A Chinese language-speaking menace actor is suspected to be behind a contemporary wave of cyber assaults focusing on authorities organizations primarily positioned in Central Asia, together with Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and the Syrian Arab Republic, since January 2025.
These focused organizations function throughout a number of sectors, corresponding to healthcare, analysis, authorities places of work, ministries of international affairs, logistics, law-enforcement businesses, city planning and amenities administration, and public academic institutions, per Kaspersky. The exercise has not been linked to any identified adversary or group.
The assaults are characterised by way of two new obfuscated backdoors the Russian cybersecurity firm is monitoring as OctLurk and SilkLurk, in addition to a specialised utility codenamed LurkProxy to proxy community visitors.
“OctLurk and SilkLurk can obtain and inject extra plugins to carry out additional malicious actions, together with launching command shells, performing file system exercise, synthesizing keyboard and mouse occasions, community scanning, credential dumping, keylogging, password theft from browsers, e mail assortment, and distant entry,” researchers Saurabh Sharma and Yaroslav Kikel mentioned.
The preliminary entry vector utilized in these assaults is presently unknown. Nevertheless, Kaspersky evaluation has discovered that OctLurk is injected into reminiscence and deployed by way of a loader, with the attackers additionally checking web connectivity to the area “dns.ssentialserv[.]xyz” earlier than executing a batch script chargeable for launching LurkProxy. The instrument then establishes contact with a distant server (“154.196.162[.]76”) for command-and-control (C2).
As soon as run, OctoLurk first collects system data, encrypts it, and sends it to a hard-coded C2 server (“dns.multitoconference[.]com”) over a stream socket connection. It is outfitted to load plugins acquired from the server immediately into reminiscence to allow command execution, file operations, clipboard content material gathering and modification, screenshot seize, and mouse actions.
The menace actors have been discovered to leverage the backdoor’s command shell plugin to carry out the next sequence of actions –
- Fingerprint the host and harvest in depth information in regards to the compromised system.
- Run instructions to export profitable logon occasions for distant interactive logons and to question these occasions for particular customers.
- Harvest password hashes from area controllers utilizing Impacket’s “secretsdump.py” instrument.
- Drop and execute a keylogger that masquerades as AnyDesk to sidestep detection.
- Decrypt and extract passwords from Google Chrome and Mozilla Firefox.
- Set up distant entry to the sufferer machine utilizing Pandora RC agent.
- Scan inner and public networks utilizing Fscan to establish companies working on particular ports, corresponding to Safe Shell (SSH) on port 22 and MySQL on port 3306, after which try and entry these companies utilizing credentials from a password file named “pp.txt.”
- Hook up with an e mail server, authenticate with a username and password, and subject instructions to gather or manipulate emails.
LurkProxy, for its half, can perform as a reverse proxy in two distinct modes, both as a SOCKS5 proxy or a clear proxy. At any given time, the malware can function in just one mode to route community visitors by means of a goal handle.
The third instrument within the menace actor’s arsenal is SilkLurk, which is launched by way of a DLL that, in flip, is executed utilizing a DLL side-loading sequence. The backdoor then creates a TCP socket and connects to a C2 server laid out in its configuration, adopted by accumulating sufferer data and transmitting it to the server.
In response, the server sends a command that is to be executed on the contaminated endpoint. This may contain getting the system’s native time, setting a sleep interval that determines the frequency at which the backdoor polls the C2 server, sending or updating backdoor configuration, and receiving and injecting extra plugins into reminiscence.
The post-compromise exercise linked to SilkLurk is under –
- Invoke “cmd.exe” to launch PowerShell and run instructions to hook up with shared community assets with administrative credentials, search and stage confidential paperwork, disconnect from the community shares, and use official archiving instruments like WinRAR and 7-Zip to archive the stolen information.
- Run “cmd.exe” to provoke a DLL side-loading chain to drop PlugX, a identified backdoor utilized by Chinese language hacking teams.
Kaspersky mentioned it discovered infrastructure overlaps between the marketing campaign and a previous set of assaults involving a C++-based implant codenamed SilentRaid (aka MystRodX and TrustFall).
“This overlap factors to shared infrastructure throughout a number of OS-targeting campaigns, although it stays unclear whether or not these actions ran concurrently or at completely different instances,” Kaspersky mentioned. “The emergence of the OctLurk and SilkLurk multi-plugin malware framework highlights how menace actors repeatedly refine their techniques to evade detection and preserve management over compromised networks.”
“Each households function primarily in reminiscence, leaving solely a minimalistic loader on disk that depends on machine-specific information (OctLurk makes use of the drive serial quantity, and SilkLurk makes use of the pc title) to decode payload areas and contents. This victim-specific encoding makes reverse engineering and automatic detection significantly tougher.”
