China-Linked Hackers Deploy 5 New Malware Families Targeting Central Asian Governments

Key Takeaways

• A China-linked cyberespionage campaign, dubbed “SilkParasite,” has been targeting Central Asian governments.
• The campaign leverages five previously unknown malware families: DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, and NodeEdgeRAT, alongside two known Chinese-nexus malware families.
• Attackers use sophisticated techniques like spear-phishing with password-protected archives, document macros, DLL sideloading, and abuse of legitimate cloud services (Google Drive) for stealthy operations.
• The primary objective of SilkParasite appears to be intelligence gathering from critical public-sector networks.
• Defenders must adopt behavioral detection, scrutinize cloud service activity, and implement robust user training against evolving phishing tactics, including those with AI-generated lures.

Government entities across Central Asia are currently facing an advanced cyberespionage campaign, identified by researchers as “SilkParasite.” This operation employs a sophisticated arsenal of remote access tools (RATs) to infiltrate and extract sensitive information from target networks.

The campaign’s modus operandi involves highly convincing, government-themed documents delivered via spear-phishing emails. These documents, often contained within password-protected RAR archives, exploit macros to deploy malware onto victim systems. The attackers meticulously tailor their lures to specific organizations within Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, Kazakhstan, and, in one instance, Georgia.

Bitdefender analysts, in a report shared with Cyber Security News (CSN), have detailed seven distinct malware families utilized in this operation. Crucially, five of these are newly discovered tools: DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, and NodeEdgeRAT. The remaining two, SpiceRAT and BloodAlchemy, have previously been associated with China-nexus cyber activities, indicating a blend of novel and established tactics by the threat actors. The full report, “China-Linked Spy Campaign Uses Five New Malware Families Against Central Asian Governments,” provides in-depth analysis of the campaign’s mechanics.

This evolving threat highlights the increasing vulnerability of public-sector networks responsible for critical economic and diplomatic functions. The attackers deliberately employ a modular approach, utilizing multiple tools and frequently altering supporting files, coupled with the strategic use of cloud services and seemingly normal network traffic to complicate detection and forensic analysis.

China-Linked Spy Campaign Uses Five New Malware Families

Researchers first detected the SilkParasite activity within a Central Asian government agency around October 2025, uncovering an operation that had been active for nearly a year. The evidence points to a medium-confidence link to China-nexus actors, supported by overlaps with SpiceRAT, a malware previously attributed to the SneakyChef group by Cisco Talos, and infrastructure associated with China Unicom. Bitdefender, however, maintains caution in directly attributing the campaign to a specific named group, emphasizing that shared tools alone do not definitively establish command and control.

DriveSilkRAT serves as the operational backbone of the campaign. This RAT leverages a shared Google Drive folder for command and control (C2) communications, dynamically downloading plugins into memory and exfiltrating collected data back through the same cloud service. Analysts observed approximately 65 unique infection identifiers, although this figure represents an upper bound, as a single compromised machine could generate multiple identifiers through hardware fingerprinting.

The other newly identified malware families provide diverse functionalities for network persistence and data exfiltration. CookiETagRAT cleverly embeds C2 commands within HTTP Cookie and ETag headers, while NomadRAT and GoginRAT adopt a stealthy approach by fetching additional functionalities only as needed. NodeEdgeRAT stands out by incorporating a bundled Node.js runtime, and BloodAlchemy offers robust espionage capabilities, including clipboard logging, keystroke capture, and the ability to execute processes under a different user’s session.

A recurring technique observed in the delivery chain is the abuse of DLL sideloading. This method involves a legitimate, digitally signed application loading a malicious dynamic-link library (DLL) placed in the same directory. This tactic, also seen in other campaigns like AsyncRAT sideloading, significantly hinders detection efforts, as the primary executable appears to be a genuine, trusted program.

Defenders Should Hunt Behavior

The SilkParasite campaign underscores that a low number of detected infections does not equate to a limited threat. The modular nature of the group’s tools allows for a small initial footprint, enabling operators to expand capabilities post-compromise. The strategic use of legitimate cloud storage, mirroring trends seen in malware like C2Looper OneDrive, reinforces the critical need to meticulously examine suspicious activities within commonly permitted services.

Researchers noted indications consistent with AI-assisted code generation within the malware, including residual test functions and placeholder encryption keys. While this assessment carries medium confidence, the operational discipline exhibited by the threat actors is undeniable. The malware often bypasses conventional C2 servers, rotates artifacts, and prioritizes in-memory execution to minimize forensic evidence.

What You Should Do

• Enhance Email Security: Implement advanced email filtering to detect and block spear-phishing attempts. Educate users on identifying suspicious emails, especially those containing password-protected attachments or requesting macros to be enabled.
• Disable or Restrict Macros: Configure Microsoft Office and other productivity suites to disable macros by default or to only allow digitally signed macros from trusted sources.
• Monitor DLL Sideloading: Actively monitor for signed applications launching from unusual or temporary directories, particularly when accompanied by unfamiliar DLLs. Implement Endpoint Detection and Response (EDR) solutions capable of detecting such anomalous loading behaviors.
• Audit Cloud Service Activity: Scrutinize outbound connections to legitimate cloud services like Google Drive that do not align with expected user activity patterns. Establish baselines for normal process-to-cloud service interactions to identify deviations.
• Implement Behavior-Based Detection: Focus on detecting malicious behaviors rather than just static signatures. This includes monitoring for suspicious scheduled tasks, unusual process parent-child relationships, and in-memory execution.
• Strengthen User Awareness Training: Conduct regular cybersecurity awareness training for all staff. Emphasize the importance of verifying unexpected password-protected archives through alternative communication channels and reporting any suspicious messages to IT security teams before opening attachments.
• Review IoCs: Integrate the provided Indicators of Compromise (IoCs) into your security information and event management (SIEM) systems, intrusion detection/prevention systems (IDS/IPS), and endpoint protection platforms to detect and block known malicious artifacts.
  

  Type	Indicator	Description
  Domain	evo[.]hoster-kg[.]com	NodeEdgeRAT command-and-control domain impersonating the Kyrgyz hosting provider hoster.kg
  Scheduled task	SysEdgeUpdateTaskMachineCore	NodeEdgeRAT persistence task presented as a Microsoft Edge update job
  Persistence entry	fl_bridge	BloodAlchemy persistence artifact named in the report
  Directory	C:ProgramDataUSOSharedLogs	SpiceRAT copy location used before creating a recurring scheduled task
  Process name	avp.exe	Security product process checked by the delivery macro before execution
  Sideloaded host / DLL	ebook-edit.exe / calibre-launcher.dll	Calibre application and malicious SpiceRAT loader DLL, also tracked as HelpLoader
  Sideloaded host / DLL	FineReader.exe / dsp_ippv2_x64.dll	ABBYY FineReader and malicious BloodAlchemy DLL
  Sideloaded host / DLL	emlproui.exe / scansts.dll	Quick Heal executable and malicious NomadRAT DLL
  Sideloaded host / DLL	MpDefenderCoreService.exe / mpclient.dll	Windows Defender service executable and malicious C++ DriveSilkRAT DLL
  Sideloaded host / DLL	Mp3tag.exe / tak_deco_lib.dll	Mp3tag executable and malicious CookiETagRAT DLL
  Loader DLL	mscorsvc.dll	GoginRAT loader DLL used to decrypt and launch the Go-based orchestrator
  Hardcoded key	0123456789abcdef	Sequential AES key embedded in GoginRAT
  Configuration value	change_this_key	Placeholder encryption-key value found in NodeEdgeRAT configuration

  Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.