[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fMx1qBwhgNDbrcMFn9-JSgyjWAKm1iM0yqx4pdfVXKck":3},{"article":4,"iocs":50,"watch_terms":65,"solutions":66,"lesson":155},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"21d7e4c8-c7d7-4e97-b64f-1d6fbdb5911a","OctLurk and SilkLurk Windows Backdoors Target Governments in 6 Countries","octlurk-and-silklurk-windows-backdoors-target-governments-in-6-countries-059210","Kaspersky links OctLurk and SilkLurk to cyberespionage attacks stealing passwords, emails and files from government systems in six countries since January 2025.","Kaspersky has identified two new Windows backdoors, OctLurk and SilkLurk, used in cyberespionage attacks against government organizations in six Central Asian and Middle Eastern countries since January 2025. These backdoors are designed to be highly specific to each victim and can steal passwords, emails, and files, with attackers deploying additional tools like Impacket and PlugX. The campaign shows evidence of shared command infrastructure with a previous Linux malware campaign, suggesting a potential link to a Chinese-speaking threat actor.","OctLurk and SilkLurk backdoors target governments in 6 countries, stealing sensitive data.","https:\u002F\u002Fhackread.com\u002Foctlurk-silklurk-backdoors-target-6-countries\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F08\u002Foctlurk-silklurk-windows-backdoors-target-6-countries.png","2026-08-05T19:14:21+00:00","2026-08-05T20:00:23.651489+00:00",8,[17,20,23,26,28,30],{"name":18,"type":19},"Kaspersky","vendor",{"name":21,"type":22},"Chinese-speaking actor","threat_actor",{"name":24,"type":25},"OctLurk","product",{"name":27,"type":25},"SilkLurk",{"name":29,"type":25},"LurkProxy",{"name":31,"type":25},"PlugX","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":32,"icon":34,"name":35,"slug":36},null,"Nation-state","nation-state",[38,40,45],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51,53,54,56,59,61,63],{"type":44,"value":24,"context":52},"Windows backdoor used in cyberespionage campaign",{"type":44,"value":27,"context":52},{"type":44,"value":29,"context":55},"Network traffic relay implant",{"type":44,"value":57,"context":58},"TrustFall","Linux malware used in a related campaign",{"type":44,"value":60,"context":58},"MystRodX",{"type":44,"value":62,"context":58},"SilentRaid",{"type":44,"value":31,"context":64},"Second-stage payload deployed by SilkLurk",[18,24,27],{"controls":67,"vendors":154},[68,96,125],{"slug":69,"name":70,"problem":71,"products":72},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[73,81,89],{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":69,"product_name":93,"url":94,"description":95},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"slug":97,"name":98,"problem":99,"products":100},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[101,109,117],{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"slug":126,"name":127,"problem":128,"products":129},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[130,138,146],{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":147,"vendor_name":148,"vendor_logo":149,"product_slug":150,"product_name":151,"url":152,"description":153},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",[],{"slug":156,"title":157,"body":158,"framework_refs":159,"framework_notes":173},"state-sponsored-backdoors-exploit-government-networks-across-six-nations","State-Sponsored Backdoors Exploit Government Networks Across Six Nations","The OctLurk and SilkLurk campaign demonstrates how sophisticated, victim-tailored backdoors can silently penetrate government environments to exfiltrate sensitive credentials, emails, and files over extended periods. The use of shared command-and-control infrastructure linking this campaign to previous Linux malware activity suggests a persistent, well-resourced threat actor — likely state-sponsored — with long-term espionage objectives. The deployment of post-exploitation tools like Impacket and PlugX indicates attackers achieved deep lateral movement, meaning initial detection failures allowed significant dwell time. This matters because government organizations hold highly sensitive national security data, and prolonged undetected access dramatically amplifies the damage of any breach.",[160,161,162,163,164,165,166,167,168,169,170,171,172],"NIST SP 800-53: AC-2 (Account Management)","NIST SP 800-53: SI-3 (Malicious Code Protection)","NIST SP 800-53: AU-6 (Audit Record Review)","NIST SP 800-53: IR-4 (Incident Handling)","CIS Control 3: Data Protection","CIS Control 6: Access Control Management","CIS Control 13: Network Monitoring and Defense","CIS Control 17: Incident Response Management","MITRE ATT&CK: T1059 (Command and Scripting Interpreter)","MITRE ATT&CK: T1078 (Valid Accounts)","MITRE ATT&CK: T1571 (Non-Standard Port C2)","ISO\u002FIEC 27001: A.12.4 (Logging and Monitoring)","ISO\u002FIEC 27001: A.13.1 (Network Security Management)",{}]