New Backdoors OctLurk and SilkLurk Discovered in Central Asia Cyber Attacks
Cybersecurity researchers have identified two new backdoors, OctLurk and SilkLurk, that have been used in targeted attacks against government organizations in Central Asia since January 2025. The affected countries include Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and Syria, with victims spanning various sectors such as healthcare, research, and law enforcement.
Both backdoors are customized for each victim, utilizing information from the compromised machines to decrypt their payloads. The complexity of their obfuscation poses significant challenges for analysis. OctLurk and SilkLurk are capable of downloading and injecting additional plugins to execute a range of malicious actions, including launching command shells, performing file system activities, and stealing credentials. A specialized utility named LurkProxy has also been deployed, which, while similar in architecture to OctLurk, serves a different function.
Investigations indicate that the same threat actor operates both backdoors, with evidence suggesting they are Chinese-speaking. However, no specific group has been attributed to these activities as of the publication date. The attackers have employed various techniques, including creating scheduled tasks on remote machines to execute malicious scripts with system privileges.
For instance, a scheduled task named GoogleUpDate was created to run a batch script that collects extensive information about the victim's hardware and software configurations. The attackers also utilized tools to extract password hashes from domain controllers and deployed keyloggers to capture sensitive information.
The OctLurk backdoor is particularly notable for its ability to load plugins directly from the command-and-control (C2) server into memory, allowing for a wide range of operations. The backdoor employs a double-XOR encryption method for data transmission, ensuring that the collected information is securely encrypted before being sent to the C2 server.
In addition to OctLurk, the SilkLurk backdoor has been observed using legitimate binaries to load malicious DLLs, further complicating detection efforts. The attackers have demonstrated a high level of sophistication in their methods, including the use of custom algorithms for decryption and the establishment of persistent connections to their C2 servers.
As the investigation continues, the cybersecurity community remains vigilant in monitoring these threats, emphasizing the need for enhanced security measures to protect against such tailored cyber-espionage campaigns.
