OctLurk and SilkLurk Backdoors Target Central Asian Governments in Cyberespionage Campaign

OctLurk and SilkLurk are highly customized, memory‑resident backdoors used in an ongoing cyberespionage campaign against government and critical‑sector networks across Central Asia and Syria, operated by a Chinese‑speaking threat actor but not yet linked to a known APT.

Active since January 2025, the operation leverages victim‑specific loaders, multi‑plugin frameworks, and shared infrastructure, along with Linux‑focused TrustFall/MystRodX/SilentRaid implants, to maintain long‑term, covert access to strategic environments.

Victims span ministries of foreign affairs, law‑enforcement agencies, healthcare providers, research institutes, logistics entities, urban planning departments, facilities management, and public education bodies.

The activity aligns with a long‑running pattern of Chinese‑language espionage operations focused on Central Asian governments and regional politics.

Both malware families are designed for precision targeting. Their loaders are customized per victim and will only decrypt and execute the payload on the intended machine, dramatically complicating automated triage and static detection.

Once established, the backdoors provide full remote access, data theft, and lateral‑movement capabilities, supporting long‑term intelligence collection rather than smash‑and‑grab monetization.

OctLurk is deployed via scheduled tasks and malicious services, typically masquerading as benign components such as “GoogleUpDate” or pseudo‑system services (for example, NgcCIntSvc).

The loader DLL (oleasapi.dll and related variants) exports Refresh and RegisterService, implementing a heavily obfuscated chain: hard‑coded bytes are double‑XOR‑decrypted and zlib‑decompressed to recover both payload paths and the backdoor DLL.

Crucially, OctLurk’s second XOR key is derived from the serial number of the victim’s C: drive, binding execution to a specific machine.

The backdoor is reflectively injected into memory and talks to a hard‑coded C2 domain over TLS (dns[.]multitoconference[.]com, port 443).

It exfiltrates detailed host fingerprints OS version, hostname, user, IP, and local time which are compressed and encrypted twice with a long string XOR key and a randomly generated 83‑byte key, then framed in a custom packet format.

Commands and plugins received from the C2 undergo the same double‑XOR plus zlib pipeline before execution.

OctLurk’s plugin system exports ins_ctl_db and oct_lk_col, with functionality concentrated in oct_lk_col. Common plugins include a command shell, a file manager, and an interaction manager.

Kaspersky Researchers said that, OctLurk and SilkLurk deployed against government organizations in Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and the Syrian Arab Republic.

Together they enable granular drive inventory, file search and staging, timestamp tampering, arbitrary command execution, screen capture, clipboard manipulation, synthetic keyboard/mouse events, and full operator‑driven remote control.

OctLurk and SilkLurk Backdoors

SilkLurk arrives via DLL side‑loading through legitimate binaries such as NetSetSvc.exe and Realtek/NVIDIA utilities, using malicious companion DLLs (nvml.dll, vulkan‑1.dll, RtkSmbusLoc.dll, RtkNGUI64Loc.dll) as loaders.

The loader verifies its host process, moves an encrypted payload (for example, OneDrive.dat) into a hard‑coded directory, then creates a persistent service (RmSs) that ensures repeated execution of the legitimate binary plus loader.

SilkLurk’s loader uses the victim computer name as a cryptographic anchor. A 32‑bit hash of the hostname drives multiple custom arithmetic/logic‑based decryption routines that unpack shellcode and reconstruct the backdoor from a partially zeroed PE image.

Imports, relocations, and the entry point are decrypted on the fly, then scrubbed from memory, minimizing forensic artefacts.

The backdoor maintains a 1196‑byte configuration blob containing four C2 hosts and ports, as well as up to two HTTP proxy endpoints with credentials. C2 connectivity may be tunneled through authenticated proxies using a crafted CONNECT request that mimics a Chrome/86 user agent.

The attackers ran commands to export successful logon events for remote interactive logons (e.g., Remote Desktop Protocol) and to query those events for specific users.

After connection, SilkLurk generates a 32‑byte network key, wraps it with a magic dword in a 40‑byte block, and encrypts it using a bespoke algorithm before sending it to the C2 in a structured packet with random padding to frustrate traffic analysis.

SilkLurk then gathers host identifiers computer name, DNS domain, username, CPU architecture, OS build, IP, process ID, tick count, module name compresses and encrypts them with the network key, and encapsulates the blob in an encrypted header and random dword spacer.

Subsequent C2 responses follow a 19‑byte header format; decrypted message types dictate operations such as time queries, sleep interval updates, configuration retrieval and update, and in‑memory injection of secondary payloads and plugins.

In parallel with OctLurk, operators deploy LurkProxy, an implant built on a heavily obfuscated OctLurk‑style loader but dedicated to network proxying rather than host control.

LurkProxy listens on a hard‑coded port (64980), negotiates a TLS session with a C2 at 154[.]196[.]162[.]76, and implements a proprietary binary protocol where every packet is compressed with zlib and encrypted via double‑XOR.

Two operating modes are supported: SOCKS5 reverse proxy (mode 1), where the C2 mediates client‑selected target connections, and a transparent reverse proxy (mode 2) that forwards all traffic to a fixed backend endpoint.

Infrastructure overlaps extend beyond Windows implants. Kazakhstan’s State Technical Service (STS) reported TrustFall (also tracked as MystRodX and SilentRaid) a Linux‑focused remote‑access backdoor in a 2025 campaign against national critical infrastructure.

Active probing later identified new TrustFall C2 servers, three of which were also used by OctLurk and LurkProxy, indicating shared VPS‑based infrastructure and cross‑platform operational planning.

Once inside, the threat actor follows a disciplined post‑compromise playbook. Using OctLurk’s command‑shell plugin, they deploy a detailed fingerprinting script (in.bat) that enumerates sessions, network configuration, AV products and exclusions, event logs, startup items, BIOS and hardware data, and scheduled tasks.

Lateral movement and credential theft rely on Impacket’s secretsdump (disguised as Adobe.exe) to extract domain controller hashes, a keylogger invoked via AnyDesk‑named tasks, bespoke browser password decryptors for Chrome and Firefox, Pandora RC agents for remote monitoring.

For data theft, SilkLurk‑controlled shells launch PowerShell and net use commands to mount administrative shares, search for sensitive documents, and then archive exfiltration sets with WinRAR and 7‑Zip under misleading filenames.

In several cases, SilkLurk also served as the delivery mechanism for PlugX a long‑standing, modular RAT historically associated with Chinese‑speaking APTs and configured in this campaign to use gycudore[.]kozow[.]com as C2 while SilkLurk itself talked to ctyuhjerf[.]kozow[.]com, further tying the ecosystem to Chinese‑language tooling.

IOCs

Family	Type	Indicator	Notes
OctLurk C2	DNS	dns.multitoconference[.]com	Domain
OctLurk C2	DNS	tj.tajikistandip[.]com	Subdomain tj
OctLurk C2	DNS	fm01.clouddevicemetrics[.]com	Subdomain fm01
OctLurk C2	DNS	confbase.mdpsupport[.]net	Domain
OctLurk C2	DNS	digital.leroymerling[.]com	Subdomain digital
OctLurk C2	DNS	api2.annoyingremote[.]com	Subdomain api2
OctLurk C2	DNS	about.blsouqs[.]com	Subdomain about
OctLurk C2	DNS	ssl.blsouqs[.]com	Subdomain ssl
OctLurk C2	IP	45[.]138[.]157[.]165	IPv4 address
LurkProxy C2	DNS	dns.ssentialserv[.]xyz	Domain
LurkProxy C2	IP	154[.]196[.]162[.]76	IPv4 address

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

$1M Data Breach Warranty is Genuine Protection?: Download 10 Point Free AI SOC Breach Warranty Guide