# SilkParasite Infrastructure Links SpiceRAT, NodeEdgeRAT, and NomadRAT to Four-Year China-Nexus Campaign Against Central Asian Governments

> Hunt.io correlated shared TLS certificates, decoy web content, and passive-DNS registration patterns to tie SpiceRAT, NodeEdgeRAT, and NomadRAT to a single infrastructure cluster ("SilkParasite") active since mid-2022 against government ministries, railways, telecoms, and energy entities across five Central Asian nations. A TLS certificate impersonating Uzbekistan's railway authority, issued by a Chinese state-affiliated CA, anchors the cluster to a suspected China-nexus operator with tradecraft overlaps to SneakyChef, FamousSparrow, and IndigoZebra.

- **Published:** 2026-09-17T00:00:00Z
- **Last reviewed:** 2026-09-17T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2554
- **ID:** TL-2026-2554
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Hunt.io researcher Guy Yasur used TLS certificate pivoting, cloned-webpage hash matching, and passive DNS to link infrastructure previously attributed to three separately tracked RAT families — SpiceRAT (Cisco Talos, tied to the SneakyChef actor), NodeEdgeRAT, and NomadRAT (both first documented by Bitdefender) — into a single four-year operation dubbed SilkParasite. The anchor artifact is a TLS certificate (CN azure.uzrailwaystax[.]com, issued by TLC DV TLS CA, valid 2025-12-23 to 2026-12-23) impersonating Uzbekistan's national railway authority; the issuing CA, TLC (泰尔认证中心有限公司), is wholly funded by CAICT under China's Ministry of Industry and Information Technology. Pivoting on that certificate and on a cloned RTX Corporation homepage (served as decoy content on port 80 across 13 servers) surfaced a domain cluster spoofing state railways, foreign ministries, national telecoms, and energy authorities across Uzbekistan, Turkmenistan, Tajikistan, Kyrgyzstan, and Kazakhstan, hosted through resellers CrownCloud, EDIS GmbH, and CloudBackbone on ASNs including AS199959, AS57169, AS48314, and AS9009 across Germany, the Netherlands, Bulgaria, and Estonia. The cluster also exposes RDP-over-TLS on non-standard high-numbered ports (64350, 64330, 65535, 65111, 61256), and shows registration-level infrastructure overlap with a prior Check Point-documented cluster, IndigoZebra (aka Speccom), that targeted the same governments as far back as 2021 using matching subdomain conventions (mail, service, help).

Bitdefender's companion research ("SilkParasite: Tracking a China-Nexus APT Across Central Asia," 19 Aug 2026) independently arrived at the same cluster from the malware side, documenting seven RAT families in active use — the previously known SpiceRAT and BloodAlchemy plus five newly identified families: NodeEdgeRAT (JavaScript/Node.js), NomadRAT (C++), DriveSilkRAT (.NET/C++), CookiETagRAT (C++), and GoginRAT (Go). Initial access is spear-phishing with password-protected RAR archives carrying region-tailored Office-macro lure documents (impersonating ministries in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, Kazakhstan, and Georgia); the delivery macro checks for Kaspersky's avp.exe before executing. Every family lands via DLL side-loading against signed, legitimate applications: Calibre (ebook-edit.exe → calibre-launcher.dll) for SpiceRAT, ABBYY FineReader (FineReader.exe → dsp_ippv2_x64.dll) for BloodAlchemy, Quick Heal (emlproui.exe → scansts.dll) for NomadRAT, a Windows Defender component (MpDefenderCoreService.exe → mpclient.dll) for the C++ DriveSilkRAT variant, and Mp3tag (Mp3tag.exe → tak_deco_lib.dll) for CookiETagRAT. Cisco Talos's earlier SpiceRAT/SneakyChef research (2024) documented a parallel loader chain abusing a Samsung-signed RunHelp.exe to side-load ssMUIDLL.dll, which decrypts an RC4-encrypted payload masquerading as a Windows help file (CGMIMP32.HLP) and communicates over hardcoded HTTP POST C2 (WinHttpPostShare). DriveSilkRAT is the operational backbone of the current campaign, using a "living-off-trusted-services" model: infected hosts poll a shared Google Drive folder for encrypted tasking, execute it through an in-memory .NET plugin system, and upload results back through the same Google service — evading network controls that allowlist Google Workspace traffic. CookiETagRAT instead smuggles commands inside HTTP Cookie and ETag response headers. Persistence across families relies on scheduled tasks disguised as update jobs (SysEdgeUpdateTaskMachineCore, fl_bridge, MicrosoftEdgeUpdateTaskMachineClSAN). Collection capabilities documented across the family set include keylogging, clipboard logging, browser-credential theft, and reconnaissance of OS version, hostname, username, IP, and MAC address; BloodAlchemy additionally uses HalosGate-style indirect syscalls and reflective in-memory DLL plugin loading to evade EDR hooking.

Bitdefender assesses AI-assisted (not AI-generated) development with medium confidence, citing leftover Go test functions compiled into GoginRAT's release binary, a hardcoded placeholder AES key (0123456789abcdef) in GoginRAT, and a NodeEdgeRAT configuration field still set to the literal string change_this_key — residue consistent with unreviewed AI-assisted code generation. Attribution is assessed as China-nexus with medium confidence: SpiceRAT ties to the SneakyChef actor documented by Cisco Talos, infrastructure traces to China Unicom backbone, operator activity clusters in UTC+8 working hours, and BloodAlchemy's code lineage links to ShadowPad/PlugX-family tooling associated with FamousSparrow (Azerbaijan energy targeting, May 2026) and TAG-110/UAC-0063 (Central Asia, February 2025). Researchers explicitly caution the evidence does not support attributing the cluster to a single named group; SneakyChef, FamousSparrow, and IndigoZebra represent overlapping but not confirmed-identical clusters. No CVE or software vulnerability is exploited — the tradecraft is social engineering plus abuse of legitimate DLL search-order behavior in signed third-party applications, not a coding defect in those applications.

## MITRE ATT&CK

- T1583.001 Domains
- T1584.001 Domains
- T1608.003 Install Digital Certificate
- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1047 Windows Management Instrumentation
- T1059.005 Visual Basic
- T1053.005 Scheduled Task
- T1574.001 DLL
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1620 Reflective Code Loading
- T1082 System Information Discovery
- T1056.001 Keylogging
- T1555.003 Credentials from Web Browsers
- T1071.001 Web Protocols
- T1102.002 Bidirectional Communication

## Sources

- [SilkParasite Infrastructure Links SpiceRAT to Central Asian Targets](https://securityaffairs.com/199267/apt/silkparasite-infrastructure-links-spicerat-to-central-asian-targets.html)
- [SilkParasite Infrastructure: SpiceRAT Servers Tied to Energy and Government Targets Across Central Asia](https://hunt.io/blog/silkparasite-spicerat-central-asia-infrastructure)
- [SilkParasite: Tracking a China-Nexus APT Across Central Asia](https://businessinsights.bitdefender.com/silkparasite-tracking-china-nexus-apt-across-central-asia)
- [SilkParasite Espionage Campaign Targets Central Asian Governments with Five New RATs](https://thehackernews.com/2026/08/silkparasite-espionage-campaign-targets.html)
- [SilkParasite Threatens Central Asian Orgs With Flurry of RATs](https://www.darkreading.com/threat-intelligence/silkparasite-central-asian-orgs-flurry-rats)
- [SilkParasite Uses Google Drive as C2 to Hide RAT Traffic Inside Trusted Cloud Services](https://gbhackers.com/silkparasite-uses-google-drive/)
- [SilkParasite Hackers Use SpiceRAT Infrastructure to Target Central Asian Governments and Energy Firms](https://gbhackers.com/spicerat-infrastructure/)
- [Unveiling SpiceRAT: SneakyChef's latest tool targeting EMEA and Asia](https://blog.talosintelligence.com/new-spicerat-sneakychef/)
- [SneakyChef espionage group targets government agencies with SugarGh0st and more infection techniques](https://blog.talosintelligence.com/sneakychef-sugargh0st-rat/)
- [IndigoZebra APT continues to attack Central Asia with evolving tools](https://research.checkpoint.com/2021/indigozebra-apt-continues-to-attack-central-asia-with-evolving-tools/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2554