SilkParasite Cyber Espionage Campaign Targets Central Asian Governments
Cybersecurity researchers have uncovered a previously undocumented cyber espionage operation dubbed SilkParasite, targeting government organizations across Central Asia.
The campaign, first identified in late 2025, has been assessed by Bitdefender Labs with medium confidence as being linked to a China-nexus threat cluster.
SilkParasite stands out for its extensive use of remote access trojans (RATs), including five previously undocumented malware families: DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, and NodeEdgeRAT.
Researchers also identified two previously known malware families, BLOODALCHEMY and an updated version of SpiceRAT, within the campaign.
SilkParasite Uses Seven RAT Families
According to Bitdefender, SilkParasite uses a modular malware arsenal developed using four programming languages: .NET, C++, Go, and JavaScript.
The malware families are designed with plugin based architectures, allowing attackers to selectively deploy capabilities depending on the targeted environment.
The seven identified implants include:
- DriveSilkRAT: A .NET and C++ RAT that uses Google Drive as its command and control channel. It can execute tasks through an in-memory plugin system and supports plugins for process discovery, system and network enumeration, file management, and command execution.
- CookiETagRAT: A C++ based RAT that uses HTTP Cookie and ETag response headers to receive commands from its operators.
- NomadRAT: A C++ implant consisting of a central orchestrator, a dedicated C2 communication component, and plugins that are downloaded only when required.
- GoginRAT: A Go based RAT with a modular architecture similar to NomadRAT. It separates C2 communications from capabilities such as file system access and shell execution.
- NodeEdgeRAT: A JavaScript based implant containing functionality for command execution, file management, and file transfers.
- BLOODALCHEMY: A C based backdoor associated with a broader malware lineage connected to Deed RAT and ShadowPad.
- SpiceRAT: An existing RAT that can download and execute files and arbitrary commands.
Bitdefender observed approximately 65 systems infected with DriveSilkRAT, with most infections located in Asia.
Spear-Phishing Starts the Attack
The attacks begin with password-protected RAR archives containing malicious Microsoft Office documents.
The password required to open the archive is included in the phishing email.
When the victim opens the document, a macro triggers a DLL sideloading sequence that launches the first-stage malware.
The phishing documents were specifically tailored for government organizations in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, and Kazakhstan.
Researchers also recovered a document targeting a Georgian government organization.
Attackers Check for Kaspersky Antivirus
One notable feature of the campaign is that the malicious macro checks whether Kaspersky antivirus software is installed and running before continuing with execution.
Bitdefender believes this behavior is likely intended to help the attackers avoid detection in environments where Kaspersky products are widely deployed.
This indicates that the threat actors are actively adapting their delivery process to the security software commonly used by their targets.
DLL Sideloading Remains a Key Technique
DLL sideloading is one of the most consistent techniques observed throughout the SilkParasite campaign.
The attackers use legitimate, digitally signed applications together with malicious DLL files placed in locations where the legitimate executable expects to find them.
When the signed application launches, it loads the malicious library and executes the attacker's code.
Bitdefender said the strongest detection signal is therefore not necessarily the name of the DLL, but the combination of a legitimate signed application loading a nearby malicious library while running from an unusual location.
Google Drive Used for Command and Control
DriveSilkRAT uses Google Drive as its command and control infrastructure.
The malware periodically checks a specific Google Drive folder for instructions, executes the received tasks through its plugin system, and uploads the results back to the same location.
The technique allows attackers to blend malicious communications into legitimate cloud service traffic.
Its plugin framework supports capabilities including:
- Process enumeration
- System information collection
- Network discovery
- File management
- Command execution
The modular design allows operators to add or change capabilities without replacing the underlying malware.
Possible Signs of AI-Assisted Development
Bitdefender researchers identified several characteristics suggesting that AI may have been used to assist with parts of the malware development process.
The researchers emphasized that the malware does not appear to be entirely AI-generated.
Instead, the implants display characteristics of professional espionage tooling developed by experienced human operators, with AI potentially being used to accelerate coding and development.
For example, GoginRAT contains Go test functions and uses a hard-coded AES key set to "0123456789abcdef".
NodeEdgeRAT contains an encryption configuration field using the literal value "change_this_key."
Researchers also observed similarities between the architectures of NomadRAT and GoginRAT, despite the two implants being written in different programming languages.
Bitdefender said these similarities could indicate that the same high-level design was implemented multiple times with assistance from AI-based development workflows.
China Nexus Suspected
Several elements of the campaign point toward a possible Chinese connection.
One major clue is the deployment of BLOODALCHEMY, an updated version of Deed RAT.
Deed RAT is itself considered a successor to ShadowPad, while ShadowPad evolved from the PlugX malware family.
Both ShadowPad and PlugX have been widely associated with Chinese state-linked threat groups.
The campaign also uses an updated version of SpiceRAT, which has previously been associated with a Chinese-speaking threat actor known as SneakyChef.
However, Bitdefender assessed the China nexus with medium confidence, meaning the available evidence does not establish attribution with high certainty.
Plugin Architecture Makes Detection More Difficult
Almost every malware family used by SilkParasite follows a plugin-oriented design.
This gives attackers several advantages.
They can selectively deploy capabilities based on the target environment, keep the initial payload relatively small, and add functionality without replacing the core implant.
It also reduces the amount of malicious code that must initially be exposed to security tools.
Bitdefender warned that traditional signature based detection may therefore be less effective against these implants.
Instead, defenders should monitor unusual relationships between legitimate processes, DLL files, network connections, cloud services, and execution locations.
Organizations Should Monitor DLL Sideloading
Bitdefender identified DLL sideloading as one of the most reliable detection opportunities associated with SilkParasite.
Security teams should investigate cases where:
- A legitimate signed executable runs from an unusual directory
- The executable loads a DLL from the same unexpected location
- A trusted application establishes unusual external communications
- Cloud storage services are used for suspicious command and control activity
- Office documents launch unexpected DLL or executable activity
- Malware attempts to detect installed security software
The SilkParasite campaign demonstrates how advanced espionage groups are combining established techniques such as spear-phishing and DLL sideloading with cloud based C2 and highly modular malware.
