Central Asia Targeted by New Backdoors

A campaign involving previously unidentified threat actors has targeted government, healthcare, and educational sectors across Central Asia and the Syrian Arab Republic since January 2025. Kaspersky researchers report the deployment of two specialized, obfuscated backdoors, OctLurk and SilkLurk, designed for long-term persistence and intelligence collection within sensitive networks.

The Dual-Backdoor Framework

The malicious activity utilizes a modular architecture to maintain control over infected systems. While the initial infection vector remains unconfirmed, the OctLurk backdoor operates by injecting itself into memory via a loader. Before execution, the process confirms internet connectivity by reaching out to a specific domain before initiating LurkProxy, a utility that manages network traffic routing through SOCKS5 or transparent proxy modes.

SilkLurk operates through a different mechanism, utilizing a DLL side-loading sequence to execute its payload. Once active, this backdoor establishes a TCP socket connection to a command-and-control server to await further instructions, which can include modifying polling intervals or injecting additional plugins directly into the system's memory. Both tools rely on machine-specific data to decrypt their payloads, increasing the complexity of forensic analysis.

Both families operate primarily in memory, leaving only a minimalistic loader on disk that relies on machine-specific data (OctLurk uses the drive serial number, and SilkLurk uses the computer name) to decode payload locations and contents. This victim-specific encoding makes reverse engineering and automated detection considerably harder.

— Kaspersky

Post-Compromise Tactics

Once inside a network, the threat actors execute a wide range of commands to facilitate data exfiltration and lateral movement. The attackers utilize various techniques to broaden their reach and acquire credentials, including harvesting password hashes from domain controllers and extracting stored credentials from web browsers. The campaign also makes use of established tools to further its objectives:

• Use of Impacket's secretsdump.py to harvest domain controller password hashes.
• Deployment of Fscan to perform network reconnaissance on ports 22 and 3306.
• Execution of a keylogger masquerading as the legitimate AnyDesk application.
• Deployment of the PlugX backdoor via DLL side-loading to maintain established access.

Infrastructure and Attribution

Kaspersky researchers have identified links between this campaign and previous activities involving the SilentRaid implant. This overlap suggests that the threat actors behind these attacks share infrastructure resources across multiple operations. While the specific group remains unidentified, the methodology suggests a high level of operational security, as the attackers continuously refine their techniques to avoid detection by security software.

Consequences for Regional Security

The use of memory-resident malware that encodes payloads based on specific hardware identifiers presents a significant challenge for incident response teams. For government and infrastructure entities in the region, the reliance on these backdoors suggests that attackers are prioritizing stealthy, long-term intelligence gathering over immediate disruption. The ability of these tools to perform credential dumping and email manipulation means that organizations should prioritize the monitoring of administrative logon events and the hardening of internal network segments to limit the effectiveness of lateral movement tools like Fscan.