SilkParasite Espionage Campaign Targeting Central Asian Governments

SilkParasite is an espionage-focused threat cluster assessed with medium confidence to have a China-nexus. The campaign has been active since late 2025, specifically targeting government organizations in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, and Kazakhstan. The threat group employs a diverse arsenal of seven distinct RAT families, five of which were newly documented: DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, and NodeEdgeRAT. These tools are built in .NET, C++, Go, and JavaScript, and leverage a modular, plugin-oriented architecture to maintain a low footprint. The operators utilize DLL sideloading to execute malicious payloads, often bringing their own signed binaries to facilitate evasion. The campaign shows potential signs of AI-assisted development, specifically in codebase architecture and test function generation.

Attack Chain

1. Initial access via spear-phishing emails containing password-protected RAR archives.
2. The RAR archives contain malicious Microsoft Office documents with embedded VBA macros.
3. The VBA macro checks for the presence of Kaspersky antivirus to determine if the environment is suitable for infection.
4. The macro executes a DLL sideloading sequence, dropping a rogue DLL beside a legitimately signed binary.
5. The legitimately signed binary loads the malicious DLL to initiate the first-stage payload execution.
6. Implants (such as DriveSilkRAT, GoginRAT, or NomadRAT) establish C2 via cloud services (e.g., Google Drive) or custom HTTP header tagging.
7. Modular plugins are fetched and executed in memory for system enumeration, file exfiltration, and command execution.

Impact

The campaign has resulted in at least 65 confirmed infections, primarily affecting government entities across Central Asia. Successful exploitation allows for persistent unauthorized access to sensitive government networks, host enumeration, and data exfiltration. The use of modular plugin architecture allows the attackers to continuously adapt to the victim's environment, making the threat highly persistent and difficult to eradicate.

Recommendation

• Implement behavioral monitoring to detect DLL sideloading by alerting on signed binaries loading modules from non-standard or user-writable directories.
• Deploy the Sigma rule provided below to detect suspicious DLL sideloading attempts in your environment.
• Block or monitor traffic to public cloud storage services (like Google Drive) when initiated by unsigned or suspicious processes originating from unusual host paths.
• Conduct threat hunting for the execution of Office macros that perform environment checks for security software, specifically looking for process-creation events linked to Microsoft Office applications.