OctLurk and SilkLurk: newly identified tailored backdoors in cyber-espionage campaign in Central Asia
OctLurk and SilkLurk backdoors target Central Asian governments in espionage campaign.
Researchers discovered two new tailored backdoors, OctLurk and SilkLurk, deployed in a cyber-espionage campaign targeting government organizations across Central Asia (Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, Syria) since January 2025. Both backdoors operate primarily in memory, inject plugins for shells, network scanning, credential dumping, keylogging, and browser password theft. The same Chinese-speaking threat actor likely operates both backdoors and a supporting utility called LurkProxy.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonA Chinese-speaking threat actor has deployed two sophisticated, memory-resident backdoors — OctLurk and SilkLurk — against government organizations across Central Asia since January 2025. Because these backdoors operate primarily in memory and inject plugins dynamically, they leave minimal forensic artifacts on disk, making traditional signature-based detection largely ineffective. Their capabilities — credential dumping, keylogging, browser password theft, and network scanning — indicate a mature, persistent espionage operation designed to maximize lateral movement and data exfiltration. This campaign underscores the danger of advanced persistent threat (APT) actors who tailor tooling specifically to evade standard endpoint defenses. Without robust behavioral monitoring and network visibility, organizations may remain compromised for extended periods without detection.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- hash_md5 — 6ecf84fb18f6747ed08d7598364d853a
- hash_md5 — 082d49ef9f14e6811d68c7e0e82e5069
- hash_md5 — b874123a80fc4f40e06872b9cb54ebc6
- domain — dns.ssentialserv.xyz
- ip — 154.196.162.76
- malware — OctLurk
- malware — SilkLurk
- malware — LurkProxy
- malware — PlugX