# SilkParasite: China-Nexus APT Campaign Targeting Central Asian Governments with Seven RAT Families

> Bitdefender tracks SilkParasite, a campaign assessed with medium confidence as China-nexus, targeting Central Asian and South Caucasus government bodies focused on economic policy. Spear-phishing with Office macro documents inside password-protected RAR archives leads to DLL sideloading and deployment of seven plugin-based RAT families (DriveSilkRAT, SpiceRAT, CookiETagRAT, BloodAlchemy, NomadRAT, GoginRAT, NodeEdgeRAT); about 65 infection instances were observed.

- **Published:** 2026-10-14T07:35:39Z
- **Last reviewed:** 2026-10-14T07:35:39Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3477
- **ID:** TL-2026-3477
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** SilkParasite (China)
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

SilkParasite is a previously unreported espionage operation first detected in October 2025 at a Central Asian government entity; Bitdefender assesses the operation had been running for roughly a year before detection. Targets are government bodies involved in economic decision-making and policy in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, Kazakhstan and Georgia. Bitdefender counts approximately 65 infection instances (an upper-bound estimate). Attribution is China-nexus at medium confidence: SpiceRAT links to SneakyChef (Cisco Talos, June 2024), BloodAlchemy sits in the ShadowPad / Deed RAT lineage (Deed RAT is FamousSparrow's primary backdoor), several C2 IPs sit on China Unicom's backbone, and operator command activity inferred from Google Drive server-side timestamps (n=37 commands) fits UTC+8. Bitdefender explicitly states the evidence does not support pinning the campaign to a single named group, and that IP-level infrastructure analysis is circumstantial.

Initial access is social engineering, not vulnerability exploitation (no CVEs). Regionally tailored spear-phishing lures impersonate ministries (for example a fake Ministry of Internal Affairs of Uzbekistan correspondence) and carry malicious Microsoft Office documents with macros, delivered in password-protected RAR archives with the password in the email body to get past mail gateways. The macro checks for Kaspersky's avp.exe and adapts its behavior. Two recovered lures (an energy-cooperation platform and a GPU cloud-computing advertisement) appear AI-generated. Execution then relies on DLL sideloading: a legitimately signed application is placed beside a malicious library. Observed pairs: Calibre ebook-edit.exe + calibre-launcher.dll (SpiceRAT, via a HelpLoader that decrypts a payload from an .hlp file); ABBYY FineReader.exe + dsp_ippv2_x64.dll (BloodAlchemy); Quick Heal emlproui.exe + scansts.dll (NomadRAT); Windows Defender MpDefenderCoreService.exe + mpclient.dll (DriveSilkRAT C++ variant); Mp3tag.exe + tak_deco_lib.dll (CookiETagRAT); and an unidentified .NET utility + mscorsvc.dll (GoginRAT).

Seven families are deployed, five of them new and named by Bitdefender. DriveSilkRAT (.NET and C++) is the backbone: it uses shared Google Drive folders as C2 (living off trusted services), polls for tasking, runs in-memory .NET plugins (twelve recovered), runs commands through WMI rather than cmd.exe to break parent-child monitoring, and fingerprints hardware to create victim IDs; keys, C2 addresses, payload names and persistence names change between builds. SpiceRAT (C/C++) is an evolved version of the Talos-documented implant with API resolution by hash, HTTP C2 hosted on M247 infrastructure, reflectively loaded DLL plugins, and persistence under C:\ProgramData\USOShared\Logs\ with a scheduled task relaunching every two minutes. CookiETagRAT (C++) receives commands in HTTP Cookie/ETag response headers, returns results in the body, encrypts per victim with ChaCha20 keyed from a system identifier, and fires from DllMain. BloodAlchemy (C/C++) supports TCP, HTTP/S, DNS and SMB C2, uses HalosGate, hardware breakpoints and vectored exception handlers, executes its payload via an EnumTimeFormatsEx callback, and embeds impapi (user impersonation / process execution as another user), cliplogger and keylogger plugins. NomadRAT (C++) is split into an orchestrator, a dedicated transmitter library and numbered PE plugins, with MessagePack registration data and nested base64-encoded JSON tasking over HTTPS. GoginRAT (Go) is reached through DriveSilkRAT, is loaded by a malicious mscorsvc.dll, runs filesystem and shell plugins in separate goroutines over HTTP, and contains leftover Go test functions and the placeholder AES key 0123456789abcdef. NodeEdgeRAT (JavaScript) is a monolithic obfuscated script run by a bundled legitimate Node.js runtime, beacons over HTTPS to evo.hoster-kg.com (impersonating the Kyrgyz hosting provider hoster.kg), and persists through the scheduled task SysEdgeUpdateTaskMachineCore masquerading as a Microsoft Edge update job.

Bitdefender sees traces of AI-assisted development (leftover test functions, placeholder keys, the same orchestrator/transmitter/plugin design implemented in both C++ and Go) and signs of a maintained build pipeline (ConfuserEx protection, a dedicated Encoder utility, recurring debug-symbol paths). The assessment is held at medium confidence. The main detection surface is the sideloading pairing of a signed application with an unexpected library, unusual process-to-network relationships (Google Drive traffic with no matching user activity), and the persistence artifacts listed above. The full IOC set is published in Bitdefender's malware-ioc GitHub repository (2026_08-silkparasite-iocs.csv); that CSV could not be retrieved during this research, so the IOC list below contains only indicators named in the public write-ups.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1047 Windows Management Instrumentation
- T1059.007 JavaScript
- T1053.005 Scheduled Task
- T1134 Access Token Manipulation
- T1574.001 DLL
- T1036.004 Masquerade Task or Service
- T1027 Obfuscated Files or Information
- T1620 Reflective Code Loading
- T1140 Deobfuscate/Decode Files or Information
- T1518.001 Security Software Discovery
- T1082 System Information Discovery
- T1057 Process Discovery
- T1056.001 Keylogging
- T1102.002 Bidirectional Communication
- T1071.001 Web Protocols
- T1573.001 Symmetric Cryptography

## Sources

- [SilkParasite: Tracking a China-Nexus APT Across Central Asia (Bitdefender Business Insights)](https://www.bitdefender.com/en-us/blog/businessinsights/silkparasite-tracking-china-nexus-apt-across-central-asia)
- [Bitdefender malware-ioc repository (2026_08-silkparasite-iocs.csv)](https://github.com/bitdefender/malware-ioc)
- [SilkParasite espionage campaign targets (The Hacker News)](https://thehackernews.com/2026/08/silkparasite-espionage-campaign-targets.html)
- [SilkParasite Threatens Central Asian Orgs With Flurry of RATs (Dark Reading)](https://darkreading.com/threat-intelligence/silkparasite-central-asian-orgs-flurry-rats)
- [Unveiling SpiceRAT: SneakyChef's latest tool (Cisco Talos)](https://blog.talosintelligence.com/new-spicerat-sneakychef/)
- [SilkParasite actor profile (Malpedia)](https://malpedia.caad.fkie.fraunhofer.de/actor/silkparasite)
- [SilkParasite: China-Nexus Espionage Campaign in Central Asia (detections.ai)](https://detections.ai/intel-exchange/01a01f5c-4482-70da-a192-77e55449095f)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3477