Full Report
A previously unreported cyber espionage operation dubbed SilkParasite has been observed targeting government bodies in Central Asia. The intrusion set makes use of seven remote access tool (RAT) families, five of which have never been previously documented: DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, and NodeEdgeRAT. SilkParasite, first discovered in late 2025, is assessed to be a
Analysis Summary
# Threat Actor: SilkParasite
## Attribution & Identity
* **Actor Identification:** SilkParasite is a China-nexus threat cluster first discovered in late 2025.
* **Confidence Level:** Medium confidence attribution to China-nexus.
* **Associated Groups/Links:**
* Linked to **REF5961** and **SneakyChef** via shared tooling (BLOODALCHEMY and SpiceRAT).
* Associated with the lineage of **ShadowPad** and **PlugX**, which are historically used by Chinese APT groups.
## Activity Summary
The actor has been observed conducting a large-scale cyber espionage operation targeting government bodies in Central Asia. The campaign is notable for the use of seven different RAT families (five previously undocumented) and the integration of AI-assisted development processes. The activity highlights a sophisticated, modular approach to maintaining long-term access to high-value government targets.
## Tactics, Techniques & Procedures
* **Initial Access:** Spear-phishing emails containing password-protected RAR archives.
* **Execution:** Malicious Microsoft Office documents using macros to trigger infections.
* **Defense Evasion:**
* **DLL Sideloading:** Primary delivery vector for payloads.
* **Environment Checking:** Macros check for the presence of Kaspersky antivirus before executing to avoid detection.
* **AI-Assisted Development:** Used to streamline professional espionage tooling and create convincing phishing lures.
* **Modular Architecture:** Use of a plugin-oriented system to expand capabilities without replacing core malware.
* **Persistence:** Use of legitimate binaries to sideload malicious DLLs.
* **MITRE ATT&CK IDs (Inferred):**
* T1566.001 (Phishing: Spearphishing Attachment)
* T1574.002 (Hijack Execution Flow: DLL Side-Loading)
* T1059.005 (Command and Scripting Interpreter: Visual Basic)
* T1497.001 (Virtualization/Sandbox Evasion: System Checks)
## Targeting
* **Sectors:** Government entities and specific ministries.
* **Geography:** Central Asia (Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, and Kazakhstan) and the Caucasus (Georgia).
* **Victims:** Specific government bodies and ministries within the aforementioned regions.
## Tools & Infrastructure
* **New Malware Families:**
* DriveSilkRAT
* CookiETagRAT
* NomadRAT
* GoginRAT
* NodeEdgeRAT
* **Known/Updated Malware:**
* **BLOODALCHEMY:** A C-based backdoor (successor to Deed RAT and ShadowPad).
* **SpiceRAT:** Updated version equipped to run arbitrary commands.
* **Programming Languages:** .NET, C++, Go, and JavaScript.
## Implications
SilkParasite represents a modern evolution of Chinese espionage tactics, characterized by the adoption of AI to increase operational efficiency and the deployment of a highly diverse, modular toolset. The focus on Central Asian governments suggests a strategic interest in regional political and security intelligence. The actor’s ability to develop five new RAT families simultaneously indicates significant resources and technical maturity.
## Mitigations
* **Disable Macros:** Restrict or disable Microsoft Office macros via Group Policy across government networks.
* **DLL Sideloading Protection:** Monitor for unusual DLL loads by legitimate applications and implement application whitelisting.
* **Email Security:** Enhance phishing protections to flag password-protected archives and implement robust "sandboxing" for attachments.
* **Antivirus Integrity:** Ensure security software (like Kaspersky) is configured to protect its own processes from being tampered with or bypassed by malware-driven environment checks.
* **Threat Hunting:** Scan for indicators of the BLOODALCHEMY and SpiceRAT families, particularly within government-adjacent infrastructure.