# OctLurk/SilkLurk Backdoors Target Central Asian Government Networks for Keylogging and Credential Theft

> A likely Chinese-speaking threat actor has deployed custom backdoors OctLurk, SilkLurk, and the LurkProxy relay component (alongside PlugX) against government, law enforcement, healthcare, research, logistics, and education organizations across Afghanistan, Kazakhstan, Kyrgyzstan, Tajikistan, Uzbekistan, and Syria since January 2025. The malware performs keylogging, clipboard capture, browser credential theft, and domain-controller password dumping to enable lateral movement and data exfiltration.

- **Published:** 2026-07-31T00:00:00Z
- **Last reviewed:** 2026-07-31T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1786
- **ID:** TL-2026-1786
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 39 (full data via the Threadlinqs MCP server — Purple tier)

## Description

OctLurk and SilkLurk are two custom, primarily in-memory backdoors first documented by Kaspersky's GReAT team on Securelist in a cyber-espionage campaign active since at least January 2025 against government and critical-sector organizations across Central Asia (Afghanistan, Kazakhstan, Kyrgyzstan, Tajikistan, Uzbekistan) and Syria. Kaspersky assesses with medium confidence that a single, unattributed Chinese-speaking threat actor operates both malware families; some victims infected with SilkLurk were also found running OctLurk, and overlapping staging directories (C:\ProgramData\intel\) link the two toolsets together.

Initial access is achieved using stolen administrator credentials, which the operator uses to create a scheduled task (GoogleUpDate) that runs a batch script installing a Windows service (NgcCIntSvc) that loads the OctLurk loader DLL (oleasapi.dll). SilkLurk instead relies on DLL side-loading through legitimate signed binaries (NetSetSvc.exe, nvgwls.exe, RtkSmbus.exe, RtkNGUI64.exe) paired with a malicious service (RmSs). Both loaders decrypt their payloads using victim-specific values — the C: drive serial number for OctLurk, a hash of the computer name for SilkLurk — so sandboxes cannot decrypt or execute the backdoor outside the intended host. Both backdoors run reflectively injected in memory and download plugins from the C2 to perform file management, command-shell execution, screen capture, clipboard monitoring, keyboard/mouse simulation, and network scanning.

A related component, LurkProxy, shares OctLurk's architecture but functions purely as a SOCKS5/transparent network relay (listening on TCP/64980), letting the operator route additional intrusion tooling through compromised hosts. The actor also deploys the well-known Chinese-linked PlugX RAT (via a dropper masquerading as kmsonline.exe, injected into svchost.exe, campaign ID KG_MFA) alongside a credential-dumping toolkit — Impacket secretsdump run against domain controllers, a browser-credential-recovery utility targeting Chrome and Firefox, a custom keylogger, and the Fscan network scanner used to brute-force SSH and MySQL services for lateral movement. Post-compromise, operators harvest email over IMAP, enumerate SMB shares, and stage stolen documents with WinRAR/7-Zip prior to exfiltration, while also deploying the Pandora FMS remote-access agent for persistent control.

Kaspersky further notes that OctLurk and LurkProxy C2 infrastructure overlaps with 'TrustFall' — a Linux-targeting RAT (also tracked as MystRodX by Qianxin and SilentRaid by Cisco Talos) that Kazakhstan's State Technical Service reported against national critical infrastructure in March 2025, with additional TrustFall C2 servers discovered in October 2025 — suggesting the same infrastructure, and possibly the same operator, supports parallel Windows- and Linux-targeting campaigns.

The TrustFall/MystRodX/SilentRaid lineage that Kaspersky ties to OctLurk/LurkProxy predates the January 2025 Central Asia campaign by over a year. QiAnXin XLab's September 2025 technical analysis of MystRodX found sample activation timestamps as early as 7 January 2024, and Palo Alto Networks Unit 42 had separately documented what it assesses to be an earlier iteration of the same tool — dubbed 'ChronosRAT' — inside intrusion cluster CL-STA-0969, active against Southwest/Southeast Asian telecom networks between February and November 2024. On 8 January 2026, Cisco Talos published its own attribution of the SilentRaid backdoor to a distinct China-nexus actor it tracks as UAT-7290, assessed active since at least 2022 against South Asian telecom infrastructure (with recent expansion into Southeastern Europe), and found tooling/infrastructure overlaps with Red Foxtrot, APT10/MenuPass (via RedLeaves), and ShadowPad. Kaspersky's linkage is limited to C2 infrastructure overlap between OctLurk/LurkProxy and TrustFall — it does not itself confirm UAT-7290 as the OctLurk/SilkLurk operator — but it places the shared infrastructure inside a persistent, multi-year China-nexus espionage effort rather than a standalone Central Asia campaign.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1059.003 Windows Command Shell
- T1053.005 Scheduled Task
- T1543.003 Windows Service
- T1574.001 DLL
- T1055 Process Injection
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1685 Disable or Modify Tools
- T1055 Process Injection
- T1003.003 NTDS
- T1555.003 Credentials from Web Browsers
- T1056.001 Keylogging
- T1110 Brute Force
- T1082 System Information Discovery
- T1018 Remote System Discovery
- T1049 System Network Connections Discovery
- T1135 Network Share Discovery
- T1518.001 Security Software Discovery
- T1021.002 SMB/Windows Admin Shares
- T1113 Screen Capture
- T1115 Clipboard Data
- T1114 Email Collection
- T1005 Data from Local System
- T1560.001 Archive via Utility
- T1071.001 Web Protocols
- T1090.002 External Proxy
- T1573.001 Symmetric Cryptography
- T1132.002 Non-Standard Encoding
- T1219 Remote Access Tools
- T1041 Exfiltration Over C2 Channel
- T1020 Automated Exfiltration

## Sources

- [New Backdoors Let Hackers Keylog, Steal Passwords and Control Government Computers](https://cybersecuritynews.com/new-backdoors-let-hackers-keylog/)
- [OctLurk and SilkLurk: new Backdoors in Central Asia](https://securelist.com/octlurk-silklurk-backdoors-central-asia/120840/)
- [Kaspersky discovers OctLurk and SilkLurk, newly identified tailored backdoors in cyber-espionage campaign in Central Asia](https://malwaretips.com/threads/kaspersky-discovers-octlurk-and-silklurk-newly-identified-tailored-backdoors-in-cyber-espionage-campaign-in-central-asia.142566/)
- [Researchers Warn of MystRodX Backdoor Using DNS and ICMP Triggers for Stealthy Control](https://thehackernews.com/2025/09/researchers-warn-of-mystrodx-backdoor.html)
- [MystRodX: The Covert Dual-Mode Backdoor Threat](https://blog.xlab.qianxin.com/mystrodx_covert_dual-mode_backdoor_en/)
- [The Covert Operator's Playbook: Infiltration of Global Telecom Networks (CL-STA-0969 / ChronosRAT)](https://unit42.paloaltonetworks.com/infiltration-of-global-telecom-networks/)
- [UAT-7290 targets high value telecommunications infrastructure in South Asia](https://blog.talosintelligence.com/uat-7290/)
- [PlugX: A Talisman to Behold](https://trellix.com/en-us/about/newsroom/stories/threat-labs/plugx-a-talisman-to-behold.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1786