Suspected Chinese-Speaking Hackers Target Central Asian Governments With OctLurk and SilkLurk

A suspected Chinese-speaking threat actor has been conducting targeted intrusions against government entities in Central Asia and Syria since January 2025, deploying two novel backdoors — OctLurk and SilkLurk — alongside a traffic-management tool called LurkProxy. The campaign focuses on credential theft, system reconnaissance, and persistent remote access, hallmarks of a long-term espionage operation. Government networks are high-value targets because compromised credentials and system information can enable lateral movement across entire ministries or inter-agency systems. The use of custom tooling and a dedicated proxy layer suggests a sophisticated adversary deliberately evading signature-based detection. Without robust endpoint visibility, network segmentation, and privileged access controls, these footholds can persist undetected for months or years.