SilkParasite is a previously unreported espionage operation first detected in October 2025 at a Central Asian government entity; Bitdefender assesses the operation had been running for roughly a year before detection. Targets are government bodies involved in economic decision-making and policy in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, Kazakhstan and Georgia. Bitdefender counts approximately 65 infection instances (an upper-bound estimate). Attribution is China-nexus at medium confidence: SpiceRAT links to SneakyChef (Cisco Talos, June 2024), BloodAlchemy sits in the ShadowPad / Deed RAT lineage (Deed RAT is FamousSparrow's primary backdoor), several C2 IPs sit on China Unicom's backbone, and operator command activity inferred from Google Drive server-side timestamps (n=37 commands) fits UTC+8. Bitdefender explicitly states the evidence does not support pinning the campaign to a single named group, and that IP-level infrastructure analysis is circumstantial.

Initial access is social engineering, not vulnerability exploitation (no CVEs). Regionally tailored spear-phishing lures impersonate ministries (for example a fake Ministry of Internal Affairs of Uzbekistan correspondence) and carry malicious Microsoft Office documents with macros, delivered in password-protected RAR archives with the password in the email body to get past mail gateways. The macro checks for Kaspersky's avp.exe and adapts its behavior. Two recovered lures (an energy-cooperation platform and a GPU cloud-computing advertisement) appear AI-generated. Execution then relies on DLL sideloading: a legitimately signed application is placed beside a malicious library. Observed pairs: Calibre ebook-edit.exe + calibre-launcher.dll (SpiceRAT, via a HelpLoader that decrypts a payload from an .hlp file); ABBYY FineReader.exe + dsp_ippv2_x64.dll (BloodAlchemy); Quick Heal emlproui.exe + scansts.dll (NomadRAT); Windows Defender MpDefenderCoreService.exe + mpclient.dll (DriveSilkRAT C++ variant); Mp3tag.exe + tak_deco_lib.dll (CookiETagRAT); and an unidentified .NET utility + mscorsvc.dll (GoginRAT).

Seven families are deployed, five of them new and named by Bitdefender. DriveSilkRAT (.NET and C++) is the backbone: it uses shared Google Drive folders as C2 (living off trusted services), polls for tasking, runs in-memory .NET plugins (twelve recovered), runs commands through WMI rather than cmd.exe to break parent-child monitoring, and fingerprints hardware to create victim IDs; keys, C2 addresses, payload names and persistence names change between builds. SpiceRAT (C/C++) is an evolved version of the Talos-documented implant with API resolution by hash, HTTP C2 hosted on M247 infrastructure, reflectively loaded DLL plugins, and persistence under C:\ProgramData\USOShared\Logs\ with a scheduled task relaunching every two minutes. CookiETagRAT (C++) receives commands in HTTP Cookie/ETag response headers, returns results in the body, encrypts per victim with ChaCha20 keyed from a system identifier, and fires from DllMain. BloodAlchemy (C/C++) supports TCP, HTTP/S, DNS and SMB C2, uses HalosGate, hardware breakpoints and vectored exception handlers, executes its payload via an EnumTimeFormatsEx callback, and embeds impapi (user impersonation / process execution as another user), cliplogger and keylogger plugins. NomadRAT (C++) is split into an orchestrator, a dedicated transmitter library and numbered PE plugins, with MessagePack registration data and nested base64-encoded JSON tasking over HTTPS. GoginRAT (Go) is reached through DriveSilkRAT, is loaded by a malicious mscorsvc.dll, runs filesystem and shell plugins in separate goroutines over HTTP, and contains leftover Go test functions and the placeholder AES key 0123456789abcdef. NodeEdgeRAT (JavaScript) is a monolithic obfuscated script run by a bundled legitimate Node.js runtime, beacons over HTTPS to evo.hoster-kg.com (impersonating the Kyrgyz hosting provider hoster.kg), and persists through the scheduled task SysEdgeUpdateTaskMachineCore masquerading as a Microsoft Edge update job.

Bitdefender sees traces of AI-assisted development (leftover test functions, placeholder keys, the same orchestrator/transmitter/plugin design implemented in both C++ and Go) and signs of a maintained build pipeline (ConfuserEx protection, a dedicated Encoder utility, recurring debug-symbol paths). The assessment is held at medium confidence. The main detection surface is the sideloading pairing of a signed application with an unexpected library, unusual process-to-network relationships (Google Drive traffic with no matching user activity), and the persistence artifacts listed above. The full IOC set is published in Bitdefender's malware-ioc GitHub repository (2026_08-silkparasite-iocs.csv); that CSV could not be retrieved during this research, so the IOC list below contains only indicators named in the public write-ups.