The skinny — who got hit and what’s new

Since early 2025, a wave of intrusions has been aimed at government and public-sector organizations across Central Asia (Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan) and a few other hotspots. Targets include ministries, law-enforcement, healthcare, universities, urban planning and logistics — basically, anything that smells like official paperwork.

Security researchers traced these ops to a Chinese-speaking threat actor and uncovered a fresh toolkit built around three components: OctLurk, SilkLurk and LurkProxy. These pieces work together like a tiny but determined criminal circus: a stealthy loader, memory-only backdoors that pull plugins on demand, and a proxy utility to sneak traffic through compromised hosts.

How they hack and what they do after getting in

The intrusions are notable for being highly modular and mostly memory-resident — the malware leaves very little on disk, often needing a machine-specific key (like a drive serial or computer name) to decode payloads. That makes automated detection and analysis a pain in the neck.

Here’s what the operators and their tools are observed doing once they’re inside:

  • Initial loader activity: a tiny on-disk loader injects the main backdoor into memory, checks internet connectivity (reports show it queries a DNS-like domain such as dns.ssentialserv[.]xyz) and then launches the proxy component.
  • Command-and-control: the backdoors reach out to hard-coded C2 endpoints (examples reported as dns.multitoconference[.]com and IPs like 154.196.162[.]76) to exchange encrypted info and fetch plugins.
  • Plugin magic: OctLurk and SilkLurk can load extra modules directly into RAM to run shells, manipulate files, capture screenshots, move the mouse, and intercept clipboard data — basically a Swiss Army knife for hands-on keyboard activity.
  • Credential theft and lateral movement: the attackers extract system fingerprints, pull password hashes (tools like secretsdump-type techniques were used), and scrape stored browser passwords from Chrome and Firefox.
  • Keylogging and masquerading: they drop a keylogger disguised as a legitimate remote tool to hide in plain sight and have used remote-access agents such as Pandora RC to maintain control.
  • Network reconnaissance: scanners are run to find exposed services (SSH on port 22, MySQL on 3306, etc.), then credentials from stolen password lists are tried against those services.
  • Email and data exfiltration: operators have connected to mail servers to harvest messages and used legitimate archivers like WinRAR/7-Zip to package sensitive files for exfiltration via staged network shares.
  • Proxying traffic: the LurkProxy component can run as either a SOCKS5 proxy or a transparent forwarder (but only one mode at a time), allowing attackers to route traffic through compromised hosts to reach internal resources.
  • DLL side-loading tricks: SilkLurk is sometimes delivered via a DLL side-load chain, used to drop further payloads and even attempt to install other backdoors.

Investigators also noticed infrastructure overlap with earlier campaigns that used different implants. That suggests either shared infrastructure or a recycling of operational resources across multiple campaigns targeting a variety of operating systems.

If there’s a silver lining, it’s that the behavior is predictable: memory-only modules, unusual proxying, credential harvesting, and lateral scanning. Those odd patterns give defenders clues to detect and disrupt the operation if they look in the right places.

Practical quick wins for teams who want to sleep better: enable multifactor authentication everywhere possible, monitor for anomalous internal proxy connections and DNS lookups to strange domains, deploy endpoint detection that watches memory-only injections and unusual DLL loads, restrict lateral movement with network segmentation, and hunt for signs of disguised keyloggers or remote-control agents.

In short: this crew is neat, noisy if you know what to watch for, and sneaky if you don’t. Keep logs, watch for odd proxies, and patch your way out of their playbook.