SilkParasite Espionage Campaign Unleashes Five New RATs on Central Asian Governments

A sophisticated cyber espionage operation called SilkParasite has been caught targeting government bodies across Central Asia using seven remote access tools — five of which have never been documented before — in a campaign assessed with medium confidence to be China-linked.

First uncovered in late 2025 and publicly detailed by Bitdefender Labs in August 2026, SilkParasite represents a significant escalation in state-level cyber activity directed at the region. The campaign's technical sophistication, regional tailoring, and novel malware arsenal make it one of the more consequential espionage operations to emerge from Central Asia in recent years. To understand the broader threat landscape this campaign operates within, it helps to have a solid grounding in the different types of malware and how they are typically classified and deployed.

What Makes SilkParasite Different

Cybersecurity researchers at Bitdefender Labs — who shared their technical findings exclusively with The Hacker News — describe SilkParasite as a deliberate departure from the growing trend of fully AI-generated malware.

"What makes SilkParasite interesting is the traces of AI-assisted development running through otherwise expert code, which is a different thing from AI-generated malware," Bitdefender Labs said in its report.

The distinction matters. Rather than relying on AI to write malware from scratch, SilkParasite's operators appear to use AI to accelerate and streamline a development process that remains fundamentally human-driven. The hallmarks of professional espionage tooling — careful architecture, modular design, and multi-language implementation — are all present, and they point to a threat actor operating at a level well above opportunistic intrusion groups.

The Role of AI-Assisted Development

The clearest evidence of AI involvement appears in a phishing lure that Bitdefender describes as "indubitably AI-generated." Researchers note this may have been a deliberate choice to obscure attribution — a kind of operational misdirection that calls to mind the layered deception tactics of Cold War-era intelligence tradecraft.

Additional AI indicators surface in GoginRAT, which ships with Go test functions and a hard-coded AES key set to "0123456789abcdef". NodeEdgeRAT carries a configuration field for an encryption key literally labeled "change_this_key" — both consistent with AI-assisted code generation that was not fully sanitised before deployment. These artefacts suggest a pipeline where AI accelerates development velocity but human review steps were either abbreviated or skipped entirely.

The shared architectural design between NomadRAT and GoginRAT — essentially the same high-level blueprint implemented in two separate programming languages — further reinforces the case for AI-assisted development workflows, where a single structural template is translated across language environments rather than designed independently from the ground up.

The Malware Arsenal

SilkParasite deploys seven implants written across four programming languages — .NET, C++, Go, and JavaScript — with DLL sideloading as the primary delivery mechanism. Five of these tools are newly documented, making this one of the more significant introductions of novel espionage tooling in a single campaign in recent years.

Newly Documented Implants

• DriveSilkRAT (.NET/C++) uses Google Drive as its command-and-control channel, polling a specific folder for instructions and uploading results back to the same location. It supports 12 plugins covering process listing, system and network enumeration, file management, and command execution. Bitdefender observed roughly 65 infected instances, most concentrated in Asia.

• CookiETagRAT (C++) conceals its command-and-control traffic inside HTTP Cookie and ETag response headers — a technique engineered to blend into normal web traffic and evade inspection tools that rely on anomalous connection patterns.

• NomadRAT (C++) uses a modular orchestrator-and-transmitter architecture with plugins fetched from the server only when needed, keeping its detection footprint deliberately minimal.

• GoginRAT (Go) mirrors NomadRAT's architecture and implements file system and shell capabilities as independent plugins, with results routed through a shared callback.

• NodeEdgeRAT (JavaScript) consolidates command execution, file management, and file transfer into a single script — an unusual choice of language for a RAT, likely reflecting the flexibility and cross-platform compatibility JavaScript runtimes can offer in enterprise environments.

Previously Documented Tools

Two additional tools round out the arsenal. BLOODALCHEMY — first documented by Elastic Security Labs in October 2023 — is a C-based backdoor and an updated version of Deed RAT, itself a successor to ShadowPad. Both ShadowPad and its predecessor PlugX are widely associated with Chinese hacking groups. The campaign also deploys an improved variant of SpiceRAT, attributed to a Chinese-speaking threat actor known as SneakyChef.

The reuse and evolution of these established tools alongside five novel implants is a notable operational choice. It suggests the threat actor is capable of sustaining parallel development tracks — maintaining legacy tooling for proven use cases while investing in new capabilities that carry no prior detection signatures.

Every tool in the SilkParasite arsenal uses a plugin-oriented architecture. This design keeps the detection footprint small by serving only the payloads needed for a given target, while enabling operators to upgrade components without rebuilding core infrastructure — a level of operational discipline more commonly associated with advanced persistent threat actors conducting long-term strategic intrusion campaigns.

How the Attacks Unfold

Initial Access and Delivery

Attack chains begin with password-protected RAR archives containing malicious Microsoft Office documents delivered via spear-phishing emails. The password to open the archive is included in the email body — a simple social engineering mechanism that bypasses automated sandbox detonation while placing the burden of activation on the target. Once the document is opened, a macro triggers a DLL sideloading sequence to drop the first-stage payload.

"The lures were regionally tailored," Bitdefender noted. Recovered documents were crafted to appear relevant to government entities in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, and Kazakhstan — with several impersonating specific ministries. A separate document recovered from a public malware-sharing platform was addressed to a Georgian government entity.

Evasion and Persistence

One particularly telling operational detail: the macro checks whether Kaspersky antivirus software is installed and running before execution. Given Kaspersky's prevalence across the region, this check reflects a precise, environment-aware attempt to evade detection in the specific infrastructure the attackers expected to encounter. It is not a generic evasion technique — it is targeted tradecraft.

This level of operational preparation — from regionally appropriate phishing lures to antivirus-aware execution logic — is characteristic of a well-resourced actor with sustained intelligence about its target environment. Understanding how campaigns like SilkParasite are tracked and analysed is central to building effective defences; organisations investing in structured cyber threat intelligence programmes are better positioned to detect these patterns before they result in a breach.

Detection Challenges

"More broadly, low-footprint plugin-based implants operating through legitimate cloud services are poorly served by volume-based detection," Bitdefender warned. "Catching them reliably takes behavioral baselines that flag unusual relationships between processes and network services, rather than signatures for any single artifact."

DriveSilkRAT's use of Google Drive as a command-and-control channel is a clear illustration of this problem. Traffic to Google Drive is not inherently suspicious — which is precisely what makes it effective as a covert channel. Defenders cannot rely on blocking known-bad infrastructure when the infrastructure in question is legitimate cloud services used by millions of organisations worldwide.

Broader Regional Context

SilkParasite is the third major threat actor to strike Central Asia in recent years, following UAC-0063 and FamousSparrow — a pattern that signals the region has become a sustained and deliberate focus of state-level cyber operations. The geographic consistency across these campaigns, combined with the tailoring evident in SilkParasite's lure documents, suggests that Central Asian government networks are being treated as a persistent intelligence priority rather than targets of opportunity.

Defensive Priorities for Government Security Teams

For government IT and security teams, this campaign surfaces several concrete operational priorities.

Monitoring for DLL sideloading events — particularly legitimately signed applications loading libraries from unusual filesystem locations — provides the most consistent detection surface across this campaign and across the broader class of implants that use this delivery mechanism.

Behavioural baselines that track relationships between processes and outbound network connections to cloud services like Google Drive are more effective than signature-based detection against this class of implant. A process that has no legitimate business reason to communicate with a cloud storage API should be flagged and investigated, regardless of whether that API is inherently suspicious.

Spear-phishing remains the entry point, and strict macro execution policies combined with targeted staff awareness training — particularly for personnel in ministries and government agencies likely to receive external correspondence — continue to represent the highest-value defensive investment against intrusions of this type. Password-protected archives are a known technique for bypassing email gateway scanning, and filtering or quarantining such attachments at the perimeter is a practical first-line measure that many organisations have yet to implement consistently.

---

For further technical detail on the SilkParasite campaign, Bitdefender Labs' full report is available via the Bitdefender Labs research blog.