{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/actors/silkparasite/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["SilkParasite"],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Office"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"threat","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eSilkParasite is an espionage-focused threat cluster assessed with medium confidence to have a China-nexus. The campaign has been active since late 2025, specifically targeting government organizations in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, and Kazakhstan. The threat group employs a diverse arsenal of seven distinct RAT families, five of which were newly documented: DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, and NodeEdgeRAT. These tools are built in .NET, C++, Go, and JavaScript, and leverage a modular, plugin-oriented architecture to maintain a low footprint. The operators utilize DLL sideloading to execute malicious payloads, often bringing their own signed binaries to facilitate evasion. The campaign shows potential signs of AI-assisted development, specifically in codebase architecture and test function generation.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInitial access via spear-phishing emails containing password-protected RAR archives.\u003c/li\u003e\n\u003cli\u003eThe RAR archives contain malicious Microsoft Office documents with embedded VBA macros.\u003c/li\u003e\n\u003cli\u003eThe VBA macro checks for the presence of Kaspersky antivirus to determine if the environment is suitable for infection.\u003c/li\u003e\n\u003cli\u003eThe macro executes a DLL sideloading sequence, dropping a rogue DLL beside a legitimately signed binary.\u003c/li\u003e\n\u003cli\u003eThe legitimately signed binary loads the malicious DLL to initiate the first-stage payload execution.\u003c/li\u003e\n\u003cli\u003eImplants (such as DriveSilkRAT, GoginRAT, or NomadRAT) establish C2 via cloud services (e.g., Google Drive) or custom HTTP header tagging.\u003c/li\u003e\n\u003cli\u003eModular plugins are fetched and executed in memory for system enumeration, file exfiltration, and command execution.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe campaign has resulted in at least 65 confirmed infections, primarily affecting government entities across Central Asia. Successful exploitation allows for persistent unauthorized access to sensitive government networks, host enumeration, and data exfiltration. The use of modular plugin architecture allows the attackers to continuously adapt to the victim's environment, making the threat highly persistent and difficult to eradicate.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImplement behavioral monitoring to detect DLL sideloading by alerting on signed binaries loading modules from non-standard or user-writable directories.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule provided below to detect suspicious DLL sideloading attempts in your environment.\u003c/li\u003e\n\u003cli\u003eBlock or monitor traffic to public cloud storage services (like Google Drive) when initiated by unsigned or suspicious processes originating from unusual host paths.\u003c/li\u003e\n\u003cli\u003eConduct threat hunting for the execution of Office macros that perform environment checks for security software, specifically looking for process-creation events linked to Microsoft Office applications.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-19T14:32:40Z","date_published":"2026-08-19T14:32:40Z","id":"https://feed.craftedsignal.io/briefs/2026-08-silkparasite/","summary":"The SilkParasite threat actor is targeting Central Asian government entities with a modular suite of seven remote access tools delivered via spear-phishing and DLL sideloading.","title":"SilkParasite Espionage Campaign Targeting Central Asian Governments","url":"https://feed.craftedsignal.io/briefs/2026-08-silkparasite/"}],"language":"en","title":"CraftedSignal Threat Feed - SilkParasite","version":"https://jsonfeed.org/version/1.1"}