SilkParasite: China-Nexus Cyber Espionage Campaign Targeting Central Asian Governments
SilkParasite (TL-2026-2090), also tracked as SilkParasite, is a critical-severity advanced persistent threat campaign, first published 2026-08-20. It is attributed to SneakyChef (China) with medium confidence, affects Calibre Calibre E-book Management, maps to 20 MITRE ATT&CK techniques (T1003, T1027, T1036), and is covered by 9 detection rules and 47 indicators of compromise.
Key facts for TL-2026-2090
- Threat ID
- TL-2026-2090
- Also known as
- SilkParasite
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- APT
- First published
- 2026-08-20
- Last reviewed
- 2026-08-20
- Attribution
- SneakyChef
- Attribution confidence
- MEDIUM
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- government administration, finance, energy
- Target regions
- 143 - Central Asia, uzbekistan, turkmenistan, kyrgyzstan, tajikistan, kazakhstan, georgia
- Detection rules
- 9
- Indicators of compromise
- 47
Malware and tooling in SilkParasite
Malware and tooling: BloodAlchemy, CookiETagRAT, DriveSilkRAT, GoginRAT, NodeEdgeRAT, NomadRAT, SpiceRAT
Bitdefender Labs discovered SilkParasite, a China-nexus cyberespionage campaign targeting government bodies across Central Asia, including Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, Georgia, and Kazakhstan. The operation deploys seven RAT families (five previously undocumented) via spear-phishing emails with malicious Office documents, using DLL sideloading as the primary execution mechanism. The most widely deployed strain, DriveSilkRAT, uses shared Google Drive folders as a living-off-trusted-services (LOTS) C2 channel to evade detection. The malware shows evidence of AI-assisted development, including hardcoded placeholder encryption keys and leftover test functions in deployed binaries, marking a notable case of a China-nexus APT using AI to accelerate malware engineering.
How SilkParasite works
Bitdefender Labs uncovered the SilkParasite operation in late 2025 after detecting a suspicious infection at a Central Asian government body involved in economic decision-making. The campaign, which had been running for nearly one year as of August 2026, targets government institutions across six Central Asian countries: Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, Georgia, and Kazakhstan. The targeting profile focuses on the economic arms of governments, consistent with China's strategic economic interests in the region as Russia's influence declines.
Attack Chain: Initial access is achieved through spear-phishing emails delivering malicious Microsoft Office documents packaged inside password-protected RAR archives. The password is supplied in the email body to evade email-gateway scanning and automated sandbox inspection. Upon opening the document, a macro executes that checks for the presence of Kaspersky's avp.exe process and adapts behavior accordingly. The macro drops a legitimate signed application paired with a malicious DLL, triggering a DLL sideloading chain that deploys the first-stage payload.
Seven RAT Families: The operation deploys seven distinct remote access trojan families, five of which were previously undocumented and named by Bitdefender. DriveSilkRAT (.NET and C++) is the most widely deployed, with approximately 65 infection instances observed. It uses Google Drive as a C2 channel, polling a shared folder for tasking and executing in-memory .NET plugins, with 12 recovered plugins including process listing, system enumeration, file management, and WMI-based command execution. SpiceRAT (C/C++, previously documented by Cisco Talos in June 2024 under the SneakyChef attribution) uses HTTP C2 hosted on M247 infrastructure with DLL plugins reflectively loaded. It achieves persistence via a scheduled task that relaunches every 2 minutes and copies itself to C:\ProgramData\USOShared\Logs\. CookiETagRAT (C++, previously undocumented) uses HTTP Cookie and ETag response headers as a covert C2 channel, with each host deriving its own ChaCha20 key and nonce from a unique system identifier. BloodAlchemy (C/C++, known in the ShadowPad and Deed RAT lineage, first documented by Elastic Security Labs in October 2023) supports TCP, HTTP/S, DNS, and SMB C2 protocols, employs the HalosGate syscall-evasion technique, and uses hardware breakpoints combined with vectored exception handlers. It embeds three plugins: impapi (token impersonation), cliplogger, and keylogger. NomadRAT (C++, previously undocumented) uses HTTPS C2 with a three-part architecture of main orchestrator, dedicated transmitter library, and plugins fetched by numeric module ID. GoginRAT (Go, previously undocumented) shares the same architectural design as NomadRAT, uses HTTP C2, and lazy-loads filesystem and shell plugins from bundled encrypted modules with concurrent goroutines for independent operator sessions. NodeEdgeRAT (JavaScript/Node.js, previously undocumented) is a monolithic script bundling command execution, file management, and file transfer, with a bundled Node.js runtime, using a C2 domain impersonating the Kyrgyz hoster.kg provider.
C2 Infrastructure: The campaign demonstrates sophisticated C2 diversity. DriveSilkRAT's use of Google Drive as a command channel represents a living-off-trusted-services (LOTS) approach that blends malicious traffic with legitimate Google Drive traffic, evading network monitoring. CookiETagRAT hides commands in HTTP Cookie and ETag headers, mimicking cache validation traffic. Traditional C2 infrastructure includes IPs tied to China Unicom's backbone network and M247 hosting. The HTTP C2 channels use encrypted communications: ChaCha20 per-host keys in CookiETagRAT, RC4 in SpiceRAT, and hash-based encryption in NomadRAT.
AI-Assisted Development Evidence: Bitdefender assesses at medium confidence that AI tools were used to accelerate development. Evidence includes: leftover Go test functions in deployed GoginRAT binaries, a hardcoded AES key of 0123456789abcdef (a sequential placeholder), NodeEdgeRAT's encryption key config field set to the literal change_this_key, and the architectural similarity between NomadRAT (C++) and GoginRAT (Go) suggesting dual-language implementation via AI-assisted workflows. Additionally, two recovered phishing lures were AI-generated: a fake regional energy-cooperation platform and a fake advertisement for GPU cloud-computing capacity. Bitdefender characterizes the campaign as primarily AI-assisted, where capable humans engineer and lean on AI to move faster, rather than fully AI-generated malware.
Attribution: Bitdefender assesses the activity cluster as China-nexus with medium confidence. Cisco Talos publicly linked SpiceRAT to SneakyChef, a China-based espionage group active since August 2023 targeting ministries of foreign affairs and embassies across nine countries. Infrastructure IPs are tied to China Unicom's backbone network. BloodAlchemy sits in the ShadowPad and Deed RAT malware lineage, a China-nexus development family. The targeting profile of economic government bodies in Central Asia fits China-nexus intelligence collection priorities. Bitdefender designates the activity cluster as SilkParasite rather than attributing it to a single named group.
MITRE ATT&CK techniques used in TL-2026-2090
Credential Access
T1003 OS Credential Dumping; T1056 Input Capture
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1202 Indirect Command Execution; T1497 Virtualization/Sandbox Evasion; T1574 Hijack Execution Flow
Persistence
T1053 Scheduled Task/Job; T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution
Discovery
T1057 Process Discovery; T1082 System Information Discovery; T1518 Software Discovery
Execution
T1059 Command and Scripting Interpreter
Command and Control
T1071 Application Layer Protocol; T1573 Encrypted Channel
Impact
Collection
Initial Access
Affected products and versions in SilkParasite
- Calibre — Calibre E-book Management
Vulnerable versions: All versions when paired with malicious calibre-launcher.dll - ABBYY — ABBYY FineReader
Vulnerable versions: All versions when paired with malicious dsp_ippv2_x64.dll - Quick Heal Technologies — Quick Heal AntiVirus (emlproui.exe)
Vulnerable versions: All versions when paired with malicious scansts.dll - Microsoft — Windows Defender (MpDefenderCoreService.exe)
Vulnerable versions: All versions when paired with malicious mpclient.dll - Florian Heidenreich — Mp3tag
Vulnerable versions: All versions when paired with malicious tak_deco_lib.dll - Samsung Electronics — Samsung RunHelp
Vulnerable versions: All versions when paired with malicious ssMUIDLL.dll - Brother Industries — Brother BrDifxapi
Vulnerable versions: All versions when paired with malicious BrLogAPI.dll
Remediation for SilkParasite
Immediate actions
- Block C2 IP ranges: 45.153.125.0/24, 193.29.56.0/24, 2.58.15.0/24, 194.68.44.0/24, 91.132.94.0/24, 195.88.191.0/24, 185.26.236.0/24, 217.9.250.0/24
- Block C2 domains: evo.hoster-kg.com, it.hpsupporter.com, mineconom.tdtu.org, info.ktnet.org, manager.skycom.support, infrastructure.minings.blog
- Block C2 URLs associated with SpiceRAT /PSearch and /Search paths
- Block Google Drive API access from non-whitelisted Google Workspace accounts on managed endpoints
- Deploy YARA rules for all seven RAT families from Bitdefender's GitHub IOC repository
- Monitor for DLL sideloading events: suspicious pairing of legitimate signed executables with unsigned DLLs from non-standard paths
Workarounds
- Restrict outbound Google Drive API access to managed Google Workspace accounts only
- Enable ASR rules to block DLL sideloading via Office and other productivity applications
- Deploy application whitelisting for critical systems to prevent execution of unsigned binaries
- Monitor and restrict scheduled task creation from non-administrative contexts
Longer-term hardening
- Implement behavioral baselines to flag unusual process-to-network-service relationships, particularly Google Drive API access from non-browser processes
- Deploy EDR with DLL sideloading detection rules for known abused executables: Calibre ebook-edit.exe, ABBYY FineReader.exe, Quick Heal emlproui.exe, Mp3tag.exe, Windows Defender MpDefenderCoreService.exe
- Monitor for scheduled tasks with names mimicking Microsoft Edge update tasks (SysEdgeUpdateTaskMachineCore) or containing 'Kovid Goyal EBook Task'
- Implement network monitoring for HTTP responses with anomalous Cookie and ETag header sizes, indicating CookiETagRAT C2
- Deploy application control policies restricting execution of unsigned binaries in user-writable paths
- Monitor for WMI-based command execution as an alternative to cmd.exe, indicating DriveSilkRAT activity
- Implement detection for ChaCha20 encrypted traffic patterns on non-standard HTTP channels
- Conduct user awareness training on password-protected archive phishing tactics and AI-generated lure content
Timeline of SilkParasite
- ShadowPad first reported in the NetSarang supply chain attack, establishing the malware lineage that would later include BloodAlchemy via Deed RAT
- SneakyChef threat actor first observed by Cisco Talos, targeting Ministries of Foreign Affairs and embassies across nine countries with SugarGh0st RAT
- Elastic Security Labs publishes analysis of the BLOODALCHEMY backdoor as part of the REF5961 intrusion set, targeting the Ministry of Foreign Affairs of an ASEAN member state
- ITOCHU Cyber & Intelligence publishes analysis linking BloodAlchemy to Deed RAT, establishing it as the evolved successor in the ShadowPad malware lineage
- Cisco Talos publishes analysis of SpiceRAT, a new remote access trojan attributed to the Chinese-speaking threat actor SneakyChef, targeting government agencies in EMEA and Asia
- SilkParasite campaign infections begin, approximately one year before public disclosure. Bitdefender detects first infection at a Central Asian government economic body, initiating investigation
- Bitdefender Labs publishes the SilkParasite research report detailing seven RAT families, five previously undocumented, targeting government bodies across six Central Asian countries
Sources cited for SilkParasite
- SilkParasite: Tracking a China-Nexus APT Across Central Asia
- China-linked hackers targeted Central Asian governments with AI-assisted malware, researchers say
- SilkParasite Espionage Campaign Targets Central Asian Governments
- SilkParasite Threatens Central Asian Orgs with Flurry of RATs
- SilkParasite Bitdefender IOC Repository
- Unveiling SpiceRAT: SneakyChef's latest tool targeting EMEA and Asia
- SneakyChef espionage group targets government agencies with SugarGh0st RAT
- Disclosing the BLOODALCHEMY backdoor
- Introducing the REF5961 intrusion set
- Malware Transmutation! - Unveiling Hidden Traces of BloodAlchemy (ShadowPad/Deed RAT lineage)
- China-Linked APT Uses AI to Optimize Hand-Built Malware
- Chinese Hackers Deploy SpiceRAT and SugarGh0st RAT in Global Espionage Campaign
- SilkParasite Bitdefender Full Research Report (PDF)
- Stealthy BLOODALCHEMY Malware Targeting ASEAN Government Networks
Threats related to SilkParasite
Detection coverage for TL-2026-2090
As of 2026-08-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2090 across Splunk SPL, Microsoft KQL and Sigma, covering 47 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.