[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fswQpYn7IqsqEnCnnEX6tBneNSubnkfzrr4K5EUrnWsk":3},{"article":4,"iocs":39,"watch_terms":69,"solutions":70,"lesson":165},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"83917842-97de-4891-bbec-1b372c3184b5","OctLurk and SilkLurk: newly identified tailored backdoors in cyber-espionage campaign in Central Asia","octlurk-and-silklurk-newly-identified-tailored-backdoors-in-cyber-espionage-camp-b76786","Our experts discovered OctLurk and SilkLurk, backdoors operating primarily in memory, targeting Central Asia. They inject plugins to launch shells, scan networks, dump credentials, and keylogging.","Researchers discovered two new tailored backdoors, OctLurk and SilkLurk, deployed in a cyber-espionage campaign targeting government organizations across Central Asia (Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, Syria) since January 2025. Both backdoors operate primarily in memory, inject plugins for shells, network scanning, credential dumping, keylogging, and browser password theft. The same Chinese-speaking threat actor likely operates both backdoors and a supporting utility called LurkProxy.","OctLurk and SilkLurk backdoors target Central Asian governments in espionage campaign.","https:\u002F\u002Fsecurelist.com\u002Foctlurk-silklurk-backdoors-central-asia\u002F120840\u002F","https:\u002F\u002Fmedia.kasperskycontenthub.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F43\u002F2026\u002F07\u002F30082905\u002Foctlurk_silklurk_backdoors-scaled.jpg","2026-07-30T11:00:12+00:00","2026-07-30T12:00:32.882712+00:00",9,[17,20],{"name":18,"type":19},"Impacket secretsdump","technology",{"name":21,"type":22},"Unattributed Chinese-speaking group","threat_actor","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":23,"icon":25,"name":26,"slug":27},null,"Nation-state","nation-state",[29,34],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[40,44,47,50,54,58,61,63,66],{"type":41,"value":42,"context":43},"hash_md5","6ecf84fb18f6747ed08d7598364d853a","OctLurk batch script (1.bat)",{"type":41,"value":45,"context":46},"082d49ef9f14e6811d68c7e0e82e5069","OctLurk loader DLL (oleasapi.dll)",{"type":41,"value":48,"context":49},"b874123a80fc4f40e06872b9cb54ebc6","LurkProxy batch script (auto.bat)",{"type":51,"value":52,"context":53},"domain","dns.ssentialserv.xyz","LurkProxy C2 domain",{"type":55,"value":56,"context":57},"ip","154.196.162.76","LurkProxy C2 server",{"type":33,"value":59,"context":60},"OctLurk","In-memory backdoor for Central Asia targeting",{"type":33,"value":62,"context":60},"SilkLurk",{"type":33,"value":64,"context":65},"LurkProxy","Proxy utility supporting OctLurk\u002FSilkLurk operations",{"type":33,"value":67,"context":68},"PlugX","Second-stage payload deployed by SilkLurk",[],{"controls":71,"vendors":158},[72,101,130],{"slug":73,"name":74,"problem":75,"products":76},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[77,85,93],{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"slug":102,"name":103,"problem":104,"products":105},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[106,114,122],{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"slug":38,"name":131,"problem":132,"products":133},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[134,142,150],{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":143,"vendor_name":144,"vendor_logo":145,"product_slug":146,"product_name":147,"url":148,"description":149},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":151,"vendor_name":152,"vendor_logo":153,"product_slug":154,"product_name":155,"url":156,"description":157},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",[159],{"slug":160,"name":161,"logo_path":162,"roles":163},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[164],"reported_by",{"slug":166,"title":167,"body":168,"framework_refs":169,"framework_notes":183},"memory-resident-backdoors-octlurk-silklurk-target-central-asian-governments","Memory-Resident Backdoors OctLurk & SilkLurk Target Central Asian Governments","A Chinese-speaking threat actor has deployed two sophisticated, memory-resident backdoors — OctLurk and SilkLurk — against government organizations across Central Asia since January 2025. Because these backdoors operate primarily in memory and inject plugins dynamically, they leave minimal forensic artifacts on disk, making traditional signature-based detection largely ineffective. Their capabilities — credential dumping, keylogging, browser password theft, and network scanning — indicate a mature, persistent espionage operation designed to maximize lateral movement and data exfiltration. This campaign underscores the danger of advanced persistent threat (APT) actors who tailor tooling specifically to evade standard endpoint defenses. Without robust behavioral monitoring and network visibility, organizations may remain compromised for extended periods without detection.",[170,171,172,173,174,175,176,177,178,179,180,181,182],"MITRE ATT&CK T1055 (Process Injection)","MITRE ATT&CK T1003 (OS Credential Dumping)","MITRE ATT&CK T1056.001 (Keylogging)","MITRE ATT&CK T1090 (Proxy)","CIS Control 10 – Malware Defenses","CIS Control 13 – Network Monitoring and Defense","CIS Control 16 – Application Software Security","NIST SP 800-53 SI-3 (Malicious Code Protection)","NIST SP 800-53 SI-4 (Information System Monitoring)","NIST SP 800-53 AC-4 (Information Flow Enforcement)","NIST SP 800-53 IR-4 (Incident Handling)","NIST Cybersecurity Framework DE.CM-1 (Network Monitoring)","NIST Cybersecurity Framework RS.AN-1 (Notifications from Detection Systems)",{}]