SilkParasite Infrastructure Links SpiceRAT, NodeEdgeRAT, and NomadRAT to Four-Year China-Nexus Campaign Against Central Asian Governments
SilkParasite Infrastructure Links SpiceRAT, NodeEdgeRAT, and (TL-2026-2554), also tracked as SilkParasite, is a high-severity advanced persistent threat campaign, first published 2026-09-17. It is linked to a China-nexus actor with medium confidence, affects Calibre Calibre ebook-edit.exe, maps to 17 MITRE ATT&CK techniques (T1027, T1036.005, T1047), and is covered by 9 detection rules and 30 indicators of compromise.
Key facts for TL-2026-2554
- Threat ID
- TL-2026-2554
- Also known as
- SilkParasite
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- 2026-09-17
- Last reviewed
- 2026-09-17
- Attribution confidence
- MEDIUM
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- government administration, energy, telecoms, critical infrastructure, transportation rail
- Target regions
- 143 - Central Asia, uzbekistan, turkmenistan, tajikistan, kyrgyzstan, kazakhstan
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in SilkParasite Infrastructure Links SpiceRAT, NodeEdgeRAT, and
Malware and tooling: BloodAlchemy, DriveSilkRAT, NodeEdgeRAT, NomadRAT, SpiceRAT
Hunt.io correlated shared TLS certificates, decoy web content, and passive-DNS registration patterns to tie SpiceRAT, NodeEdgeRAT, and NomadRAT to a single infrastructure cluster ("SilkParasite") active since mid-2022 against government ministries, railways, telecoms, and energy entities across five Central Asian nations. A TLS certificate impersonating Uzbekistan's railway authority, issued by a Chinese state-affiliated CA, anchors the cluster to a suspected China-nexus operator with tradecraft overlaps to SneakyChef, FamousSparrow, and IndigoZebra.
How SilkParasite Infrastructure Links SpiceRAT, NodeEdgeRAT, and works
Hunt.io researcher Guy Yasur used TLS certificate pivoting, cloned-webpage hash matching, and passive DNS to link infrastructure previously attributed to three separately tracked RAT families — SpiceRAT (Cisco Talos, tied to the SneakyChef actor), NodeEdgeRAT, and NomadRAT (both first documented by Bitdefender) — into a single four-year operation dubbed SilkParasite. The anchor artifact is a TLS certificate (CN azure.uzrailwaystax[.]com, issued by TLC DV TLS CA, valid 2025-12-23 to 2026-12-23) impersonating Uzbekistan's national railway authority; the issuing CA, TLC (泰尔认证中心有限公司), is wholly funded by CAICT under China's Ministry of Industry and Information Technology. Pivoting on that certificate and on a cloned RTX Corporation homepage (served as decoy content on port 80 across 13 servers) surfaced a domain cluster spoofing state railways, foreign ministries, national telecoms, and energy authorities across Uzbekistan, Turkmenistan, Tajikistan, Kyrgyzstan, and Kazakhstan, hosted through resellers CrownCloud, EDIS GmbH, and CloudBackbone on ASNs including AS199959, AS57169, AS48314, and AS9009 across Germany, the Netherlands, Bulgaria, and Estonia. The cluster also exposes RDP-over-TLS on non-standard high-numbered ports (64350, 64330, 65535, 65111, 61256), and shows registration-level infrastructure overlap with a prior Check Point-documented cluster, IndigoZebra (aka Speccom), that targeted the same governments as far back as 2021 using matching subdomain conventions (mail, service, help).
Bitdefender's companion research ("SilkParasite: Tracking a China-Nexus APT Across Central Asia," 19 Aug 2026) independently arrived at the same cluster from the malware side, documenting seven RAT families in active use — the previously known SpiceRAT and BloodAlchemy plus five newly identified families: NodeEdgeRAT (JavaScript/Node.js), NomadRAT (C++), DriveSilkRAT (.NET/C++), CookiETagRAT (C++), and GoginRAT (Go). Initial access is spear-phishing with password-protected RAR archives carrying region-tailored Office-macro lure documents (impersonating ministries in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, Kazakhstan, and Georgia); the delivery macro checks for Kaspersky's avp.exe before executing. Every family lands via DLL side-loading against signed, legitimate applications: Calibre (ebook-edit.exe → calibre-launcher.dll) for SpiceRAT, ABBYY FineReader (FineReader.exe → dsp_ippv2_x64.dll) for BloodAlchemy, Quick Heal (emlproui.exe → scansts.dll) for NomadRAT, a Windows Defender component (MpDefenderCoreService.exe → mpclient.dll) for the C++ DriveSilkRAT variant, and Mp3tag (Mp3tag.exe → tak_deco_lib.dll) for CookiETagRAT. Cisco Talos's earlier SpiceRAT/SneakyChef research (2024) documented a parallel loader chain abusing a Samsung-signed RunHelp.exe to side-load ssMUIDLL.dll, which decrypts an RC4-encrypted payload masquerading as a Windows help file (CGMIMP32.HLP) and communicates over hardcoded HTTP POST C2 (WinHttpPostShare). DriveSilkRAT is the operational backbone of the current campaign, using a "living-off-trusted-services" model: infected hosts poll a shared Google Drive folder for encrypted tasking, execute it through an in-memory .NET plugin system, and upload results back through the same Google service — evading network controls that allowlist Google Workspace traffic. CookiETagRAT instead smuggles commands inside HTTP Cookie and ETag response headers. Persistence across families relies on scheduled tasks disguised as update jobs (SysEdgeUpdateTaskMachineCore, fl_bridge, MicrosoftEdgeUpdateTaskMachineClSAN). Collection capabilities documented across the family set include keylogging, clipboard logging, browser-credential theft, and reconnaissance of OS version, hostname, username, IP, and MAC address; BloodAlchemy additionally uses HalosGate-style indirect syscalls and reflective in-memory DLL plugin loading to evade EDR hooking.
Bitdefender assesses AI-assisted (not AI-generated) development with medium confidence, citing leftover Go test functions compiled into GoginRAT's release binary, a hardcoded placeholder AES key (0123456789abcdef) in GoginRAT, and a NodeEdgeRAT configuration field still set to the literal string change_this_key — residue consistent with unreviewed AI-assisted code generation. Attribution is assessed as China-nexus with medium confidence: SpiceRAT ties to the SneakyChef actor documented by Cisco Talos, infrastructure traces to China Unicom backbone, operator activity clusters in UTC+8 working hours, and BloodAlchemy's code lineage links to ShadowPad/PlugX-family tooling associated with FamousSparrow (Azerbaijan energy targeting, May 2026) and TAG-110/UAC-0063 (Central Asia, February 2025). Researchers explicitly caution the evidence does not support attributing the cluster to a single named group; SneakyChef, FamousSparrow, and IndigoZebra represent overlapping but not confirmed-identical clusters. No CVE or software vulnerability is exploited — the tradecraft is social engineering plus abuse of legitimate DLL search-order behavior in signed third-party applications, not a coding defect in those applications.
MITRE ATT&CK techniques used in TL-2026-2554
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1574.001 DLL; T1620 Reflective Code Loading
Execution
T1047 Windows Management Instrumentation; T1059.005 Visual Basic; T1204.002 Malicious File
Persistence
Collection
Command and Control
T1071.001 Web Protocols; T1102.002 Bidirectional Communication
Discovery
T1082 System Information Discovery
Credential Access
T1555.003 Credentials from Web Browsers
Initial Access
T1566.001 Spearphishing Attachment
Resource Development
T1583.001 Domains; T1584.001 Domains; T1608.003 Install Digital Certificate
Affected products and versions in SilkParasite Infrastructure Links SpiceRAT, NodeEdgeRAT, and
- Calibre — Calibre ebook-edit.exe
Vulnerable versions: all versions - abused via legitimate DLL search-order behavior, not a coding defect
Fixed in: N/A - technique abuse - ABBYY — FineReader.exe
Vulnerable versions: all versions - abused via legitimate DLL search-order behavior, not a coding defect
Fixed in: N/A - technique abuse - Quick Heal — emlproui.exe
Vulnerable versions: all versions - abused via legitimate DLL search-order behavior, not a coding defect
Fixed in: N/A - technique abuse - Microsoft — Windows Defender (MpDefenderCoreService.exe)
Vulnerable versions: all versions - abused via legitimate DLL search-order behavior, not a coding defect
Fixed in: N/A - technique abuse - Mp3tag — Mp3tag.exe
Vulnerable versions: all versions - abused via legitimate DLL search-order behavior, not a coding defect
Fixed in: N/A - technique abuse - Samsung — RunHelp.exe
Vulnerable versions: all versions - abused via legitimate DLL search-order behavior, not a coding defect
Fixed in: N/A - technique abuse
Remediation for SilkParasite Infrastructure Links SpiceRAT, NodeEdgeRAT, and
Immediate actions
- Block network communication to the identified SilkParasite domains and IPs (azure.uzrailwaystax.com, help.hoster-kg.com, mineconom.tdtu.org, and associated address space from CrownCloud, EDIS GmbH, IP-Projects, and GWY IT PTY LTD) at perimeter firewalls and DNS resolvers
- Add the SHA-256 hash E9D0E8B8A33858A7A5A46F78D7A78F9AA7F9B029348D9B618C6A6A1937A39382 (cloned RTX Corporation decoy page) and the azure.uzrailwaystax.com TLS certificate fingerprints (SHA-256 27E072B92B5AC9E3E2A6770BEF3E84BDF864B0611D3BC9CACA12BE2B1A63DAE4, SHA-1 9297D5FD21EF21B16F5880CD4FAEA2AD1FB9EE39) to network detection and EDR blocklists
- Hunt for internet-exposed RDP listeners on non-standard high ports (64330, 64350, 65111, 65535, 61256) and restrict or firewall them
- Review email gateways for password-protected RAR attachments and government-themed lure documents referencing Central Asian ministries, railways, or state telecom/energy entities
Workarounds
- Restrict or block inbound and outbound RDP on non-standard high-numbered ports (64330, 64350, 65111, 65535, 61256) at the network perimeter
Longer-term hardening
- Deploy application allowlisting and code-signing enforcement to detect DLL side-loading against legitimate signed binaries (Calibre, ABBYY FineReader, Quick Heal, Windows Defender components, Mp3tag)
- Monitor for anomalous outbound traffic to Google Drive and other trusted cloud services from endpoints that do not normally use them, to catch living-off-trusted-services C2 channels
- Implement TLS certificate-transparency monitoring and passive-DNS pivoting on organizational brand and ministry-name strings to catch typosquat domains early
- Tune scheduled-task creation auditing (Sysmon Event ID 1 / schtasks) to flag persistence tasks masquerading as Windows, Edge, or Defender update jobs
Timeline of SilkParasite Infrastructure Links SpiceRAT, NodeEdgeRAT, and
- storage.natcommunzu.com first seen — the earliest dated node in the infrastructure cluster Hunt.io links to this operation, over four years before public disclosure.
- uz.natcommunzu.com registered, extending the domain cluster impersonating Uzbekistan national communications infrastructure.
- chief.presldent.info first seen on CrownCloud infrastructure, part of the 'president' typosquat sub-cluster.
- support.natcommunzu.com first seen on CrownCloud, continuing the natcommunzu.com impersonation subdomain pattern.
- Cisco Talos publishes original SpiceRAT/SneakyChef research documenting the RAT's LNK- and HTA-based infection chains against EMEA and Asia government targets; Bitdefender later notes the malware 'evolved on nearly every axis' from this baseline.
- microsoft.natcommunzu.com registered on CrownCloud infrastructure.
- it.presldent.info first seen, extending the 'president' typosquat cluster.
- Bitdefender detects a single SilkParasite infection, opening a roughly year-long retrospective investigation into the broader operation.
- TLS certificate for azure.uzrailwaystax.com (impersonating Uzbekistan's railway authority) issued by TLC DV TLS CA, a CAICT-funded Chinese state-affiliated certificate authority, valid through 2026-12-23.
- Early SpiceRAT server deployment observed at 2.58.14.95, hosting azure.uzrailwaystax.com.
- A coordinated cluster of five SpiceRAT servers comes online within days of each other — the tightest deployment window Hunt.io observed.
- Bitdefender publishes 'SilkParasite: Tracking a China-Nexus APT Across Central Asia,' documenting seven RAT families — five previously undocumented — sharing the operation.
- Hunt.io provides advance notification of the infrastructure-correlation findings to affected organizations ahead of public disclosure.
- Hunt.io publishes passive-DNS and certificate-pivot research correlating SpiceRAT, NodeEdgeRAT, and NomadRAT infrastructure into the single SilkParasite cluster.
- Security Affairs reports on the Hunt.io findings, the article that seeded this hunt entry.
Sources cited for SilkParasite Infrastructure Links SpiceRAT, NodeEdgeRAT, and
- SilkParasite Infrastructure Links SpiceRAT to Central Asian Targets
- SilkParasite Infrastructure: SpiceRAT Servers Tied to Energy and Government Targets Across Central Asia
- SilkParasite: Tracking a China-Nexus APT Across Central Asia
- SilkParasite Espionage Campaign Targets Central Asian Governments with Five New RATs
- SilkParasite Threatens Central Asian Orgs With Flurry of RATs
- SilkParasite Uses Google Drive as C2 to Hide RAT Traffic Inside Trusted Cloud Services
- SilkParasite Hackers Use SpiceRAT Infrastructure to Target Central Asian Governments and Energy Firms
- Unveiling SpiceRAT: SneakyChef's latest tool targeting EMEA and Asia
- SneakyChef espionage group targets government agencies with SugarGh0st and more infection techniques
- IndigoZebra APT continues to attack Central Asia with evolving tools
More in apt
- NightEagle (APT-Q-95) Deploys GhostContainer Backdoor on Exchange, Exploits BlueKeep (CVE-2019-0708) and DCSync to Compromise Russian Active Directory
- North Korean WaterPlum (Contagious Interview) Campaign Infects 30,000 Devices, Steals $10.71M in Crypto via Fake Job Interviews and npm/PyPI/Go/Rust Supply-Chain Packages
- North Korean WaterPlum (Contagious Interview) Hackers Target IT Professionals with BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, StoatWaffle Malware
- Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH Against India and Afghanistan Government/Defense Targets
- Red Heron Weaponizes Gitea RCE (CVE-2026-60004) with JITTERLY Implant and SIXZUT Rootkit
Detection coverage for TL-2026-2554
As of 2026-09-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2554 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.