Since January 2025, researchers have observed a new wave of intrusions aimed largely at government-related organizations across Central Asia. According to Kaspersky, the victims include institutions in Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and also the Syrian Arab Republic. Analysts suspect a Chinese-speaking threat actor is behind the activity, although the campaign has not been definitively linked to a previously known group.
What stands out is not only the geopolitical focus, but also the technical approach: the attackers rely on a framework built around OctLurk and SilkLurk, supported by a specialized network-traffic proxy tool. Together, these components enable deeper access, data collection, and stealthy command execution.
Who is being targeted and which sectors are in scope?
The compromises are reported to focus on organizations that operate across multiple public and security-related domains. Kaspersky mentions targets in areas such as healthcare and research, government offices and ministries of foreign affairs, logistics, law-enforcement agencies, and functions tied to urban planning and facilities management.
In addition, the activity appears to reach public educational establishments. In practice, that broad scope matters: it increases the number of systems that can provide sensitive operational context and credential material for further intrusions.
Meet the core toolkit: OctLurk, SilkLurk, and LurkProxy
In Kaspersky’s analysis, the campaign uses two newly tracked obfuscated backdoors: OctLurk and SilkLurk. The framework also includes a utility called LurkProxy, designed to route network traffic through the compromised environment.
While the backdoors enable the attackers to run commands and manipulate data, LurkProxy supports the “network layer” of the intrusion. This can be crucial when actors need to relay traffic to other internal targets, reach external systems, or mask where connections originate.
OctLurk: plugin-based control and multi-purpose actions
OctLurk is described as being injected into memory and deployed via a loader. Before executing a batch script that launches LurkProxy, the attackers appear to check internet connectivity against a specific domain. Once running, OctLurk gathers host details, encrypts them, and sends them to a hard-coded command-and-control endpoint using a stream socket connection.
One of the biggest operational capabilities is in-memory plugin loading. OctLurk can retrieve additional plugins from the command server and inject them directly into memory to extend functionality without relying on persistent, on-disk malware artifacts.
Researchers list several plugin-enabled behaviors, including:
- Launching command shells and executing commands
- Performing file system activity
- Collecting and altering clipboard content
- Capturing screenshots and generating mouse events
- Scanning networks for exposed services
- Dumping credentials and stealing browser passwords
- Keylogging
- Collecting emails and enabling remote access
SilkLurk: DLL side-loading and timed remote instructions
The third component in the observed toolkit, SilkLurk, is introduced through a DLL-based sequence. Kaspersky reports that it is executed using a DLL side-loading chain, after which it creates a TCP socket connection to a command-and-control server defined in its configuration.
Once connected, SilkLurk collects victim information and transmits it to the server. The command-and-control response can then instruct the malware to perform tasks such as retrieving the local system time, adjusting sleep intervals, updating configuration, or receiving and injecting new plugins into memory.
In other words, SilkLurk behaves as an adaptable, remotely controlled backdoor that can shift its behavior over time based on attacker instructions.
How command execution expands after compromise
Kaspersky highlights that OctLurk’s command shell plugin supports a chain of post-compromise activities designed to move from initial foothold toward credential access, lateral movement, and stealthy collection.
- Host fingerprinting and data harvesting: the malware fingerprints the compromised machine and gathers extensive system details.
- Logon event discovery: it exports successful logon events for remote interactive logons and queries those events for specific users.
- Password hash collection: it uses Impacket’s secretsdump.py to harvest password hashes from domain controllers.
- Keylogging disguised as a legitimate app: the toolkit drops a keylogger that masquerades as AnyDesk to reduce the likelihood of detection.
- Browser password theft: it decrypts and extracts passwords from Google Chrome and Mozilla Firefox.
- Remote access tooling: it establishes remote access using a Pandora RC agent.
- Network scanning and service probing: it scans internal and public networks with Fscan to identify services on ports such as SSH (22) and MySQL (3306), then attempts access using credentials from a password file named pp.txt.
- Email server interaction: it connects to an email server, authenticates with provided credentials, and issues commands to collect or manipulate emails.
Taken together, these actions reflect a pattern: gather intelligence, obtain credentials, expand reach, and collect data from multiple channels.
LurkProxy: proxying network traffic in two modes
The role of LurkProxy is to route network communications through the infected host. Kaspersky describes it as functioning as a reverse proxy operating in two distinct modes:
- SOCKS5 proxy mode
- Transparent proxy mode
At any given time, the malware runs in only one of those modes to direct traffic through a target address. This kind of flexibility can help an operator maintain control over how connections are relayed and how traffic aligns with the attacker’s operational needs.
Execution flow details observed by analysts
While Kaspersky notes that the initial access vector is still unknown, the researchers observed elements of how the backdoors get deployed.
OctLurk is described as being injected into memory by a loader. Additionally, the attackers appear to check internet connectivity to a domain named dns.ssentialserv[.]xyz before running a batch script responsible for launching LurkProxy.
For command-and-control, OctLurk contacts a remote server at 154.196.162[.]76 and later communicates with another command endpoint, dns.multitoconference[.]com, for encrypted system information exchange. These details matter because they provide potential indicators for detection and hunting efforts.
Infrastructure overlaps and what they may indicateKaspersky also reports infrastructure overlaps between this campaign and earlier attacks involving a C++-based implant codenamed SilentRaid (also referenced as MystRodX and TrustFall). The company interprets this overlap as evidence of shared infrastructure across different campaigns that target multiple operating systems.
However, analysts emphasize that it remains unclear whether the activities occurred concurrently or at different times. Even so, the technical commonalities help build a broader picture of the attacker’s development and operational reuse.
Importantly, Kaspersky links the emergence of the OctLurk and SilkLurk multi-plugin framework to a continuous effort to improve stealth and maintain control over compromised networks.
Why in-memory behavior complicates detection
A key point in Kaspersky’s findings is that both families primarily operate in memory. The disk footprint is described as minimalistic, relying on a victim-specific encoding method to decode payload locations and contents.
Specifically, OctLurk uses machine-specific data such as the drive serial number, while SilkLurk uses the computer name. This victim-bound encoding makes automated detection and reverse engineering significantly harder, because the payload layout and decoding steps are not identical across environments.
What defenders can take away
For organizations within government or critical public services, this activity is a reminder that compromise workflows may target many departments at once—especially those that handle credentials, communications, and operational data.
Defensive priorities should include monitoring for suspicious in-memory behaviors, validating network connections to known command-and-control infrastructure, and auditing for tools or behaviors consistent with credential dumping, browser password theft, and keylogging disguised as legitimate applications.
Just as important, teams should be prepared for proxy-based traffic routing through compromised hosts. If traffic patterns suddenly reflect proxy activity, it can help narrow down where in the network the attacker is attempting to establish further reach.
Conclusion
Kaspersky’s report describes a targeted campaign spanning Central Asia and neighboring regions since January 2025, with suspected Chinese-speaking actors pursuing access to government and related sectors. The technical backbone of the operation centers on OctLurk and SilkLurk, supported by LurkProxy to route network traffic.
By combining in-memory plugin loading, credential theft, network scanning, and remote access capabilities, the attackers demonstrate a mature post-compromise strategy. For defenders, the most actionable lesson is clear: focus on behavioral detection and network monitoring that can identify in-memory control and proxy-assisted activity—not only traditional malware files.
Source: https://thehackernews.com/2026/08/suspected-chinese-speaking-hackers.html
