OctLurk and SilkLurk Windows Backdoors Target Governments in 6 Countries
OctLurk and SilkLurk backdoors target governments in 6 countries, stealing sensitive data.
Kaspersky has identified two new Windows backdoors, OctLurk and SilkLurk, used in cyberespionage attacks against government organizations in six Central Asian and Middle Eastern countries since January 2025. These backdoors are designed to be highly specific to each victim and can steal passwords, emails, and files, with attackers deploying additional tools like Impacket and PlugX. The campaign shows evidence of shared command infrastructure with a previous Linux malware campaign, suggesting a potential link to a Chinese-speaking threat actor.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Kaspersky?
Get an email when a new story names Kaspersky, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe OctLurk and SilkLurk campaign demonstrates how sophisticated, victim-tailored backdoors can silently penetrate government environments to exfiltrate sensitive credentials, emails, and files over extended periods. The use of shared command-and-control infrastructure linking this campaign to previous Linux malware activity suggests a persistent, well-resourced threat actor — likely state-sponsored — with long-term espionage objectives. The deployment of post-exploitation tools like Impacket and PlugX indicates attackers achieved deep lateral movement, meaning initial detection failures allowed significant dwell time. This matters because government organizations hold highly sensitive national security data, and prolonged undetected access dramatically amplifies the damage of any breach.
What helps against this
How we list vendors- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — OctLurk
- malware — SilkLurk
- malware — LurkProxy
- malware — TrustFall
- malware — MystRodX
- malware — SilentRaid
- malware — PlugX