[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f9mkz62I7PjUEILiLiVodmxD4aTk1nnNAUZ42v-3QiuA":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":28,"status":29,"created_at":30,"published_at":31,"article":32,"tags":36,"podcasts":55,"controls":62},"40080d3d-c594-4bbd-9c2a-508a91205711","chinese-speaking-apt-deploys-octlurk-silklurk-backdoors-against-central-asian-governments","78d5689e-bfed-452f-8b5c-c647d29ce144","Chinese-Speaking APT Deploys OctLurk & SilkLurk Backdoors Against Central Asian Governments","A suspected Chinese-speaking threat actor has been conducting targeted intrusions against government entities in Central Asia and Syria since January 2025, deploying two novel backdoors — OctLurk and SilkLurk — alongside a traffic-management tool called LurkProxy. The campaign focuses on credential theft, system reconnaissance, and persistent remote access, hallmarks of a long-term espionage operation. Government networks are high-value targets because compromised credentials and system information can enable lateral movement across entire ministries or inter-agency systems. The use of custom tooling and a dedicated proxy layer suggests a sophisticated adversary deliberately evading signature-based detection. Without robust endpoint visibility, network segmentation, and privileged access controls, these footholds can persist undetected for months or years.","**Immediate actions:**\n- Deploy endpoint detection and response (EDR) solutions across all government workstations and servers to detect novel backdoor behaviour.\n- Audit and rotate all privileged credentials immediately, prioritising accounts with remote access or administrative rights.\n- Block outbound connections to unknown or untrusted proxy infrastructure at the perimeter firewall.\n\n**Long-term improvements:**\n- Implement strict network segmentation to isolate sensitive government systems from general-purpose networks and internet-facing assets.\n- Enforce multi-factor authentication (MFA) on all remote access pathways, VPNs, and administrative consoles.\n- Establish a threat intelligence sharing programme with peer government agencies and national CERTs to receive early warnings on APT tooling.\n\n**Detection measures:**\n- Enable centralised logging (SIEM) with alerting rules for anomalous outbound traffic patterns consistent with proxy tunnelling (e.g., LurkProxy behaviour).\n- Conduct regular threat-hunting exercises specifically looking for persistence mechanisms such as scheduled tasks, registry run keys, and unusual service installations.\n- Monitor for credential-harvesting indicators such as LSASS memory access, unusual SAM database reads, or bulk authentication failures.",[12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27],"CIS Control 1 – Inventory and Control of Enterprise Assets","CIS Control 4 – Secure Configuration of Enterprise Assets","CIS Control 6 – Access Control Management","CIS Control 13 – Network Monitoring and Defence","CIS Control 17 – Incident Response Management","NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 AC-17 (Remote Access)","NIST SP 800-53 SI-3 (Malicious Code Protection)","NIST SP 800-53 SC-7 (Boundary Protection)","NIST SP 800-53 AU-6 (Audit Record Review)","NIST CSF DE.CM-1 (Network Monitoring)","MITRE ATT&CK T1078 (Valid Accounts)","MITRE ATT&CK T1090 (Proxy)","MITRE ATT&CK T1003 (OS Credential Dumping)","ISO\u002FIEC 27001 A.9.4 (System and Application Access Control)","ISO\u002FIEC 27001 A.12.4 (Logging and Monitoring)",{},"published","2026-07-31T20:20:26.721638+00:00","2026-07-31T20:20:26.595+00:00",{"id":7,"url":33,"slug":34,"title":35},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fsuspected-chinese-speaking-hackers.html","suspected-chinese-speaking-hackers-target-central-asian-governments-with-octlurk-63ae4b","Suspected Chinese-Speaking Hackers Target Central Asian Governments With OctLurk and SilkLurk",[37,43,49],{"id":38,"name":39,"slug":40,"description":41,"color":42},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":44,"name":45,"slug":46,"description":47,"color":48},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":50,"name":51,"slug":52,"description":53,"color":54},"f43a7f30-5046-4b10-9dba-1a704139821e","Network Segmentation","network-segmentation","Lateral movement, flat networks, missing firewalls","#06b6d4",[56],{"id":57,"date":58,"edition":59,"title":60,"audio_url":61},"ebd17d28-8bff-4323-a27c-df527b94d0ab","2026-08-01","morning","ThreatNoir Weekend Brief — August 1","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-08-01\u002Fthreatnoir-morning-brief-2026-08-01.mp3",[63,67,71],{"slug":64,"name":65,"problem":66},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":68,"name":69,"problem":70},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":72,"name":73,"problem":74},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them."]