Government networks in Central Asia have been hit by two custom-built backdoors that give intruders deep control over infected computers.
Known as OctLurk and SilkLurk, the tools can record keystrokes, collect browser passwords, steal email, and run commands remotely.
The campaign has been active since January 2025 and has affected organizations in Afghanistan, Kazakhstan, Kyrgyzstan, Tajikistan, Uzbekistan, and Syria.
Victims include ministries, law enforcement agencies, healthcare bodies, research institutions, logistics organizations, schools, and urban planning offices.
Securelist said in a report shared with Cyber Security News (CSN) that both malware families are used by the same likely Chinese-speaking threat actor, although the operation has not been tied to a known group.
The intrusion shows how a determined espionage team can turn one compromised machine into a doorway to a wider government network.
The attackers used stolen administrator credentials, scheduled tasks, malicious services, and additional tools to maintain access and gather sensitive information.
New Backdoors Let Hackers Keylog, Steal Passwords
OctLurk is built to stay hidden while giving its operators a wide range of options after a system is breached.
Its loader is customized for each victim and uses machine-specific information to unlock the final payload, which makes automated analysis and detection harder.
Once active, OctLurk can pull additional plugins directly into memory instead of relying on many visible files.
Those plugins let attackers browse and copy files, open command shells, capture screenshots, read clipboard contents, scan networks, and simulate keyboard and mouse actions.
The operators also used a keylogger and a browser password recovery utility to capture credentials from compromised systems.
The keylogger saved keystrokes and clipboard data locally, while the browser tool targeted stored sign-in data from Chrome and Firefox.
This combination creates a serious risk for public-sector organizations because a single employee account can lead to more valuable systems.
The attackers also used a password-dumping tool against domain controllers, seeking credentials that could help them move across the network.
Their use of scheduled tasks is especially concerning because the tasks ran with high-level system privileges and were named to look ordinary.
Similar scheduled task persistence techniques are widely used to help attackers keep access after a restart or an initial cleanup effort.
OctLurk also supported a proxy component that could relay traffic through a compromised device.
That capability can help operators reach internal systems that are not directly exposed to the internet, reducing the chance that their activity is immediately noticed.
SilkLurk Expands Espionage
SilkLurk uses a different loading method, hiding behind legitimate-looking Windows programs and malicious DLL files.
It verifies the host program, decrypts its payload using the victim computer name, injects it into memory, and creates a service to remain active.
After gaining access, the attackers used SilkLurk to search shared network drives for confidential documents.
They then compressed collected files with archiving utilities, a common step before data is moved out of an organization.
The campaign also deployed PlugX, a long-running remote-access trojan associated with several Chinese-linked operations.
Readers tracking related activity can review Chinese APT PlugX campaigns, which illustrate how modular backdoors can support espionage through file theft, screenshots, keystroke capture, and remote commands.
Government defenders should review administrator account use, investigate unfamiliar services and scheduled tasks, and monitor for unusual access to domain controllers, browser credential stores, and shared drives.
Teams should also check endpoint and network telemetry for the indicators below, rotate exposed credentials, and isolate affected hosts during incident response.
The campaign underlines the value of watching behavior rather than depending only on file-based detection.
Organizations that regularly review task creation, service installation, remote logons, and suspicious internal scanning have a better chance of finding an intrusion before it becomes a broader compromise.
Indicators of Compromise (IoCs):-
| Type | Indicator | Description |
|---|---|---|
| Domain | dns.ssentialserv[.]xyz | LurkProxy command-and-control domain |
| IP address | 154.196.162[.]76 | LurkProxy command-and-control server |
| Domain | dns.multitoconference[.]com | OctLurk command-and-control domain |
| Domain | gycudore.kozow[.]com | PlugX command-and-control domain |
| Domain | ctyuhjerf.kozow[.]com | SilkLurk command-and-control domain |
| IP address | 64.7.198[.]130 | PlugX command-and-control address |
| MD5 | 6ecf84fb18f6747ed08d7598364d853a | OctLurk deployment batch script |
| MD5 | 082d49ef9f14e6811d68c7e0e82e5069 | OctLurk loader DLL |
| MD5 | b874123a80fc4f40e06872b9cb54ebc6 | LurkProxy deployment batch script |
| MD5 | 45cf5916fab4272a1313c26e67aa9220 | Victim-fingerprinting batch script |
| MD5 | 4e6d5c4770d5a822d7fcce6a74f7ad73 | Victim-fingerprinting batch script |
| MD5 | 32a5985543433a4f60da2fafd873b927 | Credential-dumping executable |
| MD5 | 2a571f6cee42a17d873f4c942649813f | Keylogger executable |
| MD5 | 37dc84e4bcad92fa28f1e7778d088283 | Browser password decryptor |
| MD5 | 5e26df131ff0a679a0a2699b723b46e3 | Remote-control agent deployment script |
| MD5 | cf903e4a1629aa0582fd0363b5786676 | Fscan network-scanning tool |
| MD5 | 3c9a1ba8e0c7475706adc6376e9d7b7c | PlugX dropper |
| MD5 | 62944e26b36b1dcace429ae26ba66164 | PlugX sideloaded executable |
| MD5 | ef59aad625eebda8650aec5820d6ce69 | PlugX loader DLL |
| MD5 | be4731c09734da2e8eb6814a9c82f266 | SilkLurk loader DLL |
| MD5 | 7c2f64461bb519c6cbf1fc687675514c | OctLurk loader DLL |
| MD5 | f4578e869a735cfad691f927bae3e638 | OctLurk loader DLL |
| MD5 | 2f18472866f38c1e1c2c5c14b9a6ab56 | SilkLurk loader DLL |
| Filename | oleasapi.dll | OctLurk loader DLL |
| Filename | msbasesysdc.dll | LurkProxy loader DLL |
| Filename | Adobe.exe | Credential-dumping utility |
| Filename | OneDrive.dat | SilkLurk payload file |
| Filename | nvml.dll | SilkLurk loader DLL |
| Filename | vulkan-1.dll | SilkLurk loader DLL |
| Filename | RtkSmbusLoc.dll | SilkLurk loader DLL |
| Filename | RtkNGUI64Loc.dll | SilkLurk loader DLL |
| Filename | C.dll | PlugX loader DLL |
| Filename | C.dll.res | PlugX payload file |
| Filename | GoogleUpDate | Malicious scheduled task name |
| Filename | AnyDesk | Keylogger scheduled task name |
| Filename | NgcCIntSvc | OctLurk malicious service |
| Filename | Cusrxsrv | LurkProxy malicious service |
| Filename | RmSs | SilkLurk persistence service |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
