OctLurk and SilkLurk Memory-Resident Backdoors Targeting Central Asia

Since January 2025, government and research organizations across Central Asia - including Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and Syria - have been targeted by two sophisticated, memory-resident backdoors: OctLurk and SilkLurk. These tools, likely operated by a Chinese-speaking threat actor, utilize custom loaders that generate decryption keys derived from victim-specific hardware information, such as the C: drive serial number, to perform reflective DLL injection.

The attackers deploy these backdoors by creating malicious Windows services or scheduled tasks (e.g., 'GoogleUpDate') that execute obfuscated batch scripts. Once the backdoor is injected, it communicates with C2 infrastructure via port 443 using a complex, multi-stage XOR and zlib-compression scheme. The malware is highly modular, allowing the operators to download and inject memory-only plugins for command shell execution, filesystem management, keystroke and mouse event synthesis, credential dumping, and keylogging. The campaign also involves 'LurkProxy', a utility with similar architecture used to facilitate network operations.

Attack Chain

1. Attacker establishes persistence by creating a scheduled task (e.g., 'GoogleUpDate') or a custom service (e.g., 'NgcCIntSvc', 'Cusrxsrv') on the victim machine using compromised admin credentials.
2. The persistence mechanism executes a local batch script (e.g., '1.bat' or 'auto.bat') which installs a loader DLL (e.g., 'oleasapi.dll' or 'msbasesysdc.dll') into the system.
3. The service registry is configured to call the 'RegisterService' export of the loader DLL upon service startup.
4. The loader DLL performs multi-stage decryption of the payload path using a hard-coded key and a key derived from the victim's hardware (e.g., drive serial number).
5. The loader retrieves and decrypts the backdoor DLL, then injects it into memory using reflective DLL injection techniques.
6. The backdoor contacts the C2 server (e.g., 'dns.multitoconference.com') over port 443, transmitting victim system information encrypted with hard-coded XOR keys and zlib compression.
7. The backdoor receives and loads modular plugins directly into memory to perform post-exploitation activities, including credential dumping, keylogging, and file exfiltration.

Impact

This campaign has successfully compromised government agencies, foreign affairs ministries, and law enforcement entities across Central Asia. If the attack succeeds, the threat actor gains persistent, remote access to sensitive systems, allowing for large-scale data exfiltration, credential theft, and sustained cyber-espionage activities within the targeted sectors.

Recommendation

1. Deploy the Sigma rules below to monitor for suspicious Windows service creation and scheduled task execution patterns associated with backdoor deployment.
2. Implement strict egress filtering on your network to block connections to known C2 domains: 'dns.multitoconference.com' and 'dns.ssentialserv.xyz'.
3. Monitor for the creation of unauthorized services with suspect names like 'NgcCIntSvc' or 'Cusrxsrv' as documented in the brief.
4. Use Endpoint Detection and Response (EDR) to alert on memory-resident reflective DLL injection attempts targeting system processes.
5. Investigate high-entropy command-line arguments in batch scripts occurring in non-standard directories like 'C:\Users<username>\Videos'.