Kaspersky has recognized two beforehand undocumented Home windows backdoors in a cyber-espionage marketing campaign focusing on authorities organizations and public establishments in Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan and the Syrian Arab Republic since January 2025. The corporate named the malware OctLurk and SilkLurk.
In response to Kaspersky’s report, the affected organizations embody healthcare and analysis our bodies, authorities workplaces, international ministries, logistics suppliers, law-enforcement companies, city planning departments, amenities managers and public instructional establishments.
Researchers word that every an infection is ready for a selected pc. OctLurk derives a part of its decryption key from the serial variety of the C drive, whereas SilkLurk computes a hash from the pc title. These values unlock the payload path and malicious code, making every loader particular to its meant sufferer.
On contaminated computer systems, OctLurk is put in by way of scheduled duties and malicious Home windows companies after the attacker obtains administrative credentials. SilkLurk makes use of respectable NVIDIA and Realtek applications to side-load malicious DLLs, then creates a service that restarts after a failure. Each backdoors place their predominant elements into reminiscence whereas leaving a small loader on disk.
After connecting to command servers, OctLurk and SilkLurk can obtain and inject extra plugins into reminiscence. These elements give the operator command-shell entry, file administration, keyboard and mouse management, community scanning, credential dumping, keylogging, browser password theft, e-mail assortment and distant entry.
Throughout OctLurk infections, Kaspersky noticed the attackers amassing system and community particulars earlier than deploying instruments equivalent to Impacket’s secretsdump, a keylogger, a browser password extractor and the Fscan community scanner. In addition they put in Pandora remote-control brokers and linked on to e-mail servers utilizing account credentials.
SilkLurk was used to open PowerShell, hook up with shared community sources with administrative credentials and seek for confidential paperwork. The attackers compressed collected materials with WinRAR or 7-Zip, disconnected from community shares to cover which inside servers had been accessed, and put in the PlugX remote-access malware as a second-stage payload.
Alongside the 2 backdoors, the attackers deployed LurkProxy, a separate implant constructed with a design much like OctLurk. Kaspersky stated LurkProxy will not be a backdoor. Its predominant function is to relay community site visitors by way of a TLS-encrypted connection, working as both a SOCKS5 or clear reverse proxy.
Kaspersky’s technical report, revealed on July 30, 2026, additionally linked a part of the command infrastructure to a March 2025 marketing campaign focusing on vital infrastructure in Kazakhstan with Linux malware often called TrustFall, MystRodX or SilentRaid.
Researchers additionally discovered that three command-server addresses from that marketing campaign have been utilized by OctLurk and LurkProxy, though Kaspersky couldn’t decide whether or not the operations ran on the similar time.
Proof of widespread management appeared on the contaminated programs themselves. Some victims had each backdoors; the malware generally used the identical staging directories, and Kaspersky noticed an OctLurk command shell ship a SilkLurk loader.
Kaspersky assesses with medium confidence {that a} Chinese language-speaking actor operates each backdoors. The usage of PlugX, which has an extended historical past amongst Chinese language-speaking teams, helps that evaluation, however researchers haven’t attributed the marketing campaign to any identified risk group.
Kaspersky revealed file hashes, domains, IP addresses, and file paths that organizations can use to seek for associated exercise. Extra indicators can be found to subscribers of its risk intelligence service.
