Kaspersky researchers have uncovered two previously unknown backdoors, OctLurk and SilkLurk, used in a cyber espionage campaign against government organizations across Central Asia that has been running since January 2025. Victims sit in Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan and Syria, spanning ministries of foreign affairs, law enforcement agencies, healthcare and research bodies, logistics firms, urban planning offices and public schools.
The standout detail is how carefully the attackers tailored the malware. Each loader is customized for its target and pulls information from the victim's own machine to decrypt its payload, using two keys: one hard coded into the loader, and one derived from the serial number of the machine's C: drive. Lift the file onto any other computer and it produces nothing. Both loaders and backdoors are heavily obfuscated on top of that, and the backdoors run primarily in memory rather than on disk.
How the intrusions work
The attackers already hold administrator credentials by the time these tools appear. On one victim they created a scheduled task named GoogleUpDate that ran a batch script as SYSTEM, which in turn registered a Windows service called NgcCIntSvc pointing at a loader DLL. Legitimate sounding service names recur throughout the campaign, including specitsrc, cmtastsvc, PNRPHostSvc, vmictimerosync and vmicagent. The loader reflectively injects the backdoor into memory and calls its entry point, at which point the backdoor opens a socket to a hard coded command server on port 443 and ships back OS version, computer name, username, local IP and timestamp, encrypted with a hard coded XOR key plus 83 randomly generated bytes.
Both backdoors are plugin driven, and the plugin set is a full espionage toolkit: command shells, file operations, synthetic keyboard and mouse events, network scanning, credential dumping, keylogging, browser password theft, email collection and remote access. A related utility Kaspersky named LurkProxy shares OctLurk's architecture but tunnels traffic rather than acting as a backdoor.
Living off borrowed tools
Alongside the custom implants, the operators lean heavily on off the shelf software. They ran a compiled build of Impacket's secretsdump against domain controllers to pull password hashes, then immediately enumerated the Domain Controllers group to find more machines worth hitting. A keylogger planted at C:\Users\Public\Pictures\AnyDesk.exe writes keystrokes and clipboard contents to two files, obfuscated by subtracting 2 from every byte. A browser password decryptor lifts saved credentials from Chrome and Firefox profiles, the fscan scanner sweeps internal and public networks for SSH and MySQL services to brute force, and Pandora RC agents are installed for hands on remote control. Mailboxes are drained with plain curl commands against IMAP servers.
Who is behind it
Kaspersky assesses with medium confidence that one actor runs both backdoors, noting that some SilkLurk victims also carry OctLurk, and that the operators are Chinese speaking. The team says it could not tie the activity to any known group at the time of publication, so this remains an unnamed cluster rather than a rebadged veteran. It arrives weeks after another China nexus operation was exposed by leaving its own attack server open to the internet, and adds to a thin public record of intrusion activity against Kazakhstan and its neighbours.
Indicators
Command servers include dns[.]multitoconference[.]com (OctLurk) and dns[.]ssentialserv[.]xyz, which resolved to 154[.]196[.]162[.]76 for LurkProxy. Other reported infrastructure includes 45[.]138[.]157[.]165, 95[.]179[.]210[.]138 and 45[.]61[.]149[.]112. Sample hashes include the deployment script 1.bat (MD5 6ecf84fb18f6747ed08d7598364d853a), loader oleasapi.dll (MD5 082d49ef9f14e6811d68c7e0e82e5069) and the Impacket build dropped as Adobe.exe (MD5 32a5985543433a4f60da2fafd873b927). The full indicator set is in the original Securelist report by Saurabh Sharma and Yaroslav Kikel.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.