OctLurk and SilkLurk Backdoors Fuel Chinese Espionage in Central Asia
Two new sophisticated backdoors, OctLurk and SilkLurk, have been identified in ongoing cyber-espionage campaigns targeting government entities across Central Asia since early 2025.
Security researchers have uncovered two new sophisticated backdoors, dubbed OctLurk and SilkLurk, which have been actively deployed in cyber-espionage campaigns targeting government organizations primarily in Central Asia since January 2025. The identified victims are spread across Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and the Syrian Arab Republic, encompassing critical sectors such as healthcare, research, foreign affairs ministries, law enforcement, and public education.
The threat actor behind these operations, assessed with medium confidence to be Chinese-speaking, employs highly customized loaders for each victim. These loaders are designed to obfuscate their malicious payloads, making analysis difficult. Information gleaned from the victim's machine is used to decrypt the final backdoor payload. Both OctLurk and SilkLurk possess the capability to download and inject additional plugins, expanding their functionality to include credential dumping, network scanning, command shell execution, file system manipulation, and even the synthesis of keyboard and mouse events for more sophisticated interaction.
In addition to the backdoors, the threat actor has deployed a specialized utility named LurkProxy. While sharing a similar architecture with the OctLurk backdoor, LurkProxy is not a backdoor itself but appears to serve a distinct purpose within the campaign's infrastructure. The report notes that some victims infected with SilkLurk also show signs of OctLurk infection, suggesting a coordinated and potentially overlapping deployment strategy by the same actor.
The deployment of OctLurk often begins with the creation of a scheduled task named 'GoogleUpDate' using administrative credentials. This task executes a batch script that, in turn, creates a service named 'NgcCIntSvc'. This service is configured to load a malicious DLL, 'oleasapi.dll', which exports a 'RegisterService' function. This function initiates the malicious execution chain, ultimately leading to the reflective injection of the backdoor into memory.
The OctLurk loader employs a multi-stage decryption process involving double XOR operations and zlib decompression to extract the backdoor DLL from embedded data. The XOR keys used are a combination of a hard-coded key within the loader and a key derived from the victim's C: drive serial number, adding a layer of customization. The backdoor itself then establishes communication with a hard-coded command and control (C2) server, typically on port 443.
Upon establishing a connection, the OctLurk backdoor gathers extensive information from the victim machine, including OS details, computer and user names, local IP addresses, and current date/time. This data is then compressed using zlib and encrypted using a two-stage XOR process: first with a hard-coded string key, and then with a randomly generated 83-byte key. The encrypted data is structured with the random key, compressed data size, compressed data, and additional random bytes before transmission.
The communication protocol involves a 16-byte header specifying the size of the subsequent data packet. The initial packet's last four bytes indicate the size of the next data transmission, facilitating a continuous data flow between the backdoor and its C2 server. The backdoor can then receive commands and download further modules or plugins to execute a wide range of malicious activities, underscoring its role as a versatile espionage tool.
While the specific threat actor behind OctLurk and SilkLurk remains unattributed to any known group, the technical sophistication, targeting of government entities, and the use of custom loaders and obfuscation techniques point to a well-resourced and persistent adversary. The ongoing nature of these campaigns and the broad geographical and sectoral reach highlight a significant cyber-espionage threat in Central Asia.