Threat reportMalwareTL-2026-1783
OctLurk and SilkLurk Backdoors: Unattributed Chinese-Speaking Actor Cyberespionage Campaign Targeting Central Asian Government and Critical Infrastructure
OctLurk and SilkLurk Backdoors (TL-2026-1783), also tracked as OctLurk/SilkLurk Central Asia Campaign, is a high-severity malware campaign, first published 2026-07-31. It is linked to a China-nexus actor with medium confidence, affects Microsoft Windows (endpoint and server, unspecified versions), maps to 57 MITRE ATT&CK techniques (T1001, T1003, T1005), and is covered by 9 detection rules and 73 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 57MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 73Indicators of compromise
Key facts for TL-2026-1783
- Threat ID
- TL-2026-1783
- Also known as
- OctLurk/SilkLurk Central Asia Campaign, KG_MFA Campaign (PlugX)
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- MEDIUM
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- government administration, ministries-of-foreign-affairs, police - law enforcement, health, research-institutions, logistics, urban-planning-facilities-management, public-education, critical-infrastructure
- Target regions
- 143 - Central Asia, afghanistan, kyrgyzstan, tajikistan, uzbekistan, kazakhstan, syria
- Detection rules
- 9
- Indicators of compromise
- 73
Malware and tooling in OctLurk and SilkLurk Backdoors
Malware and tooling: DriveSwitch, LurkProxy, OctLurk, PlugX, RushDrop, SilkLurk, TrustFall/MystRodX/SilentRaid, FSCAN, Impacket secretsdump, Pandora FMS RC agent
How OctLurk and SilkLurk Backdoors works
Since January 2025, an unattributed Chinese-speaking threat actor has deployed the memory-resident OctLurk and SilkLurk backdoors — alongside the LurkProxy network proxy tool and the TrustFall/MystRodX/SilentRaid Linux implant — against government, law-enforcement, healthcare, and critical-infrastructure organizations across Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and Syria. Kaspersky GReAT documented victim-specific loaders, DLL side-loading, multi-plugin frameworks, and PlugX deployment used to steal credentials, move laterally, and exfiltrate data.
OctLurk and SilkLurk are two related but distinct memory-resident backdoor families first documented in full by Kaspersky's Global Research and Analysis Team (GReAT) on 2026-07-30 (Securelist). Both are attributed with medium confidence to the same unnamed, Chinese-speaking threat cluster, active since at least January 2025 against government ministries (particularly foreign affairs), law enforcement, healthcare, research institutions, logistics, urban planning/facilities management, and public education organizations in Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and Syria.
OctLurk is delivered via a victim-specific loader (masquerading as files such as oleasapi.dll, msbasesysdc.dll, and mscastrac.dll, exporting Refresh/RegisterService) that is installed as the malicious Windows service NgcCIntSvc. The loader decrypts its payload with a double-XOR scheme — one hardcoded key plus a second key derived from the victim's C: drive serial number — followed by zlib decompression, then reflectively injects the backdoor into memory. OctLurk supports a plugin system (Command Shell, File Manager, and Interaction Manager for synthetic keyboard/mouse input and screen capture) and communicates over TLS/443 to a set of typosquatted C2 domains.
SilkLurk instead relies on classic DLL side-loading: legitimate signed binaries (NetSetSvc.exe, and Realtek/NVIDIA utilities such as nvgwls.exe, RtkSmbus.exe, RtkNGUI64.exe) load malicious companion DLLs (nvml.dll, vulkan-1.dll, RtkSmbusLoc.dll, RtkNGUI64Loc.dll) that decrypt an encrypted payload blob (e.g., OneDrive.dat) using a key derived from a 32-bit hash of the victim's hostname, then persist via the service name RmSs. SilkLurk's 0x4AC-byte configuration block carries up to four C2 host/port pairs plus proxy credentials, supports HTTP CONNECT proxying that mimics a Chrome/86 user agent, and can inject secondary payloads — including the modular PlugX RAT (service SymantecRAS, campaign ID KG_MFA, C2 gycudore[.]kozow[.]com / 64.7.198.130, injected into svchost.exe).
LurkProxy is a companion utility, architecturally derived from the OctLurk loader, that is not itself a backdoor but a reverse-proxy implant supporting two modes: a C2-mediated SOCKS5 reverse proxy and a transparent proxy with a fixed hardcoded backend, listening locally on port 64980 and using the same zlib + double-XOR protocol as OctLurk.
Post-compromise tradecraft is consistent across victims: a batch-script reconnaissance phase (in.bat / 1.bat / auto.bat) enumerates sessions, Kerberos tickets, processes, RDP logon events, network configuration, AV status, scheduled tasks, and hardware/BIOS data; credential theft follows via Impacket secretsdump disguised as Adobe.exe (LSASS/domain-controller hash extraction), an AnyDesk.exe-named keylogger, and a custom Chrome/Firefox password decryptor (64.exe); the FSCAN utility (fc.exe) then brute-forces and scans internal/public networks (SSH/22, MySQL/3306); lateral movement uses mounted administrative shares; and exfiltration stages sensitive documents into WinRAR/7-Zip archives moved off-network via PowerShell and net use. Kaspersky additionally observed deployment of a Pandora FMS remote-control agent for persistent remote access.
Infrastructure analysis found three C2 IP addresses shared between OctLurk/LurkProxy and the TrustFall Linux backdoor — also tracked as MystRodX (QiAnXin XLab) and SilentRaid (Cisco Talos) — which Kazakhstan's State Technical Service (STS) first publicly reported in March 2025 against Kazakh critical infrastructure, with additional TrustFall C2 servers identified via active probing in October 2025. Shared staging directories (C:\ProgramData\intel\) and identical post-compromise methodology across victims infected with both OctLurk and SilkLurk further support single-operator attribution. No CVE or software vulnerability is implicated; initial access appears credential- or phishing-driven rather than exploit-driven.
XLab's CTIA telemetry first flagged suspicious MystRodX activity via a dropped ELF binary (dst86.bin) fetched from 139.84.156.79 on 2025-06-06; configuration-timestamp analysis of recovered samples found an earliest activation timestamp of 2024-01-07T23:10:20Z, indicating the malware had operated undetected for roughly 20 months before discovery. XLab published its full technical analysis of MystRodX's DNS/ICMP passive wake-up trigger and dual-mode C2 design on 2025-08-27. Separately, on 2026-01-08 Cisco Talos published research tracking SilentRaid/MystRodX as the third-stage persistent implant — following the RushDrop dropper and DriveSwitch executor — used by China-nexus cluster UAT-7290 against telecommunications infrastructure in South Asia with recent expansion into Southeastern Europe; Talos assesses UAT-7290 shows victimology, infrastructure, and tooling overlap with Red Foxtrot, a cluster Recorded Future linked to PLA Unit 69010 in 2021. This UAT-7290/Red Foxtrot linkage applies to the TrustFall/MystRodX/SilentRaid malware family via C2 infrastructure overlap and does not itself confirm attribution for the OctLurk/SilkLurk operators, whom Kaspersky continues to assess only as an unattributed, medium-confidence Chinese-speaking cluster.
MITRE ATT&CK techniques used in TL-2026-1783
Command and Control
T1001 Data Obfuscation; T1008 Fallback Channels; T1071 Application Layer Protocol; T1090 Proxy; T1092 Communication Through Removable Media; T1095 Non-Application Layer Protocol; T1571 Non-Standard Port; T1573 Encrypted Channel
Credential Access
T1003 OS Credential Dumping; T1040 Network Sniffing; T1110 Brute Force; T1555 Credentials from Password Stores
Collection
T1005 Data from Local System; T1025 Data from Removable Media; T1056 Input Capture; T1074 Data Staged; T1113 Screen Capture; T1114 Email Collection; T1115 Clipboard Data; T1119 Automated Collection; T1123 Audio Capture; T1185 Browser Session Hijacking; T1560 Archive Collected Data
Discovery
T1007 System Service Discovery; T1010 Application Window Discovery; T1016 System Network Configuration Discovery; T1049 System Network Connections Discovery; T1082 System Information Discovery; T1087 Account Discovery; T1217 Browser Information Discovery; T1518 Software Discovery; T1526 Cloud Service Discovery; T1538 Cloud Service Dashboard; T1580 Cloud Infrastructure Discovery; T1614 System Location Discovery
Exfiltration
T1020 Automated Exfiltration; T1030 Data Transfer Size Limits; T1041 Exfiltration Over C2 Channel; T1048 Exfiltration Over Alternative Protocol
Lateral Movement
T1021 Remote Services; T1570 Lateral Tool Transfer
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1574 Hijack Execution Flow; T1620 Reflective Code Loading; T1622 Debugger Evasion
Persistence
T1053 Scheduled Task/Job; T1543 Create or Modify System Process; T1554 Compromise Host Software Binary
Execution
T1059 Command and Scripting Interpreter; T1106 Native API
defense-impairment
T1553 Subvert Trust Controls; T1685 Disable or Modify Tools
Initial Access
Affected products and versions in OctLurk and SilkLurk Backdoors
- Microsoft — Windows (endpoint and server, unspecified versions)
Vulnerable versions: Not vulnerability-based — targets standard Windows endpoints via social-engineering/credential-driven initial access - N/A (cross-platform) — Linux servers (TrustFall/MystRodX/SilentRaid implant)
Vulnerable versions: Not vulnerability-based — generic Linux server targeting
Remediation for OctLurk and SilkLurk Backdoors
Immediate actions
- Block all listed OctLurk, SilkLurk, LurkProxy, and PlugX C2 domains and IPs at DNS/perimeter/proxy layer
- Hunt for the malicious service names NgcCIntSvc, RmSs, and SymantecRAS across Windows estate
- Hunt for the file hashes and side-loaded DLL names (oleasapi.dll, vulkan-1.dll, nvml.dll, RtkSmbusLoc.dll, RtkNGUI64Loc.dll, RasTls.dll) against legitimate-binary allowlists
- Search for Adobe.exe, AnyDesk.exe, 64.exe, fc.exe, kmsonline.exe process execution outside their expected legitimate install paths
- Rotate credentials for any account with sessions observed on hosts exhibiting the in.bat/1.bat/auto.bat reconnaissance pattern
Workarounds
- Restrict or monitor scheduled-task creation and Windows service installation on internet-facing government/critical-infrastructure hosts
- Disable or tightly monitor local admin share (C$/ADMIN$) access from workstation-to-workstation, limiting it to IT management subnets
Longer-term hardening
- Deploy EDR with behavioral detection for reflective DLL injection, DLL side-loading of signed Realtek/NVIDIA utilities, and LSASS access
- Implement application allowlisting / code-signing enforcement to block unsigned or side-loaded companion DLLs next to signed binaries
- Monitor for anomalous use of administrative shares, WinRAR/7-Zip archive creation, and PowerShell-driven data staging
- Deploy network segmentation between government/critical-infrastructure OT-adjacent systems and general IT to limit FSCAN-style internal scanning and lateral movement
- Establish outbound TLS/443 traffic baselining to detect fixed-interval beaconing to unfamiliar domains
Timeline of OctLurk and SilkLurk Backdoors
- Configuration-timestamp analysis of recovered MystRodX samples shows an earliest activation timestamp of 2024-01-07T23:10:20Z, indicating the backdoor had operated undetected for roughly 20 months before its first public documentation (per QiAnXin XLab research).
- OctLurk and SilkLurk backdoor deployment begins against government and critical-infrastructure organizations across Central Asia and Syria, per Kaspersky GReAT telemetry.
- Kazakhstan's State Technical Service (STS) publicly reports the TrustFall (aka MystRodX/SilentRaid) Linux backdoor targeting critical infrastructure in Kazakhstan.
- QiAnXin XLab's CTIA telemetry system first detects suspicious MystRodX activity via a dropped ELF binary (dst86.bin) fetched from 139.84.156.79.
- Palo Alto Networks Unit 42 first documents the MystRodX backdoor under the name ChronosRAT, tracked as threat cluster CL-STA-0969, later shown by Kaspersky to share C2 infrastructure with OctLurk/LurkProxy.
- QiAnXin XLab publishes its full technical analysis of MystRodX ('The Covert Dual-Mode Backdoor Threat'), detailing its DNS/ICMP passive-activation trigger mechanism and dual-mode C2 design.
- The Hacker News publishes coverage of QiAnXin XLab's MystRodX research, broadening public disclosure of the DNS/ICMP passive-activation trigger mechanism.
- Kazakhstan STS researchers identify additional TrustFall C2 servers via active probing and uncover infrastructure overlap with OctLurk and LurkProxy C2 nodes.
- Cisco Talos publishes research on China-nexus cluster UAT-7290, documenting SilentRaid (aka MystRodX) as the third-stage persistent implant — following the RushDrop dropper and DriveSwitch executor — used against telecom infrastructure in South Asia with expansion into Southeastern Europe, and noting overlap with the Red Foxtrot cluster (linked to PLA Unit 69010).
- Kaspersky GReAT researchers Saurabh Sharma and Yaroslav Kikel publish the full OctLurk/SilkLurk technical analysis on Securelist, including IOCs and MITRE ATT&CK mapping.
- GBHackers publishes a summary article covering the Kaspersky OctLurk/SilkLurk research, which surfaced this hunt.
Sources cited for OctLurk and SilkLurk Backdoors
- OctLurk and SilkLurk Backdoors
- OctLurk and SilkLurk: new Backdoors in Central Asia
- Researchers Warn of MystRodX Backdoor Using DNS and ICMP Triggers for Stealthy Control
- Kaspersky discovers OctLurk and SilkLurk, newly identified tailored backdoors in cyber-espionage campaign in Central Asia
- Breaking News - Cyber Threats - 2026-07-30
- Kazakhstan State Technical Service Security Report (TrustFall critical-infrastructure targeting)
- MystRodX: The Covert Dual-Mode Backdoor Threat
- UAT-7290 targets high value telecommunications infrastructure in South Asia
Detection coverage for TL-2026-1783
As of 2026-07-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1783 across Splunk SPL, Microsoft KQL and Sigma, covering 73 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1783
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.