# SilkParasite: China-Nexus Cyber Espionage Campaign Targeting Central Asian Governments

> Bitdefender Labs discovered SilkParasite, a China-nexus cyberespionage campaign targeting government bodies across Central Asia, including Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, Georgia, and Kazakhstan. The operation deploys seven RAT families (five previously undocumented) via spear-phishing emails with malicious Office documents, using DLL sideloading as the primary execution mechanism. The most widely deployed strain, DriveSilkRAT, uses shared Google Drive folders as a living-off-trusted-services (LOTS) C2 channel to evade detection. The malware shows evidence of AI-assisted development, including hardcoded placeholder encryption keys and leftover test functions in deployed binaries, marking a notable case of a China-nexus APT using AI to accelerate malware engineering.

- **Published:** 2026-08-20T00:00:00Z
- **Last reviewed:** 2026-08-20T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2090
- **ID:** TL-2026-2090
- **Severity:** CRITICAL
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** SneakyChef (China)
- **Detections:** 9 · **IOCs:** 47 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Bitdefender Labs uncovered the SilkParasite operation in late 2025 after detecting a suspicious infection at a Central Asian government body involved in economic decision-making. The campaign, which had been running for nearly one year as of August 2026, targets government institutions across six Central Asian countries: Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, Georgia, and Kazakhstan. The targeting profile focuses on the economic arms of governments, consistent with China's strategic economic interests in the region as Russia's influence declines.

Attack Chain: Initial access is achieved through spear-phishing emails delivering malicious Microsoft Office documents packaged inside password-protected RAR archives. The password is supplied in the email body to evade email-gateway scanning and automated sandbox inspection. Upon opening the document, a macro executes that checks for the presence of Kaspersky's avp.exe process and adapts behavior accordingly. The macro drops a legitimate signed application paired with a malicious DLL, triggering a DLL sideloading chain that deploys the first-stage payload.

Seven RAT Families: The operation deploys seven distinct remote access trojan families, five of which were previously undocumented and named by Bitdefender. DriveSilkRAT (.NET and C++) is the most widely deployed, with approximately 65 infection instances observed. It uses Google Drive as a C2 channel, polling a shared folder for tasking and executing in-memory .NET plugins, with 12 recovered plugins including process listing, system enumeration, file management, and WMI-based command execution. SpiceRAT (C/C++, previously documented by Cisco Talos in June 2024 under the SneakyChef attribution) uses HTTP C2 hosted on M247 infrastructure with DLL plugins reflectively loaded. It achieves persistence via a scheduled task that relaunches every 2 minutes and copies itself to C:\ProgramData\USOShared\Logs\. CookiETagRAT (C++, previously undocumented) uses HTTP Cookie and ETag response headers as a covert C2 channel, with each host deriving its own ChaCha20 key and nonce from a unique system identifier. BloodAlchemy (C/C++, known in the ShadowPad and Deed RAT lineage, first documented by Elastic Security Labs in October 2023) supports TCP, HTTP/S, DNS, and SMB C2 protocols, employs the HalosGate syscall-evasion technique, and uses hardware breakpoints combined with vectored exception handlers. It embeds three plugins: impapi (token impersonation), cliplogger, and keylogger. NomadRAT (C++, previously undocumented) uses HTTPS C2 with a three-part architecture of main orchestrator, dedicated transmitter library, and plugins fetched by numeric module ID. GoginRAT (Go, previously undocumented) shares the same architectural design as NomadRAT, uses HTTP C2, and lazy-loads filesystem and shell plugins from bundled encrypted modules with concurrent goroutines for independent operator sessions. NodeEdgeRAT (JavaScript/Node.js, previously undocumented) is a monolithic script bundling command execution, file management, and file transfer, with a bundled Node.js runtime, using a C2 domain impersonating the Kyrgyz hoster.kg provider.

C2 Infrastructure: The campaign demonstrates sophisticated C2 diversity. DriveSilkRAT's use of Google Drive as a command channel represents a living-off-trusted-services (LOTS) approach that blends malicious traffic with legitimate Google Drive traffic, evading network monitoring. CookiETagRAT hides commands in HTTP Cookie and ETag headers, mimicking cache validation traffic. Traditional C2 infrastructure includes IPs tied to China Unicom's backbone network and M247 hosting. The HTTP C2 channels use encrypted communications: ChaCha20 per-host keys in CookiETagRAT, RC4 in SpiceRAT, and hash-based encryption in NomadRAT.

AI-Assisted Development Evidence: Bitdefender assesses at medium confidence that AI tools were used to accelerate development. Evidence includes: leftover Go test functions in deployed GoginRAT binaries, a hardcoded AES key of 0123456789abcdef (a sequential placeholder), NodeEdgeRAT's encryption key config field set to the literal change_this_key, and the architectural similarity between NomadRAT (C++) and GoginRAT (Go) suggesting dual-language implementation via AI-assisted workflows. Additionally, two recovered phishing lures were AI-generated: a fake regional energy-cooperation platform and a fake advertisement for GPU cloud-computing capacity. Bitdefender characterizes the campaign as primarily AI-assisted, where capable humans engineer and lean on AI to move faster, rather than fully AI-generated malware.

Attribution: Bitdefender assesses the activity cluster as China-nexus with medium confidence. Cisco Talos publicly linked SpiceRAT to SneakyChef, a China-based espionage group active since August 2023 targeting ministries of foreign affairs and embassies across nine countries. Infrastructure IPs are tied to China Unicom's backbone network. BloodAlchemy sits in the ShadowPad and Deed RAT malware lineage, a China-nexus development family. The targeting profile of economic government bodies in Central Asia fits China-nexus intelligence collection priorities. Bitdefender designates the activity cluster as SilkParasite rather than attributing it to a single named group.

## MITRE ATT&CK

- T1566 Phishing
- T1059 Command and Scripting Interpreter
- T1053 Scheduled Task/Job
- T1543 Create or Modify System Process
- T1547 Boot or Logon Autostart Execution
- T1574 Hijack Execution Flow
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1497 Virtualization/Sandbox Evasion
- T1055 Process Injection
- T1202 Indirect Command Execution
- T1003 OS Credential Dumping
- T1056 Input Capture
- T1082 System Information Discovery
- T1057 Process Discovery
- T1518 Software Discovery
- T1560 Archive Collected Data
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1485 Data Destruction

## Sources

- [SilkParasite: Tracking a China-Nexus APT Across Central Asia](https://www.bitdefender.com/en-us/blog/businessinsights/silkparasite-tracking-china-nexus-apt-across-central-asia)
- [China-linked hackers targeted Central Asian governments with AI-assisted malware, researchers say](https://therecord.media/china-cyber-espionage-central-asia)
- [SilkParasite Espionage Campaign Targets Central Asian Governments](https://thehackernews.com/2026/08/silkparasite-espionage-campaign-targets.html)
- [SilkParasite Threatens Central Asian Orgs with Flurry of RATs](https://www.darkreading.com/threat-intelligence/silkparasite-central-asian-orgs-flurry-rats)
- [SilkParasite Bitdefender IOC Repository](https://github.com/bitdefender/malware-ioc/blob/master/2026_08-silkparasite-iocs.csv)
- [Unveiling SpiceRAT: SneakyChef's latest tool targeting EMEA and Asia](https://blog.talosintelligence.com/new-spicerat-sneakychef/)
- [SneakyChef espionage group targets government agencies with SugarGh0st RAT](https://blog.talosintelligence.com/sneakychef-sugargh0st-rat/)
- [Disclosing the BLOODALCHEMY backdoor](https://www.elastic.co/security-labs/disclosing-the-bloodalchemy-backdoor)
- [Introducing the REF5961 intrusion set](https://www.elastic.co/security-labs/introducing-the-ref5961-intrusion-set)
- [Malware Transmutation! - Unveiling Hidden Traces of BloodAlchemy (ShadowPad/Deed RAT lineage)](https://blog-en.itochuci.co.jp/entry/2024/05/23/090000)
- [China-Linked APT Uses AI to Optimize Hand-Built Malware](https://www.govinfosecurity.com/china-linked-apt-uses-ai-to-optimize-hand-built-malware-a-32597)
- [Chinese Hackers Deploy SpiceRAT and SugarGh0st RAT in Global Espionage Campaign](https://thehackernews.com/2024/06/chinese-hackers-deploy-spicerat-and.html)
- [SilkParasite Bitdefender Full Research Report (PDF)](https://github.com/bitdefender/malware-ioc/blob/master/silkparasite-2026_08/silkparasite-bitdefender-labs-research.pdf)
- [Stealthy BLOODALCHEMY Malware Targeting ASEAN Government Networks](https://thehackernews.com/2024/05/japanese-experts-warn-of-bloodalchemy.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2090