Blog Details

<p>A suspected Chinese-speaking threat actor has been conducting a broad espionage campaign against government and public-sector organizations across Central Asia and nearby regions. The activity, observed since at least January 2025, has affected organizations in Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and Syria.</p><p>The campaign uses two newly documented backdoors, OctLurk and SilkLurk, together with a traffic-routing utility called LurkProxy. Reported targets include foreign affairs ministries, healthcare organizations, research bodies, law enforcement agencies, logistics providers, educational institutions, and urban planning departments.</p><h2>A Modular Espionage Platform</h2><p>OctLurk can receive plugins directly into memory, giving operators the ability to execute commands, browse files, capture screenshots, manipulate clipboard contents, and control keyboard or mouse activity. Investigators also observed attempts to extract domain controller password hashes, collect browser credentials, scan internal networks, deploy keyloggers, and access email servers.</p><p>SilkLurk uses DLL side-loading and a victim-specific decoding process based on the computer name. Its operators can connect to network shares, search for confidential documents, stage stolen files, and create archives with legitimate tools such as WinRAR and 7-Zip. The attackers have also used it to deploy PlugX, a backdoor long associated with Chinese espionage operations.</p><p>The initial entry method has not yet been confirmed. That uncertainty is important because it leaves defenders without a single vulnerability, phishing lure, or exposed service to prioritize.</p><h2>Why Conventional Scanning May Miss the Intrusion</h2><p>Both backdoors are designed to keep much of their malicious code in memory while leaving relatively small components on disk. In my view, this makes the campaign a strong example of why file scanning alone is no longer sufficient for defending high-value networks.</p><h3>Recommended Defensive Measures</h3><ul><li>Monitor for unusual DLL loading from user-writable and temporary directories.</li><li>Detect credential dumping and unexpected access to domain controller secrets.</li><li>Investigate unexplained use of archiving tools on servers and administrative workstations.</li><li>Restrict outbound traffic from systems that do not require direct internet access.</li><li>Collect memory telemetry and command-line activity through EDR platforms.</li><li>Segment email, identity, and document systems from ordinary user networks.</li></ul><p>I believe organizations should also hunt for the campaign's behavior rather than relying only on published indicators. Domains and server addresses can change quickly, but credential dumping, network share discovery, suspicious PowerShell execution, and unusual email collection remain difficult for an intruder to avoid.</p>