Full Report
A Chinese-speaking threat actor is suspected to be behind a fresh wave of cyber attacks targeting government organizations mainly located in Central Asia, including Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and the Syrian Arab Republic, since January 2025. These targeted organizations operate across several sectors, such as healthcare, research, government offices,
Analysis Summary
# Threat Actor: Unnamed (Suspected Chinese-Speaking Actor)
## Attribution & Identity
* **Actor Identification:** A suspected Chinese-speaking threat actor.
* **Aliases:** Currently not linked to any known named adversary or group (Untracked).
* **Known Associations:** Uses tools commonly associated with Chinese state-sponsored activity, such as **PlugX**.
## Activity Summary
Since January 2025, this actor has been conducting a wave of cyber-espionage operations targeting government and critical infrastructure across Central Asia and the Syrian Arab Republic. The campaign is characterized by the deployment of previously undocumented backdoors (OctLurk and SilkLurk) to facilitate long-term access, data exfiltration, and internal network reconnaissance.
## Tactics, Techniques & Procedures
* **Credential Access:** Harvesting password hashes from Domain Controllers using Impacket’s `secretsdump.py`; decrypting passwords from Google Chrome and Mozilla Firefox.
* **Discovery:** Host fingerprinting; network scanning using **Fscan** for SSH (port 22) and MySQL (port 3306); querying logon events for specific users.
* **Collection:** Email collection and manipulation; gathering clipboard content; screen captures; keylogging.
* **Execution:** DLL Side-loading; memory injection of plugins; launching PowerShell and command shells.
* **Lateral Movement:** Connecting to network shares with administrative credentials.
* **Exfiltration:** Staging confidential documents and archiving them using WinRAR and 7-Zip.
* **Defense Evasion:** Masquerading malicious files as legitimate software (e.g., AnyDesk); using obfuscated backdoors; injecting code directly into memory.
* **MITRE ATT&CK IDs:**
* T1574.002 (DLL Side-Loading)
* T1003 (OS Credential Dumping)
* T1056.001 (Keylogging)
* T1560 (Archive Collected Data)
* T1046 (Network Service Scanning)
* T1090 (Proxy)
## Targeting
* **Sectors:** Healthcare, Research, Government offices, Ministries of Foreign Affairs, Logistics, Law-enforcement agencies, Urban planning, Facilities management, and Public educational establishments.
* **Geography:** Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and the Syrian Arab Republic.
* **Victims:** Government organizations and critical infrastructure entities within the specified regions.
## Tools & Infrastructure
* **Malware Families:**
* **OctLurk:** Obfuscated backdoor for system info collection and plugin injection.
* **SilkLurk:** DLL-based backdoor used for persistence and executing post-compromise commands.
* **LurkProxy:** A specialized utility for proxying network traffic (SOCKS5/Transparent modes).
* **PlugX:** Well-known RAT used in the final stages of the chain.
* **Pandora RC:** Used for establishing remote access.
* **Infrastructure (Defanged):**
* **C2 Domains:**
* dns.ssentialserv[.]xyz (Connectivity check)
* dns.multitoconference[.]com (OctLurk C2)
* **C2 IPs:**
* 154.196.162[.]76 (LurkProxy C2)
## Implications
This actor demonstrates a high level of sophistication, specifically in their ability to develop custom toolsets (OctLurk/SilkLurk) to bypass traditional detections. The targeting of Ministries of Foreign Affairs and law enforcement across Central Asia suggests a strategic intelligence-gathering mission likely aligned with regional geopolitical interests. The use of proxy tools (LurkProxy) indicates a focus on maintaining a stealthy footprint within sensitive government networks.
## Mitigations
* **Implement DLL Side-loading Protections:** Monitor for unusual DLL loads in directories where legitimate executables reside.
* **Credential Guarding:** Enable Windows Defender Credential Guard to prevent tools like `secretsdump.py` from accessing LSASS memory.
* **Network Segmentation:** Restrict lateral movement by segmenting administrative environments and monitoring for unauthorized connections to network shares.
* **Endpoint Monitoring:** Deploy EDR solutions to detect memory injection techniques and the execution of reconnaissance tools like Fscan.
* **Audit Logons:** Monitor for "Remote Interactive Logon" events (Event ID 4624) and anomalous domain controller queries.