New Backdoors Used in Suspected Chinese-Speaking Campaign Against Central Asian Governments

A previously unattributed threat actor believed to be Chinese-speaking has targeted government organizations and related institutions across Central Asia since January 2025, according to an analysis by Kaspersky. Reported victims include entities in Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan and the Syrian Arab Republic.

The campaign has affected organizations in healthcare, research, foreign affairs, law enforcement, logistics, urban planning, education and other public-sector areas. Researchers have not linked the activity to a known hacking group, but they identified two previously undocumented backdoors, named OctLurk and SilkLurk, along with a traffic-routing utility called LurkProxy.

Memory-based malware framework

OctLurk is loaded into memory through a separate loader and can retrieve additional plugins from its command-and-control infrastructure. Those modules provide capabilities including command-shell access, file and clipboard operations, screenshots, keystroke capture, credential theft, browser-password extraction and network discovery.

Investigators observed the malware collecting system information before communicating with hard-coded infrastructure. Follow-on activity included exporting logon events, using Impacket’s secretsdump.py to obtain password hashes, deploying a keylogger disguised as AnyDesk, extracting credentials from Chrome and Firefox, and installing Pandora RC for remote access. The operators also used Fscan to probe internal and external networks for services such as SSH and MySQL, apparently attempting access with credentials stored in a file named pp.txt. Email accounts were targeted for collection and manipulation as well.

LurkProxy can route traffic through a compromised environment as either a SOCKS5 or transparent proxy, although it supports only one mode at a time.

SilkLurk and infrastructure links

SilkLurk is delivered through a DLL side-loading chain. After connecting to a configured command server, it gathers host information and accepts commands, including requests to change polling intervals, update configuration and load plugins directly into memory.

In observed intrusions, the backdoor was used to access network shares with administrative credentials, locate and stage sensitive documents, and archive collected files with WinRAR or 7-Zip. Researchers also saw a side-loading sequence used to deploy PlugX, a backdoor frequently associated with Chinese-speaking threat actors.

Kaspersky identified infrastructure similarities with earlier campaigns involving the SilentRaid implant, also known as MystRodX and TrustFall, but said the relationship remains unconfirmed. Both OctLurk and SilkLurk minimize their disk footprint and use victim-specific data to decode payloads, a design that can complicate automated detection and analysis.