Chinese-Speaking APT Deploys OctLurk & SilkLurk Backdoors Against Central Asian Governments
Written by AI from the linked story. Not reviewed by an editor. How this works
A suspected Chinese-speaking threat actor has been conducting targeted intrusions against government entities in Central Asia and Syria since January 2025, deploying two novel backdoors — OctLurk and SilkLurk — alongside a traffic-management tool called LurkProxy. The campaign focuses on credential theft, system reconnaissance, and persistent remote access, hallmarks of a long-term espionage operation. Government networks are high-value targets because compromised credentials and system information can enable lateral movement across entire ministries or inter-agency systems. The use of custom tooling and a dedicated proxy layer suggests a sophisticated adversary deliberately evading signature-based detection. Without robust endpoint visibility, network segmentation, and privileged access controls, these footholds can persist undetected for months or years.
Tactical Insight
Immediate actions
- Deploy endpoint detection and response (EDR) solutions across all government workstations and servers to detect novel backdoor behaviour.
- Audit and rotate all privileged credentials immediately, prioritising accounts with remote access or administrative rights.
- Block outbound connections to unknown or untrusted proxy infrastructure at the perimeter firewall.
Long-term improvements
- Implement strict network segmentation to isolate sensitive government systems from general-purpose networks and internet-facing assets.
- Enforce multi-factor authentication (MFA) on all remote access pathways, VPNs, and administrative consoles.
- Establish a threat intelligence sharing programme with peer government agencies and national CERTs to receive early warnings on APT tooling.
Detection measures
- Enable centralised logging (SIEM) with alerting rules for anomalous outbound traffic patterns consistent with proxy tunnelling (e.g., LurkProxy behaviour).
- Conduct regular threat-hunting exercises specifically looking for persistence mechanisms such as scheduled tasks, registry run keys, and unusual service installations.
- Monitor for credential-harvesting indicators such as LSASS memory access, unusual SAM database reads, or bulk authentication failures.