Skip to navigation

Threat reportAPTTL-2026-2554

SilkParasite Infrastructure Links SpiceRAT, NodeEdgeRAT, and NomadRAT to Four-Year China-Nexus Campaign Against Central Asian Governments

highACTIVE

Hunt.io correlated shared TLS certificates, decoy web content, and passive-DNS registration patterns to tie SpiceRAT, NodeEdgeRAT, and NomadRAT to a single infrastructure cluster ("SilkParasite") active since mid-2022 against government ministries, railways, telecoms, and energy entities across five Central Asian nations.

Key facts for SilkParasite Central Asia RAT Cluster

IdentifiersTL-2026-2554
Also known asSilkParasite
SeverityHIGH
Exploitation statusNo known exploitation
Affected productsCalibre Calibre ebook-edit.exe; ABBYY FineReader.exe; Quick Heal emlproui.exe; Microsoft Windows Defender (MpDefenderCoreService.exe); Mp3tag Mp3tag.exe; Samsung RunHelp.exe
Nation-state nexusChina
MalwareBloodAlchemy, DriveSilkRAT, NodeEdgeRAT, NomadRAT, SpiceRAT
MITRE ATT&CK techniquesT1027 Obfuscated Files or Information, T1036.005 Match Legitimate Resource Name or Location, T1047 Windows Management Instrumentation, T1053.005 Scheduled Task, T1056.001 Keylogging, T1059.005 Visual Basic, T1071.001 Web Protocols, T1082 System Information Discovery, T1102.002 Bidirectional Communication, T1204.002 Malicious File, T1555.003 Credentials from Web Browsers, T1566.001 Spearphishing Attachment and 5 more in the attack flow
MotivationESPIONAGE
Target sectorsgovernment administration, energy, telecoms, critical infrastructure, transportation rail
Target regions143 - Central Asia, uzbekistan, turkmenistan, tajikistan, kyrgyzstan, kazakhstan
Detection rules9 (1 shown free)
Sources10 cited sources

Detection coverage for SilkParasite Central Asia RAT Cluster

As of 2026-09-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2554 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SilkParasite Spearphishing Archive-to-Macro Execution Chain (avp.exe AV Check)

Detects the SilkParasite/SneakyChef initial-access chain: a password-protected RAR lure attachment is extracted, the victim opens a region-tailored Office document, and the embedded macro enumerates running processes for Kaspersky's avp.exe before spawning a script/command interpreter child process. Office applications (WINWORD.EXE/EXCEL.EXE/POWERPNT.EXE) rarely need to query the process list or spawn cmd/wscript/powershell/mshta as a direct child; this behavior is the macro's AV-evasion gate immediately preceding payload staging.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1566.001, T1204.002, T1059.005
  • Data sources: sysmon, windows_security, microsoft_defender_for_endpoint
  • Severity: high
  • Confidence: high

Splunk SPL

index=sysmon OR index=endpoint EventCode=1
| eval parent_l=lower(ParentImage), child_l=lower(Image), cmd_l=lower(CommandLine)
| where match(parent_l, "winword\.exe$|excel\.exe$|powerpnt\.exe$")
| where match(child_l, "cmd\.exe$|wscript\.exe$|cscript\.exe$|powershell\.exe$|mshta\.exe$|tasklist\.exe$|wmic\.exe$")
| where match(cmd_l, "avp\.exe|kavfswp|kaspersky|get-process\s+avp")
| stats count min(_time) as first_seen max(_time) as last_seen by host, User, ParentImage, Image, CommandLine, ParentCommandLine
| sort -last_seen

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE")
| where FileName in~ ("cmd.exe", "wscript.exe", "cscript.exe", "powershell.exe", "mshta.exe", "tasklist.exe", "wmic.exe")
| where ProcessCommandLine has_any ("avp.exe", "kavfswp", "kaspersky") or InitiatingProcessCommandLine has_any ("avp.exe", "kavfswp", "kaspersky")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, FolderPath
| order by Timestamp desc

Sigma

title: Office Macro Spawns Interpreter After Kaspersky AV Process Check (SilkParasite)
id: 8a2f1d6c-4e77-4c9a-9b3f-1a2e5c7d8f01
status: experimental
description: Detects Office applications spawning a command/script interpreter whose command line references avp.exe, matching the SilkParasite/SneakyChef lure-macro AV-evasion gate documented against Central Asian government targets.
references:
    - https://hunt.io/blog/silkparasite-spicerat-central-asia-infrastructure
    - https://businessinsights.bitdefender.com/silkparasite-tracking-china-nexus-apt-across-central-asia
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-17
tags:
    - attack.initial-access
    - attack.t1566.001
    - attack.execution
    - attack.t1204.002
    - attack.t1059.005
    - attack.defense-evasion
    - attack.actor.sneakychef
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\WINWORD.EXE'
            - '\EXCEL.EXE'
            - '\POWERPNT.EXE'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\powershell.exe'
            - '\mshta.exe'
            - '\tasklist.exe'
            - '\wmic.exe'
    selection_avcheck:
        CommandLine|contains:
            - 'avp.exe'
            - 'kavfswp'
            - 'kaspersky'
    condition: all of selection_*
falsepositives:
    - IT asset-inventory macros that legitimately enumerate installed AV products
    - Security-awareness training documents that simulate AV-evasion checks
level: high

Known false positives:

  • IT asset-management or license-audit macros that enumerate running security products by name
  • Endpoint-hardening validation scripts run by the security team that check for AV presence

Tuning notes: Scope to hosts that received email attachments in the prior hour (join with mail-gateway logs) to cut noise from legitimate IT scripts; add an allowlist for signed corporate deployment tooling (e.g. SCCM baseline scripts) that also queries tasklist for avp.exe.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Password-Protected Archive Followed by Macro-Enabled Document Execution · unlock with TL Creds
  • Scheduled Task Persistence Masquerading as Windows/Edge/Defender Update Jobs · unlock with TL Creds
  • RDP-over-TLS on Non-Standard High Ports Matching SilkParasite C2 Infrastructure · unlock with TL Creds
  • Region-Themed Lure Document Spawns LOLBin Consistent With SilkParasite Delivery · unlock with TL Creds
  • Reflective In-Memory DLL Loading and Indirect Syscall Evasion (BloodAlchemy HalosGate Pattern) · unlock with TL Creds
  • C2 Commands Smuggled in HTTP Cookie/ETag Headers (CookiETagRAT) · unlock with TL Creds
  • DLL Side-Loading Against Signed Third-Party Apps (SpiceRAT/BloodAlchemy/NomadRAT/DriveSilkRAT/CookiETagRAT) · unlock with TL Creds
  • SilkParasite Google Drive Living-off-Trusted-Services C2 Polling (DriveSilkRAT) · unlock with TL Creds

Indicators of compromise for SilkParasite Central Asia RAT Cluster

As of 2026-09-17, Threadlinqs Intelligence tracks 30 indicators of compromise for TL-2026-2554.

Sample indicators (3 of 30)

  • IP address: 2.58.14[.]95
  • Domain: azure[.]uzrailwaystax[.]com
  • File hash: E9D0E8B8A33858A7A5A46F78D7A78F9AA7F9B029348D9B618C6A6A1937A39382

Defanged, TLP:CLEAR. Full set of 30 indicators: unlock with TL Creds.

30 indicators of compromise · unlock with TL Creds. Compare plans

How SilkParasite Central Asia RAT Cluster works

A TLS certificate impersonating Uzbekistan's railway authority, issued by a Chinese state-affiliated CA, anchors the cluster to a suspected China-nexus operator with tradecraft overlaps to SneakyChef, FamousSparrow, and IndigoZebra.

Hunt.io researcher Guy Yasur used TLS certificate pivoting, cloned-webpage hash matching, and passive DNS to link infrastructure previously attributed to three separately tracked RAT families — SpiceRAT (Cisco Talos, tied to the SneakyChef actor), NodeEdgeRAT, and NomadRAT (both first documented by Bitdefender) — into a single four-year operation dubbed SilkParasite. The anchor artifact is a TLS certificate (CN azure.uzrailwaystax[.]com, issued by TLC DV TLS CA, valid 2025-12-23 to 2026-12-23) impersonating Uzbekistan's national railway authority; the issuing CA, TLC (泰尔认证中心有限公司), is wholly funded by CAICT under China's Ministry of Industry and Information Technology. Pivoting on that certificate and on a cloned RTX Corporation homepage (served as decoy content on port 80 across 13 servers) surfaced a domain cluster spoofing state railways, foreign ministries, national telecoms, and energy authorities across Uzbekistan, Turkmenistan, Tajikistan, Kyrgyzstan, and Kazakhstan, hosted through resellers CrownCloud, EDIS GmbH, and CloudBackbone on ASNs including AS199959, AS57169, AS48314, and AS9009 across Germany, the Netherlands, Bulgaria, and Estonia. The cluster also exposes RDP-over-TLS on non-standard high-numbered ports (64350, 64330, 65535, 65111, 61256), and shows registration-level infrastructure overlap with a prior Check Point-documented cluster, IndigoZebra (aka Speccom), that targeted the same governments as far back as 2021 using matching subdomain conventions (mail, service, help).

Bitdefender's companion research ("SilkParasite: Tracking a China-Nexus APT Across Central Asia," 19 Aug 2026) independently arrived at the same cluster from the malware side, documenting seven RAT families in active use — the previously known SpiceRAT and BloodAlchemy plus five newly identified families: NodeEdgeRAT (JavaScript/Node.js), NomadRAT (C++), DriveSilkRAT (.NET/C++), CookiETagRAT (C++), and GoginRAT (Go). Initial access is spear-phishing with password-protected RAR archives carrying region-tailored Office-macro lure documents (impersonating ministries in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, Kazakhstan, and Georgia); the delivery macro checks for Kaspersky's avp.exe before executing. Every family lands via DLL side-loading against signed, legitimate applications: Calibre (ebook-edit.exe → calibre-launcher.dll) for SpiceRAT, ABBYY FineReader (FineReader.exe → dsp_ippv2_x64.dll) for BloodAlchemy, Quick Heal (emlproui.exe → scansts.dll) for NomadRAT, a Windows Defender component (MpDefenderCoreService.exe → mpclient.dll) for the C++ DriveSilkRAT variant, and Mp3tag (Mp3tag.exe → tak_deco_lib.dll) for CookiETagRAT. Cisco Talos's earlier SpiceRAT/SneakyChef research (2024) documented a parallel loader chain abusing a Samsung-signed RunHelp.exe to side-load ssMUIDLL.dll, which decrypts an RC4-encrypted payload masquerading as a Windows help file (CGMIMP32.HLP) and communicates over hardcoded HTTP POST C2 (WinHttpPostShare). DriveSilkRAT is the operational backbone of the current campaign, using a "living-off-trusted-services" model: infected hosts poll a shared Google Drive folder for encrypted tasking, execute it through an in-memory .NET plugin system, and upload results back through the same Google service — evading network controls that allowlist Google Workspace traffic. CookiETagRAT instead smuggles commands inside HTTP Cookie and ETag response headers. Persistence across families relies on scheduled tasks disguised as update jobs (SysEdgeUpdateTaskMachineCore, fl_bridge, MicrosoftEdgeUpdateTaskMachineClSAN). Collection capabilities documented across the family set include keylogging, clipboard logging, browser-credential theft, and reconnaissance of OS version, hostname, username, IP, and MAC address; BloodAlchemy additionally uses HalosGate-style indirect syscalls and reflective in-memory DLL plugin loading to evade EDR hooking.

Bitdefender assesses AI-assisted (not AI-generated) development with medium confidence, citing leftover Go test functions compiled into GoginRAT's release binary, a hardcoded placeholder AES key (0123456789abcdef) in GoginRAT, and a NodeEdgeRAT configuration field still set to the literal string change_this_key — residue consistent with unreviewed AI-assisted code generation. Attribution is assessed as China-nexus with medium confidence: SpiceRAT ties to the SneakyChef actor documented by Cisco Talos, infrastructure traces to China Unicom backbone, operator activity clusters in UTC+8 working hours, and BloodAlchemy's code lineage links to ShadowPad/PlugX-family tooling associated with FamousSparrow (Azerbaijan energy targeting, May 2026) and TAG-110/UAC-0063 (Central Asia, February 2025). Researchers explicitly caution the evidence does not support attributing the cluster to a single named group; SneakyChef, FamousSparrow, and IndigoZebra represent overlapping but not confirmed-identical clusters. No CVE or software vulnerability is exploited — the tradecraft is social engineering plus abuse of legitimate DLL search-order behavior in signed third-party applications, not a coding defect in those applications.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1574.001 DLL; T1620 Reflective Code Loading

Execution

T1047 Windows Management Instrumentation; T1059.005 Visual Basic; T1204.002 Malicious File

Persistence

T1053.005 Scheduled Task

Collection

T1056.001 Keylogging

Command and Control

T1071.001 Web Protocols; T1102.002 Bidirectional Communication

Discovery

T1082 System Information Discovery

Credential Access

T1555.003 Credentials from Web Browsers

Initial Access

T1566.001 Spearphishing Attachment

Resource Development

T1583.001 Domains; T1584.001 Domains; T1608.003 Install Digital Certificate

Remediation for SilkParasite Central Asia RAT Cluster

Immediate actions

  • Block network communication to the identified SilkParasite domains and IPs (azure.uzrailwaystax.com, help.hoster-kg.com, mineconom.tdtu.org, and associated address space from CrownCloud, EDIS GmbH, IP-Projects, and GWY IT PTY LTD) at perimeter firewalls and DNS resolvers
  • Add the SHA-256 hash E9D0E8B8A33858A7A5A46F78D7A78F9AA7F9B029348D9B618C6A6A1937A39382 (cloned RTX Corporation decoy page) and the azure.uzrailwaystax.com TLS certificate fingerprints (SHA-256 27E072B92B5AC9E3E2A6770BEF3E84BDF864B0611D3BC9CACA12BE2B1A63DAE4, SHA-1 9297D5FD21EF21B16F5880CD4FAEA2AD1FB9EE39) to network detection and EDR blocklists
  • Hunt for internet-exposed RDP listeners on non-standard high ports (64330, 64350, 65111, 65535, 61256) and restrict or firewall them
  • Review email gateways for password-protected RAR attachments and government-themed lure documents referencing Central Asian ministries, railways, or state telecom/energy entities

Workarounds

  • Restrict or block inbound and outbound RDP on non-standard high-numbered ports (64330, 64350, 65111, 65535, 61256) at the network perimeter

Longer-term hardening

  • Deploy application allowlisting and code-signing enforcement to detect DLL side-loading against legitimate signed binaries (Calibre, ABBYY FineReader, Quick Heal, Windows Defender components, Mp3tag)
  • Monitor for anomalous outbound traffic to Google Drive and other trusted cloud services from endpoints that do not normally use them, to catch living-off-trusted-services C2 channels
  • Implement TLS certificate-transparency monitoring and passive-DNS pivoting on organizational brand and ministry-name strings to catch typosquat domains early
  • Tune scheduled-task creation auditing (Sysmon Event ID 1 / schtasks) to flag persistence tasks masquerading as Windows, Edge, or Defender update jobs

Affected and fixed versions

  • Calibre — Calibre ebook-edit.exe
    Vulnerable versions: all versions - abused via legitimate DLL search-order behavior, not a coding defect
    Fixed in: N/A - technique abuse
  • ABBYY — FineReader.exe
    Vulnerable versions: all versions - abused via legitimate DLL search-order behavior, not a coding defect
    Fixed in: N/A - technique abuse
  • Quick Heal — emlproui.exe
    Vulnerable versions: all versions - abused via legitimate DLL search-order behavior, not a coding defect
    Fixed in: N/A - technique abuse
  • Microsoft — Windows Defender (MpDefenderCoreService.exe)
    Vulnerable versions: all versions - abused via legitimate DLL search-order behavior, not a coding defect
    Fixed in: N/A - technique abuse
  • Mp3tag — Mp3tag.exe
    Vulnerable versions: all versions - abused via legitimate DLL search-order behavior, not a coding defect
    Fixed in: N/A - technique abuse
  • Samsung — RunHelp.exe
    Vulnerable versions: all versions - abused via legitimate DLL search-order behavior, not a coding defect
    Fixed in: N/A - technique abuse

Timeline of SilkParasite Central Asia RAT Cluster

  • storage.natcommunzu.com first seen — the earliest dated node in the infrastructure cluster Hunt.io links to this operation, over four years before public disclosure.
  • uz.natcommunzu.com registered, extending the domain cluster impersonating Uzbekistan national communications infrastructure.
  • chief.presldent.info first seen on CrownCloud infrastructure, part of the 'president' typosquat sub-cluster.
  • support.natcommunzu.com first seen on CrownCloud, continuing the natcommunzu.com impersonation subdomain pattern.
  • Cisco Talos publishes original locked-ioc-29/locked-ioc-28 research documenting the RAT's LNK- and HTA-based infection chains against EMEA and Asia government targets; Bitdefender later notes the malware 'evolved on nearly every axis' from this baseline.
  • microsoft.natcommunzu.com registered on CrownCloud infrastructure.
  • it.presldent.info first seen, extending the 'president' typosquat cluster.
  • Bitdefender detects a single SilkParasite infection, opening a roughly year-long retrospective investigation into the broader operation.
  • TLS certificate for locked-ioc-5 (impersonating Uzbekistan's railway authority) issued by TLC DV TLS CA, a CAICT-funded Chinese state-affiliated certificate authority, valid through 2026-12-23.
  • Early locked-ioc-29 server deployment observed at locked-ioc-26, hosting locked-ioc-5.
  • A coordinated cluster of five locked-ioc-29 servers comes online within days of each other — the tightest deployment window Hunt.io observed.
  • Bitdefender publishes 'SilkParasite: Tracking a China-Nexus APT Across Central Asia,' documenting seven RAT families — five previously undocumented — sharing the operation.
  • Hunt.io provides advance notification of the infrastructure-correlation findings to affected organizations ahead of public disclosure.
  • Hunt.io publishes passive-DNS and certificate-pivot research correlating locked-ioc-29, locked-ioc-24, and locked-ioc-30 infrastructure into the single SilkParasite cluster.
  • Security Affairs reports on the Hunt.io findings, the article that seeded this hunt entry.

Sources cited for SilkParasite Central Asia RAT Cluster

Previous and next in apt

Drafted by the Threadlinqs research pipeline from 10 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats