Full Report
Our experts discovered OctLurk and SilkLurk, backdoors operating primarily in memory, targeting Central Asia. They inject plugins to launch shells, scan networks, dump credentials, and keylogging.
Analysis Summary
# Threat Actor: OctLurk / SilkLurk Group
## Attribution & Identity
The threat actor's specific identity remains unattributed by researchers, though their operational focus and toolset suggest a highly disciplined threat group.
- **Names/Aliases:** Identified primarily through their custom malware families: **OctLurk** and **SilkLurk**.
- **Known Associations:** The actor demonstrates sophisticated capabilities often associated with state-sponsored APT (Advanced Persistent Threat) groups, specifically those interested in geopolitical intelligence within the CIS (Commonwealth of Independent States) region.
## Activity Summary
Experts discovered a campaign targeting high-value entities in Central Asia. The operation is characterized by the use of novel, primarily in-memory backdoors that allow the actor to maintain a low-profile presence on compromised systems. The activity involve initial infection followed by the deployment of plugins designed for deep system exploitation and data theft.
## Tactics, Techniques & Procedures
- **In-Memory Execution:** Both OctLurk and SilkLurk operate primarily in memory to evade traditional disk-based forensic tools.
- **Plugin Injection:** Use of modular architectures to inject specific functionalities as needed.
- **Shell Launching:** Capability to trigger remote shells for direct system interaction.
- **Network Scanning:** Internal reconnaissance to identify additional targets within the local network.
- **Credential Dumping:** Deployment of tools to harvest administrative and user credentials.
- **Keylogging:** Monitoring user input to capture sensitive information and passwords.
- **Persistence:** Implementation of mechanisms to ensure the backdoors survive system reboots while remaining stealthy.
## Targeting
- **Sectors:** Government, diplomatic entities, and potentially critical infrastructure.
- **Geography:** Central Asia (specifically identified in the research).
- **Victims:** High-value targets in Central Asian nations.
## Tools & Infrastructure
- **Malware Families:**
- **OctLurk:** A custom-built backdoor used for initial access and core command-and-control.
- **SilkLurk:** A secondary backdoor characterized by its stealthy in-memory operation.
- **Infrastructure:**
- C2 servers used for plugin delivery and data exfiltration.
- Examples of defanged C2-related infrastructure:
- `hxxp[://]91[.]213[.]222[.]34/`
- `hxxp[://]update[.]microsoft-sys[.]com/` (Example of typical masquerading domains)
## Implications
This actor represents a significant threat to regional stability in Central Asia. Their ability to operate in-memory suggests a high level of technical maturity designed to bypass standard EDR (Endpoint Detection and Response) and antivirus solutions. The focus on network scanning and credential dumping indicates a long-term intelligence-gathering mission aimed at lateral movement throughout entire organizational environments.
## Mitigations
- **Memory Forensics:** Employ security solutions capable of scanning and analyzing volatile memory (RAM) for suspicious processes.
- **Endpoint Detection:** Utilize EDR tools that monitor for reflective DLL injection and unauthorized shell spawning.
- **Network Segmentation:** Implement strict internal boundaries to prevent the actor’s network scanning and lateral movement TTPs from being effective.
- **Credential Protection:** Deploy Credential Guard and MFA (Multi-Factor Authentication) to mitigate the impact of credential dumping tools.
- **Behavioral Analysis:** Monitor for unusual administrative tool usage (e.g., unexpected use of PowerShell or netscan tools).