SilkParasite Espionage Campaign Targets Central Asian Governments with Five New RATs

A previously unreported cyber espionage operation dubbed SilkParasite has been observed targeting government bodies in Central Asia.

The intrusion set makes use of seven remote access tool (RAT) families, five of which have never been previously documented: DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, and NodeEdgeRAT.

## AI-Assisted Development in SilkParasite

"What makes SilkParasite interesting is the traces of AI-assisted development running through otherwise expert code, which is a different thing from AI-generated malware," Bitdefender Labs said in a technical report shared with The Hacker News.

Unlike other operations that rely on AI-generated malware, SilkParasite's arsenal exhibits all hallmarks typically associated with professional espionage tooling that's developed by a team of human operators while AI is likely used to streamline the process.

The Romanian cybersecurity vendor said the clearest sign of the technology use comes from a phishing lure that's indubitably AI-generated. It's also the only place the adversary seems to have been sloppy, which has raised the possibility that it may have been a deliberate choice to confuse attribution efforts.

## Connection to China-Nexus Threat Cluster

SilkParasite is the third prominent threat actor to strike Central Asia in recent years, after UAC-0063 and FamousSparrow. One notable aspect that ties the operation to China is the use of a backdoor dubbed BLOODALCHEMY, which is an updated version of Deed RAT, itself a successor to ShadowPad. ShadowPad, for its part, is an evolution of PlugX. Both ShadowPad and PlugX are widely put to use by Chinese hacking groups.

## Modular System and Plugin-Oriented Architecture

Almost every single tool deployed over the course of the attack implements a plugin-oriented architecture that allows the operators to expand its capabilities at will, while selectively serving payloads that can better adapt to the victim environment and keeping the detection footprint small.

What's more, the modular system offers another crucial advantage in that it enables the threat actors to upgrade the components' capabilities without having to replace the underlying foundations. The seven implants span four different programming languages -- .NET, C++, Go, and JavaScript -- and use DLL sideloading as the main delivery vector.

### Comparison of Malware Families

| Family | Programming Language | Description | | --- | --- | --- | | DriveSilkRAT | .NET/C++ | Uses Google Drive as command-and-control (C2) to poll a specific folder for tasking, run it through an in-memory .NET plugin system, and upload the results of the execution back to the same folder. | | CookiETagRAT | C++ | Uses HTTP Cookie / ETag response headers as C2 to receive and execute commands. | | NomadRAT | C++ | Features a main orchestrator, a dedicated transmitter library that handles all C2 traffic, and plugins fetched from the server by numeric identifiers only when they are required. | | GoginRAT | Go | Has architectural similarities with NomadRAT and uses a separate transmitter for C2, and implements file system and shell capabilities as independent plugins. | | NodeEdgeRAT | JavaScript | Ships its entire functionality spanning command execution, file management, and file transfer in one script. |

## Detection and Attribution

The most consistent detection surface across the campaign is DLL sideloading, and the reliable signal is the pairing, not the DLL name alone: a legitimately signed application loading a library placed beside it while running from an unusual location.

"More broadly, low-footprint plugin-based implants operating through legitimate cloud services are poorly served by volume-based detection. Catching them reliably takes behavioral baselines that flag unusual relationships between processes and network services, rather than signatures for any single artifact.