OctLurk and SilkLurk: modular backdoors in Central Asia

Kaspersky has documented a sustained espionage campaign focused on government and public-sector organisations in Central Asia. The operator uses three newly described tools: the OctLurk and SilkLurk backdoors and a specialised LurkProxy relay. Activity has been observed since at least January 2025 across Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan and Syria.

Researchers found language and infrastructure clues suggesting a Chinese-speaking operator, but the campaign has not been attributed to a known group. Similar tools or server overlaps are analytical leads, not proof of an operator’s identity.

Three parts of one toolkit

The full Securelist analysis describes an architecture built for quiet, selective expansion after initial access.

OctLurk is injected into memory by a loader. It gathers host information, encrypts it and sends it to a hard-coded command-and-control server. It can then receive plugins executed directly in memory. The operator does not need to deploy every capability at once and can select modules according to the value of each host.

SilkLurk starts through DLL side-loading, where a legitimate executable loads an attacker-controlled library. The backdoor connects to C2 over TCP, receives configuration and injects further modules into memory. In observed cases it also supported document staging, archive creation and PlugX deployment.

LurkProxy operates as a reverse proxy in either SOCKS5 or transparent mode. A compromised endpoint can therefore become an entry point to internal services and a source of traffic that appears to originate from the victim network.

Why host-bound decoding matters

OctLurk binds payload decoding to information including a drive serial number, while SilkLurk uses the computer name. A sample moved to a different analysis machine may fail to reveal the correct code. This goes beyond generic obfuscation: an artefact is tailored to its target and behaves poorly in an arbitrary sandbox.

Defenders should not rely on copying one suspicious file into a lab. Preserve host context, process memory, execution trees and environment parameters. Memory forensics and EDR telemetry become more important than the file hash alone.

What the operator does after access

The modules documented by Kaspersky support command execution, file operations, clipboard access, screenshots, synthetic mouse and keyboard input, and network discovery. In observed intrusions the attackers:

• exported successful remote-logon events;
• used Impacket’s secretsdump.py to collect hashes from domain controllers;
• launched a keylogger masquerading as AnyDesk;
• extracted passwords from Chrome and Firefox;
• deployed Pandora RC for remote access;
• scanned networks with Fscan and attempted access to SSH and MySQL;
• connected to mail servers to collect or manipulate messages;
• archived documents with WinRAR or 7-Zip and staged them on network shares.

This is a path from one workstation into the domain, mail and document estates. Detecting one loader does not close the incident. Responders must determine which identities were compromised and where the proxy routed traffic.

Detection priorities

Domains and IP addresses from one report will age quickly, so behaviour should drive the durable detection layer. A SOC should correlate:

1. Unusual legitimate-EXE and DLL pairs loading from user folders or extracted archives.
2. Processes performing memory injection and maintaining long-lived TCP sessions without an expected application protocol.
3. secretsdump execution, browser-database access, LSASS dumping and logon-event exports.
4. New archives created immediately before transfer and bulk reads from document shares.
5. SOCKS5 or tunneled traffic from endpoints with no legitimate proxy role.
6. An “AnyDesk” process launched from an unusual path or whose signature and hash do not match the approved package.

If these behaviours are found, isolating one workstation is insufficient. Preserve memory and artefacts, revoke affected credentials from a clean system, inspect domain controllers, mail servers and hosts reachable through the tunnel, and hunt for staged archives.

Who is exposed

The report names government, foreign ministries, healthcare, research, logistics, law enforcement, urban planning, facilities management and education. That does not make private organisations outside the region immune. The tooling is portable, and its post-exploitation chain fits any target with directory services, email and valuable documents.

Organisations working with public-sector partners in the region should review telemetry, supplier access and remote accounts. Use a disciplined Cyber Threat Intelligence lifecycle and connect findings to an executable incident-response plan.

Primary facts versus Breachroad analysis

The malware names, module descriptions, affected sectors and observed actions come from Kaspersky’s telemetry and reverse engineering. The initial-access vector remains unknown, and the activity has not been attributed to a specific known group. Infrastructure overlaps with other clusters do not settle authorship.

Breachroad’s conclusion is to prioritise behavioural detection, memory analysis and a complete identity review after finding tunnelling or credential dumping. Cybersecurity training for technical teams teaches analysts to turn artefacts into an attack narrative, while an IT security audit can assess segmentation, EDR, domain controllers and response readiness.