SilkParasite: Tracking a China-Nexus APT Across Central Asia

What Happened

A cyberespionage campaign called SilkParasite, attributed to a China-linked group at medium confidence, has been targeting government agencies in Central Asia for about a year. The attackers used seven different remote access tools, five of which were newly discovered and named by Bitdefender. The campaign primarily gains access through phishing emails with malicious documents disguised as official government correspondence. Once inside, the attackers use a technique called DLL sideloading, where they place malicious code next to legitimate, signed software so it runs without raising alarms. One of the tools communicates through Google Drive, making its traffic look like normal cloud usage. The malware is professionally built with modular designs, and researchers found evidence that AI tools were used to assist development, though the core engineering remains human-driven. Organizations with interests or operations in Central Asia should review their endpoint detection for DLL sideloading behavior and monitor for unusual cloud service traffic.

Key Takeaways

• SilkParasite is a China-nexus cyberespionage operation targeting Central Asian government bodies involved in economic decision-making, active for approximately one year.
• Seven RAT families were identified: DriveSilkRAT, SpiceRAT, CookiETagRAT, BloodAlchemy, NomadRAT, GoginRAT, and NodeEdgeRAT. Five were previously undocumented.
• DLL sideloading is the primary delivery mechanism across all families, with six different signed host applications abused, each loading a differently named malicious DLL.
• DriveSilkRAT uses Google Drive as a C2 channel (living off trusted services), polling a shared folder for command files and uploading results, blending into legitimate traffic.
• Traces of AI-assisted development were found in otherwise professionally engineered code, including leftover Go test functions, a sequential placeholder AES key, and a literal 'change_this_key' config field.

Affected Systems

• Microsoft Windows endpoints (all variants targeted Windows)
• Microsoft Office (macro-enabled documents used for initial access)
• Government bodies in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, Kazakhstan, and Georgia

Vulnerabilities (CVEs)

None identified.

Attack Chain

1. Initial Access: Spear-phishing emails deliver password-protected RAR archives containing malicious Microsoft Office documents with regionally tailored government lures
2. Execution: Office macro checks for Kaspersky avp.exe process, then drops signed-application sideloading chain to disk and launches first-stage payload (SpiceRAT or DriveSilkRAT)
3. Defense Evasion: Malicious DLLs are loaded by legitimately signed host applications (Calibre, ABBYY FineReader, Quick Heal, Windows Defender, Mp3tag) from their own directories, executing inside trusted processes
4. Persistence: Implants copy themselves to system directories (e.g., C:\ProgramData\USOShared\Logs) and create scheduled tasks (SysEdgeUpdateTaskMachineCore, fl_bridge) disguised as system maintenance jobs
5. Command and Control: DriveSilkRAT polls a shared Google Drive folder for tasking and uploads results; other families use HTTP/HTTPS, TCP, DNS, or HTTP Cookie/ETag headers for C2
6. Discovery and Collection: Modular plugins fetched on demand from C2 provide process listing, system/network enumeration, file management, clipboard logging, and keylogging capabilities

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No
• Platforms: Bitdefender GitHub IOC repository, Bitdefender IntelliZone

The full IOC set is available in Bitdefender's GitHub IOC repository and through Bitdefender IntelliZone. The complete technical analysis including protocol documentation and full MITRE ATT&CK mapping is in the accompanying full research report. No detection rules are reproduced in this article.

Detection Engineering Assessment

Required Log Sources

• Windows Sysmon Event ID 7 (Image loaded - for DLL sideloading detection)
• Windows Sysmon Event ID 1 (Process creation - for WMI and unusual parent-child relationships)
• Windows Scheduled Task logs (Event ID 4698)
• Network proxy logs with TLS SNI and destination domain visibility
• EDR process telemetry including module loading events
• Google Drive API audit logs (if available via Google Workspace)

Hunting Hypotheses

Control Gaps

• Signature-based antivirus may not detect novel RAT families with no public signatures
• Network-based detection relying on domain reputation will miss Google Drive C2 traffic routed through legitimate Google infrastructure
• Application allowlisting based on signed binary hashes will not catch DLL sideloading where the signed host executable is legitimate
• Static import analysis will miss SpiceRAT variants that resolve Windows APIs dynamically by hash
• Userland API hooking by EDR products will be bypassed by BloodAlchemy's HalosGate technique combined with hardware breakpoints and vectored exception handlers
• Email gateway sandboxing may be bypassed by password-protected RAR archives containing the malicious documents

Key Behavioral Indicators

• Signed application executables (ebook-edit.exe, FineReader.exe, emlproui.exe, MpDefenderCoreService.exe, Mp3tag.exe) running from non-standard directories
• DLL files (calibre-launcher.dll, dsp_ippv2_x64.dll, scansts.dll, mpclient.dll, tak_deco_lib.dll, mscorsvc.dll) loaded by their respective signed host applications
• Process execution via WMI without cmd.exe in the process ancestry chain
• Scheduled tasks named SysEdgeUpdateTaskMachineCore or fl_bridge
• Files with .hlp extension in non-standard locations (SpiceRAT payload disguise)
• Google Drive API traffic from non-browser, non-Drive-client processes
• HTTP responses with abnormally large Cookie or ETag header values
• Presence of Node.js runtime executing obfuscated JavaScript from non-standard locations

False Positive Assessment

Recommendations

Immediate Mitigation

Infrastructure Hardening

• Consider evaluating whether Google Drive and other trusted cloud services can be monitored at the network level for process-to-destination correlation, since DriveSilkRAT uses Google Drive as a C2 channel.
• If applicable, consider implementing network segmentation policies that restrict which processes or endpoints can initiate outbound connections to consumer cloud storage platforms.
• Consider reviewing proxy and firewall configurations to inspect HTTP Cookie and ETag headers for anomalous payload sizes, as CookiETagRAT uses these headers for C2 communication.
• Where supported by your EDR, consider enabling module loading telemetry to detect DLL sideloading behavior based on the pairing of signed executables with unexpected DLLs in non-standard directories.

User Protection

• Consider deploying behavioral endpoint detection rules that flag signed applications executing from temp, AppData, or ProgramData directories, as this is the primary delivery mechanism across all seven RAT families.
• If your EDR supports it, consider enabling WMI activity monitoring to detect process creation via WMI that bypasses normal cmd.exe parent-child chains.
• Consider evaluating whether your endpoint protection can detect HalosGate-style syscall evasion techniques used in combination with hardware breakpoints and vectored exception handlers.

Security Awareness

• Consider updating phishing awareness training to emphasize that lure quality is no longer a reliable indicator of threat legitimacy. SilkParasite deliberately used low-quality, AI-generated lures to blend into the AI-generated content targets receive daily.
• Consider training users in Central Asian government-facing roles to treat unsolicited Office documents in password-protected archives as high-risk, even when the sender appears legitimate.
• If applicable, consider briefing staff on the risk of regionally tailored phishing lures impersonating specific government ministries, as recovered documents targeted entities in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, Kazakhstan, and Georgia.

MITRE ATT&CK Mapping

Additional IOCs

• File Paths:
  • C:\ProgramData\USOShared\Logs\ - SpiceRAT copies itself into this directory for persistence, disguised as Windows Update Orchestrator log files
• Command Lines:
  • Purpose: Process execution via WMI instead of cmd.exe to break parent-child process chain | Tools: wmic, WMI | Stage: Execution | wmic process call create
  • Purpose: Scheduled task creation for persistence, relaunching implant every two minutes (SpiceRAT) | Tools: schtasks | Stage: Persistence | schtasks /create /tn <taskname> /tr
• Other:
  • 0123456789abcdef - Hardcoded sequential placeholder AES key found in GoginRAT binary, indicative of AI-assisted development residue
  • change_this_key - Literal placeholder string found in NodeEdgeRAT configuration field for encryption key, never replaced before deployment
  • avp.exe - Kaspersky antivirus process name checked by SpiceRAT delivery macro before executing payload; macro adapts behavior if detected