# SilkParasite: China-Nexus APT Campaign Using 7 Malware Families Across Central Asia

> Bitdefender tracks SilkParasite, a China-nexus cyberespionage campaign (medium confidence) targeting Central Asian government bodies involved in economic decision-making. Active since at least early 2025 and discovered via a late-2025 infection at a Central Asian government body, the operation deploys 7 distinct malware families — including 5 newly identified (DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, NodeEdgeRAT) — delivered via spear-phishing with password-protected RAR archives and DLL sideloading across 6 different signed-legitimate-application pairs. C2 spans living-off-trusted-services (Google Drive), HTTP header steganography (Cookie/ETag), and traditional HTTPS. The campaign reflects an organized, well-resourced operator ecosystem with evidence of AI-assisted development acceleration, and represents the third in a Bitdefender-observed arc of China-related cyber operations in Central Asia following UAC-0063/TAG-110 and FamousSparrow.

- **Published:** 2026-08-19T00:00:00Z
- **Last reviewed:** 2026-08-19T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2068
- **ID:** TL-2026-2068
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** SilkParasite (China)
- **Detections:** 9 · **IOCs:** 34 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Bitdefender Labs researchers Marius Baciu, Gheorghe Schipor, and Victor Vrabie published the SilkParasite campaign analysis on August 19, 2026, documenting a China-nexus espionage operation (medium confidence) targeting government bodies across five Central Asian states — Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, and Kazakhstan — plus Georgia. The operation was discovered following a single infection at a Central Asian government body around October 2025, triggering months of forensic investigation and threat hunting that revealed the campaign had been running for roughly the better part of a year (since approximately early 2025).

SilkParasite is distinguished by its deployment of seven distinct malware families across four programming languages (C/C++, Go, JavaScript/Node.js, and .NET/C#), forming one of the most diverse tool arsenals observed in a single espionage campaign. Families range from sophisticated, multi-plugin RATs like DriveSilkRAT (Google Drive-based C2) and BloodAlchemy (ShadowPad/Deed RAT lineage with HalosGate syscall evasion) to specialized implants like CookiETagRAT (command delivery via HTTP Cookie and ETag headers with per-host ChaCha20 encryption) and GoginRAT (Go-based with dual-goroutine independent shells). The malware is delivered through spear-phishing emails containing password-protected RAR archives (password supplied in email body to bypass gateway sandboxes), with malicious Office documents executing macros that deploy a DLL sideloading chain using legitimate signed applications.

DLL sideloading is the campaign's primary execution mechanism, with six confirmed signed-legitimate-application pairs: Calibre's ebook-edit.exe loading calibre-launcher.dll (tracked as HelpLoader), ABBYY FineReader.exe loading dsp_ippv2_x64.dll (BloodAlchemy), Quick Heal's emlproui.exe loading scansts.dll (NomadRAT), Windows Defender's MpDefenderCoreService.exe loading mpclient.dll (DriveSilkRAT C++ variant), Mp3tag.exe loading tak_deco_lib.dll (CookiETagRAT), and an unknown .NET utility (likely mscorsvw.exe) loading mscorsvc.dll (GoginRAT). Each sideloading host is a legitimate signed application, making detection based on hash or signature alone ineffective.

Command and control demonstrates deliberate diversity and a preference for blending into trusted services. DriveSilkRAT uses Google Drive shared folders (Living Off Trusted Services/LOTS) — operators drop command files, the host polls, fetches in-memory .NET plugins, and uploads results. CookiETagRAT embeds C2 commands in HTTP Cookie and ETag headers with per-host ChaCha20 encryption keyed to a system identifier plus fixed suffix, so traffic from one victim cannot decrypt another's. BloodAlchemy operates across TCP, HTTP/S, DNS, and SMB. Operators were active in UTC+8 timezone (derived from 37 Google Drive command timestamps).

Attribution rests on medium-confidence evidence: tooling lineage linking SpiceRAT to Cisco Talos's SneakyChef (China-nexus cluster); BloodAlchemy's shared data structures with Deed RAT (ShadowPad lineage, the latter being FamousSparrow's primary backdoor, which Bitdefender tied to an Azerbaijani oil/gas campaign in May 2026); several C2 IPs traced to China Unicom's backbone; and victimology consistent with Chinese strategic intelligence priorities in Central Asia. Bitdefender does not pin the activity to a single named group, instead designating it as the SilkParasite activity cluster — reflecting the observation that tooling, techniques, and infrastructure circulate across otherwise distinct China-nexus groups.

Geopolitically, SilkParasite forms the third data point in a Bitdefender-observed arc: UAC-0063/TAG-110 (February 2025, targeting Central Asian and European diplomatic/government bodies), FamousSparrow (May 2026, targeting Azerbaijani oil and gas), and now SilkParasite (August 2026, Central Asian economic-policy government bodies). Bitdefender contextualizes this with Russia's declining influence in Central Asia since the 2022 Ukraine invasion, a vacuum China has been filling economically — and intelligence gathering follows.

The campaign also provides one of the most documented real-world cases of AI-assisted malware development. Evidence includes leftover Go test functions in deployed GoginRAT binaries, a hardcoded placeholder AES key (0123456789abcdef), literal change_this_key in NodeEdgeRAT configuration, shared near-identical architecture between NomadRAT (C++) and GoginRAT (Go) suggesting cross-language AI translation, and recurring debugging-symbol paths in DriveSilkRAT builds. Bitdefender assesses that capable humans do the engineering and lean on AI to move faster, leaving behind tells but none of the quality degradation that would indicate fully AI-generated malware.

## MITRE ATT&CK

- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1047 Windows Management Instrumentation
- T1203 Exploitation for Client Execution
- T1053 Scheduled Task/Job
- T1574 Hijack Execution Flow
- T1027 Obfuscated Files or Information
- T1685 Disable or Modify Tools
- T1055 Process Injection
- T1620 Reflective Code Loading
- T1564 Hide Artifacts
- T1098 Account Manipulation
- T1082 System Information Discovery
- T1057 Process Discovery
- T1049 System Network Connections Discovery
- T1056 Input Capture
- T1071 Application Layer Protocol
- T1001 Data Obfuscation
- T1573 Encrypted Channel
- T1537 Transfer Data to Cloud Account
- T1583 Acquire Infrastructure
- T1588 Obtain Capabilities

## Sources

- [Bitdefender: SilkParasite — Tracking a China-nexus APT across Central Asia](https://www.bitdefender.com/en-us/blog/businessinsights/silkparasite-tracking-china-nexus-apt-across-central-asia)
- [Bitdefender GitHub — SilkParasite IOC Repository](https://github.com/bitdefender/malware-ioc/blob/master/2026_08-silkparasite-iocs.csv)
- [Bitdefender GitHub — SilkParasite Full Research PDF](https://github.com/bitdefender/malware-ioc/blob/master/silkparasite-2026_08/silkparasite-bitdefender-labs-research.pdf)
- [Cisco Talos — New SpiceRAT malware and SneakyChef espionage campaign](https://blog.talosintelligence.com/new-spicerat-sneakychef/)
- [Cisco Talos — SneakyChef/SpiceRAT IOCs](https://github.com/Cisco-Talos/IOCs/blob/main/2024/06/new-spicerat-sneakychef.txt)
- [Trend Micro — Earth Estries: China-linked espionage across telecom and government](https://www.trendmicro.com/en/research/24/k/earth-estries.html)
- [Darktrace — Unpacking SnappyBee (Deed RAT)](https://www.darktrace.com/blog/darktrace-malware-analysis-unpacking-snappybee)
- [DeepSec 2024 — The Malicious Bloodline Inheritance (Deed RAT/BloodAlchemy)](https://blog.deepsec.net/deepsec-2024-talk-the-malicious-bloodline-inheritance-dissecting-deed-rat-and-blood-alchemy/)
- [Bitdefender — FamousSparrow APT Targets Azerbaijani Oil & Gas](https://businessinsights.bitdefender.com/famoussparrow-apt-targets-azerbaijani-oil-gas-industry)
- [Bitdefender — UAC-0063 / TAG-110: Pro-Ukraine Hacktivists or Russian Espionage?](https://www.bitdefender.com/en-us/blog/businessinsights/tag-110-apt-targeting-central-asia-europe)
- [ITOCNU — BloodAlchemy Loader Analysis](https://blogs.itochu.co.jp/)
- [Dark Reading — China FamousSparrow APT Hits South Caucasus Energy Firm](https://www.darkreading.com/cyberattacks-data-breaches/china-famoussparrow-apt-south-caucasus-energy-firm)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2068