A previously unreported operation, now tracked under SilkParasite espionage, has been linked to cyber espionage against government bodies in Central Asia. The intrusion was discovered in late 2025 and is believed to be a China-nexus threat cluster, based on multiple technical signals and consistent tooling overlaps.
Security researchers observed the campaign using seven Remote Access Tool (RAT) families. Notably, five of those RATs have not been documented before: DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, and NodeEdgeRAT.
What makes SilkParasite stand out
According to Bitdefender Labs, SilkParasite is interesting not simply for what it does, but for how it appears to have been built. The technical report points to traces of AI-assisted development inside code that otherwise looks like it was written by experienced human operators. That distinction matters: the evidence does not suggest fully AI-generated malware, but rather a workflow where AI may help streamline certain parts of development.
Bitdefender also notes that most of the operation looks deliberately engineered for professionalism. The clearest “messy” detail is tied to a phishing lure that is assessed to be AI-generated, and it may have been left that way either accidentally or as a tactic to confuse attribution attempts.
Targeting Central Asia with region-tailored phishing
The campaign’s attack chains begin with spear-phishing. Victims receive password-protected RAR archives containing Microsoft Office documents. Crucially, the password is provided inside the email body, which reduces friction for the recipient and increases the likelihood the document will be opened.
When the document is opened, a macro triggers a chain designed to perform DLL sideloading and drop the first-stage payload. Researchers state that the lures were tailored to specific government contexts across Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, and Kazakhstan. Some documents impersonate particular ministries, while an additional document recovered from a malware-sharing platform targeted a Georgian government entity.
DLL sideloading as the campaign’s consistent backbone
Across SilkParasite, DLL sideloading shows up as the most consistent technique. Bitdefender emphasizes that the reliable detection signal is not only the presence of a DLL, but the relationship between a legitimately signed application and the library loaded alongside it—especially when execution occurs from an unusual location.
This approach aligns with broader operator tradecraft: by relying on legitimate binaries and placing a rogue library next to them, the attackers can keep artifacts less conspicuous than a purely file-based dropper chain.
Bypassing security checks during execution
In addition to the lure and delivery method, the macro includes a check for whether Kaspersky antivirus is installed and running before execution. Bitdefender interprets this as an effort to reduce exposure to detection, particularly given how prevalent the product is in the region.
A modular RAT toolkit built for flexibility
Another defining characteristic is a plugin-oriented architecture. Almost every tool used in the campaign implements components that can be extended. Operators can add or selectively serve capabilities that better match the victim environment, while keeping the detection footprint smaller than if every function were bundled into a single monolithic binary.
Researchers also highlight the operational advantage of this design: modular systems enable upgrades to components without replacing the underlying foundation. The seven implants span multiple programming languages—.NET, C++, Go, and JavaScript—and use DLL sideloading as the primary delivery vector.
Bitdefender describes a common method: the attackers bring their own copy of a legitimately signed program rather than using an already installed binary, then place the rogue DLL under a filename the executable looks for. When executed, the malicious code runs as part of the sideloaded library behavior.
The seven RAT families used in SilkParasite
Bitdefender provides a brief technical overview of the RAT families observed in the operation. While details vary, the core theme is consistent: modular functionality, remote tasking, and output handling designed to fit espionage workflows.
- DriveSilkRAT (.NET/C++): Uses Google Drive as command-and-control (C2). It polls a specific folder for tasks, executes commands through an in-memory .NET plugin system, then uploads results back to the same folder. It supports 12 plugins for tasks such as process listing, system and network enumeration, file management, and command execution.
- CookiETagRAT (C++): Uses HTTP Cookie/ETag response headers as the C2 mechanism. Commands are received and executed based on those header signals.
- NomadRAT (C++): Features a main orchestrator and a dedicated transmitter library that handles all C2 traffic. Plugins are fetched from the server only when needed, identified by numeric IDs.
- GoginRAT (Go): Shares architectural similarities with NomadRAT. It includes a separate transmitter for C2, and implements file system and shell capabilities as independent plugins. The results from plugin execution are routed through a shared callback.
- NodeEdgeRAT (JavaScript): Ships its full functionality in a single script, covering command execution, file management, and file transfer.
- Additional context on deployment volume: Bitdefender observed roughly 65 infected instances involving DriveSilkRAT, with most located in Asia.
Signals of AI involvement inside the campaign
While the operation is primarily assessed as human-operated espionage tooling, the report points to several artifacts that suggest AI-assisted workflows. Bitdefender notes that GoginRAT includes Go test functions and a hard-coded AES key set to
Source: https://thehackernews.com/2026/08/silkparasite-espionage-campaign-targets.html
