[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f12e354zzAaqGKiuGotBqfHPWgI2xutDOjvYO0vifDUc":3},{"article":4,"iocs":41,"watch_terms":61,"solutions":62,"lesson":145},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"78d5689e-bfed-452f-8b5c-c647d29ce144","Suspected Chinese-Speaking Hackers Target Central Asian Governments With OctLurk and SilkLurk","suspected-chinese-speaking-hackers-target-central-asian-governments-with-octlurk-63ae4b","A Chinese-speaking threat actor is suspected to be behind a fresh wave of cyber attacks targeting government organizations mainly located in Central Asia, including Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and the Syrian Arab Republic, since January 2025. These targeted organizations operate across several sectors, such as healthcare, research, government offices,","A Chinese-speaking threat actor is suspected of targeting government organizations in Central Asia and Syria with new backdoors named OctLurk and SilkLurk since January 2025. The attacks leverage a tool called LurkProxy to manage network traffic and aim to steal credentials, harvest system information, and establish remote access.","Chinese-speaking hackers target Central Asian governments with OctLurk and SilkLurk backdoors.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fsuspected-chinese-speaking-hackers.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjmBagWdesuJqVgNAHPh7t75IGrajY_oJeL9HHI7r23AK7CuLUN22-GBwDCWJWTlIutBApsdhSGproqxtR6kV_Dg04FT2zc6vZXZCQed8Kx3bD-jw-VXkYfAHlJsNgcQOcqRFW8TTh1kyN34MisnGx3ImU9vejv_oNy4jN0sPNcPM7jclq7klrMmGrnROjk\u002Fs1600\u002Fchinese-hackers.jpg","2026-07-31T18:52:04+00:00","2026-07-31T20:00:27.753783+00:00",8,[17,20],{"name":18,"type":19},"Chinese-speaking threat actor","threat_actor",{"name":21,"type":22},"Kaspersky","vendor","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":23,"icon":25,"name":26,"slug":27},null,"Nation-state","nation-state",[29,31,36],{"category":30},{"id":23,"icon":25,"name":26,"slug":27},{"category":32},{"id":33,"icon":25,"name":34,"slug":35},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[42,46,50,53,56,58],{"type":43,"value":44,"context":45},"domain","dns.ssentialserv[.]xyz","Domain checked for internet connectivity before executing batch script.",{"type":47,"value":48,"context":49},"ip","154.196.162[.]76","Command-and-control (C2) server IP address.",{"type":43,"value":51,"context":52},"dns.multitoconference[.]com","Hard-coded C2 server for OctLurk.",{"type":35,"value":54,"context":55},"OctLurk","Obfuscated backdoor used in attacks.",{"type":35,"value":57,"context":55},"SilkLurk",{"type":35,"value":59,"context":60},"LurkProxy","Utility to proxy network traffic.",[21],{"controls":63,"vendors":144},[64,93,119],{"slug":65,"name":66,"problem":67,"products":68},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[69,77,85],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":94,"name":95,"problem":96,"products":97},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[98,106,111],{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":107,"product_name":108,"url":109,"description":110},"falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"slug":40,"name":120,"problem":121,"products":122},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[123,128,136],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":124,"product_name":125,"url":126,"description":127},"falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",[],{"slug":146,"title":147,"body":148,"framework_refs":149,"framework_notes":166},"chinese-speaking-apt-deploys-octlurk-silklurk-backdoors-against-central-asian-governments","Chinese-Speaking APT Deploys OctLurk & SilkLurk Backdoors Against Central Asian Governments","A suspected Chinese-speaking threat actor has been conducting targeted intrusions against government entities in Central Asia and Syria since January 2025, deploying two novel backdoors — OctLurk and SilkLurk — alongside a traffic-management tool called LurkProxy. The campaign focuses on credential theft, system reconnaissance, and persistent remote access, hallmarks of a long-term espionage operation. Government networks are high-value targets because compromised credentials and system information can enable lateral movement across entire ministries or inter-agency systems. The use of custom tooling and a dedicated proxy layer suggests a sophisticated adversary deliberately evading signature-based detection. Without robust endpoint visibility, network segmentation, and privileged access controls, these footholds can persist undetected for months or years.",[150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165],"CIS Control 1 – Inventory and Control of Enterprise Assets","CIS Control 4 – Secure Configuration of Enterprise Assets","CIS Control 6 – Access Control Management","CIS Control 13 – Network Monitoring and Defence","CIS Control 17 – Incident Response Management","NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 AC-17 (Remote Access)","NIST SP 800-53 SI-3 (Malicious Code Protection)","NIST SP 800-53 SC-7 (Boundary Protection)","NIST SP 800-53 AU-6 (Audit Record Review)","NIST CSF DE.CM-1 (Network Monitoring)","MITRE ATT&CK T1078 (Valid Accounts)","MITRE ATT&CK T1090 (Proxy)","MITRE ATT&CK T1003 (OS Credential Dumping)","ISO\u002FIEC 27001 A.9.4 (System and Application Access Control)","ISO\u002FIEC 27001 A.12.4 (Logging and Monitoring)",{}]