackers bring their own copy of a legitimately signed executable. A malicious DLL is then placed alongside the executable using the filename expected by the legitimate program.
When the signed executable launches, it loads the malicious DLL, allowing the attackers to execute their code while potentially blending malicious activity with legitimate software.
The technique is particularly difficult to detect when the signed executable is launched from an unusual directory.
Possible Use of AI in Malware Development
Researchers identified several indicators suggesting that AI may have been used to assist with parts of the malware development process.
For example, GoginRAT contains Go test functions and uses a hard-coded AES key of 0123456789abcdef. NodeEdgeRAT contains a configuration field where the encryption key is set to change_this_key.
Another potential indicator is the architectural similarity between NomadRAT and GoginRAT. Although the malware is written in different programming languages, both use a comparable high-level design, suggesting that the same architecture may have been implemented multiple times.
However, the malware does not appear to be entirely AI-generated. Its overall design, modular structure, and operational capabilities display characteristics associated with professionally developed espionage tooling.
Attackers Use Modular Malware Architecture
Nearly every tool deployed during the campaign uses a plugin-oriented architecture.
This approach allows attackers to add or remove capabilities without replacing the underlying malware. Operators can selectively deploy only the plugins required for a particular victim, reducing the malware’s footprint and potentially making detection more difficult.
The modular design also allows the attackers to update individual components as their operational requirements change.
Researchers observed approximately 65 systems infected with DriveSilkRAT, with most of the identified infections located in Asia.
How Organizations Can Detect the Activity
One of the most consistent indicators associated with the campaign is the use of DLL sideloading.
Rather than focusing solely on the name of a suspicious DLL, security teams should examine the relationship between a legitimately signed executable and a library loaded from an unusual location.
Organizations should also monitor unusual processes communicating with legitimate cloud services, particularly when those services are being used for command-and-control purposes.
Behavior-based detection can be especially important for identifying modular implants that use legitimate infrastructure and have a relatively small detection footprint.
Conclusion
The SilkParasite campaign highlights the growing sophistication of cyber espionage operations targeting government organizations in Central Asia.
Its combination of spear-phishing, DLL sideloading, modular RATs, legitimate cloud services, and suspected AI-assisted development creates a flexible attack framework that can adapt to different victims while attempting to minimize detection.
The suspected China-nexus links, use of malware associated with previously identified Chinese-speaking threat actors, and extensive use of modular espionage tooling make SilkParasite a campaign that organizations in the region should closely monitor.
