Threat reportMalwareTL-2026-1786
OctLurk/SilkLurk Backdoors Target Central Asian Government Networks for Keylogging and Credential Theft
OctLurk/SilkLurk Backdoors Target Central Asian Government (TL-2026-1786), also tracked as KG_MFA (PlugX campaign identifier observed in this activity), is a high-severity malware campaign, first published 2026-07-31. It is linked to a China-nexus actor with medium confidence, affects Microsoft Windows workstations, servers, and Active Directory domain, maps to 31 MITRE ATT&CK techniques (T1003.003, T1005, T1018), and is covered by 9 detection rules and 39 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 31MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 39Indicators of compromise
Key facts for TL-2026-1786
- Threat ID
- TL-2026-1786
- Also known as
- KG_MFA (PlugX campaign identifier observed in this activity)
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- MEDIUM
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- government administration, police - law enforcement, health, research, logistics, education, urban planning, facilities management, foreign affairs
- Target regions
- 143 - Central Asia, South Asia, Middle East
- Detection rules
- 9
- Indicators of compromise
- 39
Malware and tooling in OctLurk/SilkLurk Backdoors Target Central Asian Government
Malware and tooling: Fscan, Impacket secretsdump
How OctLurk/SilkLurk Backdoors Target Central Asian Government works
A likely Chinese-speaking threat actor has deployed custom backdoors OctLurk, SilkLurk, and the LurkProxy relay component (alongside PlugX) against government, law enforcement, healthcare, research, logistics, and education organizations across Afghanistan, Kazakhstan, Kyrgyzstan, Tajikistan, Uzbekistan, and Syria since January 2025. The malware performs keylogging, clipboard capture, browser credential theft, and domain-controller password dumping to enable lateral movement and data exfiltration.
OctLurk and SilkLurk are two custom, primarily in-memory backdoors first documented by Kaspersky's GReAT team on Securelist in a cyber-espionage campaign active since at least January 2025 against government and critical-sector organizations across Central Asia (Afghanistan, Kazakhstan, Kyrgyzstan, Tajikistan, Uzbekistan) and Syria. Kaspersky assesses with medium confidence that a single, unattributed Chinese-speaking threat actor operates both malware families; some victims infected with SilkLurk were also found running OctLurk, and overlapping staging directories (C:\ProgramData\intel\) link the two toolsets together.
Initial access is achieved using stolen administrator credentials, which the operator uses to create a scheduled task (GoogleUpDate) that runs a batch script installing a Windows service (NgcCIntSvc) that loads the OctLurk loader DLL (oleasapi.dll). SilkLurk instead relies on DLL side-loading through legitimate signed binaries (NetSetSvc.exe, nvgwls.exe, RtkSmbus.exe, RtkNGUI64.exe) paired with a malicious service (RmSs). Both loaders decrypt their payloads using victim-specific values — the C: drive serial number for OctLurk, a hash of the computer name for SilkLurk — so sandboxes cannot decrypt or execute the backdoor outside the intended host. Both backdoors run reflectively injected in memory and download plugins from the C2 to perform file management, command-shell execution, screen capture, clipboard monitoring, keyboard/mouse simulation, and network scanning.
A related component, LurkProxy, shares OctLurk's architecture but functions purely as a SOCKS5/transparent network relay (listening on TCP/64980), letting the operator route additional intrusion tooling through compromised hosts. The actor also deploys the well-known Chinese-linked PlugX RAT (via a dropper masquerading as kmsonline.exe, injected into svchost.exe, campaign ID KG_MFA) alongside a credential-dumping toolkit — Impacket secretsdump run against domain controllers, a browser-credential-recovery utility targeting Chrome and Firefox, a custom keylogger, and the Fscan network scanner used to brute-force SSH and MySQL services for lateral movement. Post-compromise, operators harvest email over IMAP, enumerate SMB shares, and stage stolen documents with WinRAR/7-Zip prior to exfiltration, while also deploying the Pandora FMS remote-access agent for persistent control.
Kaspersky further notes that OctLurk and LurkProxy C2 infrastructure overlaps with 'TrustFall' — a Linux-targeting RAT (also tracked as MystRodX by Qianxin and SilentRaid by Cisco Talos) that Kazakhstan's State Technical Service reported against national critical infrastructure in March 2025, with additional TrustFall C2 servers discovered in October 2025 — suggesting the same infrastructure, and possibly the same operator, supports parallel Windows- and Linux-targeting campaigns.
The TrustFall/MystRodX/SilentRaid lineage that Kaspersky ties to OctLurk/LurkProxy predates the January 2025 Central Asia campaign by over a year. QiAnXin XLab's September 2025 technical analysis of MystRodX found sample activation timestamps as early as 7 January 2024, and Palo Alto Networks Unit 42 had separately documented what it assesses to be an earlier iteration of the same tool — dubbed 'ChronosRAT' — inside intrusion cluster CL-STA-0969, active against Southwest/Southeast Asian telecom networks between February and November 2024. On 8 January 2026, Cisco Talos published its own attribution of the SilentRaid backdoor to a distinct China-nexus actor it tracks as UAT-7290, assessed active since at least 2022 against South Asian telecom infrastructure (with recent expansion into Southeastern Europe), and found tooling/infrastructure overlaps with Red Foxtrot, APT10/MenuPass (via RedLeaves), and ShadowPad. Kaspersky's linkage is limited to C2 infrastructure overlap between OctLurk/LurkProxy and TrustFall — it does not itself confirm UAT-7290 as the OctLurk/SilkLurk operator — but it places the shared infrastructure inside a persistent, multi-year China-nexus espionage effort rather than a standalone Central Asia campaign.
MITRE ATT&CK techniques used in TL-2026-1786
Credential Access
T1003.003 NTDS; T1056.001 Keylogging; T1110 Brute Force; T1555.003 Credentials from Web Browsers
Collection
T1005 Data from Local System; T1113 Screen Capture; T1114 Email Collection; T1115 Clipboard Data; T1560.001 Archive via Utility
Discovery
T1018 Remote System Discovery; T1049 System Network Connections Discovery; T1082 System Information Discovery; T1135 Network Share Discovery; T1518.001 Security Software Discovery
Exfiltration
T1020 Automated Exfiltration; T1041 Exfiltration Over C2 Channel
Lateral Movement
T1021.002 SMB/Windows Admin Shares
Defense Evasion
T1027 Obfuscated Files or Information; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information
Persistence
T1053.005 Scheduled Task; T1543.003 Windows Service
Privilege Escalation
Execution
T1059.003 Windows Command Shell
Command and Control
T1071.001 Web Protocols; T1090.002 External Proxy; T1132.002 Non-Standard Encoding; T1219 Remote Access Tools; T1573.001 Symmetric Cryptography
Initial Access
stealth
defense-impairment
Affected products and versions in OctLurk/SilkLurk Backdoors Target Central Asian Government
- Microsoft — Windows workstations, servers, and Active Directory domain controllers
Vulnerable versions: All supported Windows versions reachable via stolen administrator credentials or DLL side-loading — this is a credential-abuse/malware campaign, not a version-specific vulnerability
Remediation for OctLurk/SilkLurk Backdoors Target Central Asian Government
Immediate actions
- Block and monitor the listed OctLurk, SilkLurk, LurkProxy, and PlugX C2 domains and IPs at the network perimeter and DNS resolver
- Hunt for the named scheduled tasks (GoogleUpDate, AnyDesk) and services (NgcCIntSvc, RmSs, SymantecRAS, Cusrxsrv, specitsrc, cmtastsvc, PNRPHostSvc, vmictimerosync, vmicagent) across the Windows fleet
- Rotate and audit domain administrator credentials; review recent scheduled-task and service-creation events tied to those accounts
- Alert on outbound TCP/64980 connections and SOCKS5/HTTP CONNECT proxy setup consistent with LurkProxy
Workarounds
- Disable or tightly restrict legitimate remote-access tools (AnyDesk, Pandora FMS) where not business-required, and monitor their installation
- Review and lock down Windows Defender exclusion lists and tamper-protection settings for unauthorized changes
Longer-term hardening
- Deploy application allow-listing / code-integrity controls to prevent DLL side-loading via legitimate signed binaries
- Deploy EDR with behavioral detection for reflective DLL injection and in-memory-only backdoor execution
- Restrict and monitor administrative credential usage for remote task/service creation with a tiered, least-privilege admin model
- Harden domain controllers against Impacket secretsdump-style credential dumping (LSASS protection, Credential Guard, NTDS.dit access auditing)
Timeline of OctLurk/SilkLurk Backdoors Target Central Asian Government
- Cisco Talos later assesses that UAT-7290 — the China-nexus actor it attributes the SilentRaid backdoor (aka MystRodX, aka TrustFall) to, whose C2 infrastructure Kaspersky finds overlapping with OctLurk/LurkProxy — has been active since at least 2022, predating the Central Asia campaign by roughly three years (exact 2022 date not specified by Talos).
- The earliest activation timestamp recovered from a MystRodX/TrustFall sample is set to 7 January 2024 23:10:20, per QiAnXin XLab's later analysis — indicating the Linux RAT infrastructure that Kaspersky links to OctLurk/LurkProxy had been operating in target networks for over 20 months before public disclosure.
- Palo Alto Networks Unit 42 later documents intrusion cluster CL-STA-0969 as active against Southwest/Southeast Asian telecom networks from February through November 2024, using the ELF tool 'ChronosRAT' subsequently identified as an earlier iteration of MystRodX/TrustFall.
- Kaspersky Securelist assesses the OctLurk/SilkLurk campaign as active from on or after January 2025, targeting government and critical-sector organizations in Central Asia and Syria.
- Kazakhstan's State Technical Service publicly reports the 'TrustFall' Linux RAT (also tracked as MystRodX/SilentRaid) targeting national critical infrastructure; Kaspersky later finds its C2 servers overlap with OctLurk/LurkProxy infrastructure.
- Palo Alto Networks Unit 42 publishes 'The Covert Operator's Playbook,' publicly documenting CL-STA-0969 and the ChronosRAT tool later tied to the MystRodX/TrustFall lineage that overlaps with OctLurk/LurkProxy infrastructure.
- QiAnXin XLab publishes detailed technical analysis of MystRodX (aka TrustFall, aka SilentRaid), the DNS/ICMP-triggered dual-mode Linux backdoor whose C2 infrastructure Kaspersky subsequently finds overlapping with OctLurk and LurkProxy.
- Kazakhstan STS researchers discover additional TrustFall C2 servers via active probing, further corroborating infrastructure sharing between the Windows-targeting (OctLurk/SilkLurk) and Linux-targeting (TrustFall) campaigns.
- Cisco Talos publishes attribution research on UAT-7290, assessing with high confidence a China-nexus actor active since at least 2022 whose arsenal includes SilentRaid (aka MystRodX/TrustFall) alongside RushDrop and DriveSwitch, with infrastructure/tooling overlaps to Red Foxtrot, APT10/MenuPass (via RedLeaves), and ShadowPad.
- Kaspersky publishes the Securelist report 'OctLurk and SilkLurk: new Backdoors in Central Asia', detailing the backdoors, the LurkProxy relay, PlugX deployment, IOCs, and a medium-confidence Chinese-speaking attribution.
- Threat ingested into the TL-Intel Harness hunt backlog via RSS monitoring of Cyber Security News.
- Cyber Security News publishes coverage summarizing the Kaspersky findings ('New Backdoors Let Hackers Keylog, Steal Passwords and Control Government Computers').
Sources cited for OctLurk/SilkLurk Backdoors Target Central Asian Government
- New Backdoors Let Hackers Keylog, Steal Passwords and Control Government Computers
- OctLurk and SilkLurk: new Backdoors in Central Asia
- Kaspersky discovers OctLurk and SilkLurk, newly identified tailored backdoors in cyber-espionage campaign in Central Asia
- Researchers Warn of MystRodX Backdoor Using DNS and ICMP Triggers for Stealthy Control
- MystRodX: The Covert Dual-Mode Backdoor Threat
- The Covert Operator's Playbook: Infiltration of Global Telecom Networks (CL-STA-0969 / ChronosRAT)
- UAT-7290 targets high value telecommunications infrastructure in South Asia
- PlugX: A Talisman to Behold
Detection coverage for TL-2026-1786
As of 2026-07-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1786 across Splunk SPL, Microsoft KQL and Sigma, covering 39 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1786
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.