[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fAXx6AFuWmHobcskaFtmORaqPsm3TRKP5fo2TwNLmVm8":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":25,"status":26,"created_at":27,"published_at":28,"article":29,"tags":33,"podcasts":52,"controls":59},"174e442c-0c5c-48d0-9d38-6a7376c92ae4","memory-resident-backdoors-octlurk-silklurk-target-central-asian-governments","83917842-97de-4891-bbec-1b372c3184b5","Memory-Resident Backdoors OctLurk & SilkLurk Target Central Asian Governments","A Chinese-speaking threat actor has deployed two sophisticated, memory-resident backdoors — OctLurk and SilkLurk — against government organizations across Central Asia since January 2025. Because these backdoors operate primarily in memory and inject plugins dynamically, they leave minimal forensic artifacts on disk, making traditional signature-based detection largely ineffective. Their capabilities — credential dumping, keylogging, browser password theft, and network scanning — indicate a mature, persistent espionage operation designed to maximize lateral movement and data exfiltration. This campaign underscores the danger of advanced persistent threat (APT) actors who tailor tooling specifically to evade standard endpoint defenses. Without robust behavioral monitoring and network visibility, organizations may remain compromised for extended periods without detection.","**Immediate actions:**\n- Deploy memory-forensics and behavior-based EDR solutions capable of detecting in-memory code injection and anomalous plugin loading.\n- Audit and rotate all privileged credentials immediately, especially on systems potentially exposed to the threat actor's known target profile.\n- Block known indicators of compromise (IOCs) associated with OctLurk, SilkLurk, and LurkProxy at perimeter and host-based controls.\n\n**Detection measures:**\n- Enable deep packet inspection and encrypted traffic analysis on outbound connections to identify C2 communication patterns used by LurkProxy.\n- Implement SIEM rules to alert on credential-dumping behaviors (e.g., LSASS access), unusual network scanning activity, and browser credential store access.\n- Establish baseline behavioral profiles for government endpoints to rapidly surface anomalies consistent with keylogging or in-memory execution.\n\n**Long-term improvements:**\n- Enforce strict network segmentation between government departments to limit lateral movement opportunities for attackers who gain an initial foothold.\n- Adopt a Zero Trust architecture requiring continuous verification of identity and device health before granting access to sensitive systems.\n- Conduct regular threat-hunting exercises specifically targeting fileless malware and memory-resident implants using frameworks like MITRE ATT&CK.",[12,13,14,15,16,17,18,19,20,21,22,23,24],"MITRE ATT&CK T1055 (Process Injection)","MITRE ATT&CK T1003 (OS Credential Dumping)","MITRE ATT&CK T1056.001 (Keylogging)","MITRE ATT&CK T1090 (Proxy)","CIS Control 10 – Malware Defenses","CIS Control 13 – Network Monitoring and Defense","CIS Control 16 – Application Software Security","NIST SP 800-53 SI-3 (Malicious Code Protection)","NIST SP 800-53 SI-4 (Information System Monitoring)","NIST SP 800-53 AC-4 (Information Flow Enforcement)","NIST SP 800-53 IR-4 (Incident Handling)","NIST Cybersecurity Framework DE.CM-1 (Network Monitoring)","NIST Cybersecurity Framework RS.AN-1 (Notifications from Detection Systems)",{},"published","2026-07-30T12:20:40.819602+00:00","2026-07-30T12:20:40.699+00:00",{"id":7,"url":30,"slug":31,"title":32},"https:\u002F\u002Fsecurelist.com\u002Foctlurk-silklurk-backdoors-central-asia\u002F120840\u002F","octlurk-and-silklurk-newly-identified-tailored-backdoors-in-cyber-espionage-camp-b76786","OctLurk and SilkLurk: newly identified tailored backdoors in cyber-espionage campaign in Central Asia",[34,40,46],{"id":35,"name":36,"slug":37,"description":38,"color":39},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":41,"name":42,"slug":43,"description":44,"color":45},"182e11d5-57c4-444e-8ec8-4682ad60261b","Incident Response","incident-response","Slow detection, poor containment, missing playbooks","#14b8a6",{"id":47,"name":48,"slug":49,"description":50,"color":51},"f43a7f30-5046-4b10-9dba-1a704139821e","Network Segmentation","network-segmentation","Lateral movement, flat networks, missing firewalls","#06b6d4",[53],{"id":54,"date":55,"edition":56,"title":57,"audio_url":58},"a67b8545-f81f-446c-b9a7-7c1165feda0a","2026-07-30","afternoon","ThreatNoir Afternoon Brief — July 30","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-07-30\u002Fthreatnoir-afternoon-brief-2026-07-30.mp3",[60,64,68],{"slug":61,"name":62,"problem":63},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":65,"name":66,"problem":67},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",{"slug":69,"name":70,"problem":71},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them."]