securelist · Crawled Jul 31, 2026

OctLurk and SilkLurk: newly identified tailored backdoors in cyber-espionage campaign in Central Asia

67 IoCs 2 Malware
Read original article ↗

AI Summary

Kaspersky researchers identified a cyber-espionage campaign targeting government and public sector organizations in Central Asia since January 2025, using two custom backdoors: OctLurk and SilkLurk. Both backdoors are heavily obfuscated, deployed via customized loaders that use victim-specific data for decryption, and support plugin-based post-compromise activities including credential theft, keylogging, remote access, and data exfiltration. The same threat actor, assessed as Chinese-speaking, operates both backdoors and has deployed secondary payloads such as PlugX and Impacket's secretsdump. Infrastructure overlap with the TrustFall (MystRodX/SilentRaid) campaign suggests coordinated multi-platform operations.

AI-extracted · verify before operational use

Extracted Entities 2 found

Malware PlugX → Malware SilentRaid →

Indicators of Compromise 67 extracted

Type Value Detail
Domain dns[.]multitoconference[.]com Details →
Domain tj[.]tajikistandip[.]com Details →
Domain fm01[.]clouddevicemetrics[.]com Details →
Domain confbase[.]mdpsupport[.]net Details →
Domain digital[.]leroymerling[.]com Details →
Domain api2[.]annoyingremote[.]com Details →
Domain about[.]blsouqs[.]com Details →
Domain ssl[.]blsouqs[.]com Details →
IP 45[.]138[.]157[.]165 Details →
Domain dns[.]ssentialserv[.]xyz Details →
IP 154[.]196[.]162[.]76 Details →
Domain tyhbgtyuj[.]gleeze[.]com Details →
IP 95[.]179[.]210[.]138 Details →
Domain wedfcvbn[.]gleeze[.]com Details →
IP 45[.]77[.]136[.]228 Details →
Domain rgnojb[.]casacam[.]net Details →
IP 95[.]179[.]141[.]26 Details →
Domain ctyuhjerf[.]kozow[.]com Details →
IP 45[.]32[.]152[.]50 Details →
IP 212[.]11[.]39[.]138 Details →
IP 195[.]86[.]120[.]2 Details →
Domain uyhvfredc[.]accesscam[.]org Details →
IP 154[.]196[.]187[.]73 Details →
IP 45[.]61[.]149[.]112 Details →
Domain gycudore[.]kozow[.]com Details →
IP 64[.]7[.]198[.]130 Details →
MD5 082d49ef9f14e6811d68c7e0e82e5069 Details →
Filename oleasapi.dll Details →
MD5 f4578e869a735cfad691f927bae3e638 Details →
Filename msbasesysdc.dll Details →
MD5 7c2f64461bb519c6cbf1fc687675514c Details →
Filename mscastrac.dll Details →
MD5 8269d6ba1b6842f9152c90cf7add9b93 Details →
Filename vulkan-1.dll Details →
MD5 3c9a1ba8e0c7475706adc6376e9d7b7c Details →
Filename kmsonline.exe Details →
MD5 ef59aad625eebda8650aec5820d6ce69 Details →
Filename RasTls.dll Details →
MD5 a0cc7accc79abb0287aaba825d0351f0 Details →
Filename OctLurk backdoor Details →
MD5 a56cce62930a6bee80d679b4c495a340 Details →
Filename OctLurk File Manager plugin Details →
MD5 1415a78b75de7db4ba3d1e61d7db4501 Details →
Filename OctLurk Command Shell plugin Details →
MD5 a4d550a3ba0cd073fe3839b99d98a7a8 Details →
Filename OctLurk Interaction Manager plugin Details →
MD5 32a5985543433a4f60da2fafd873b927 Details →
Filename Adobe.exe Details →
MD5 2a571f6cee42a17d873f4c942649813f Details →
Filename AnyDesk.exe Details →
MD5 37dc84e4bcad92fa28f1e7778d088283 Details →
Filename x64.exe Details →
MD5 cf903e4a1629aa0582fd0363b5786676 Details →
Filename fc.exe Details →
MD5 6ecf84fb18f6747ed08d7598364d853a Details →
Filename 1.bat Details →
MD5 b874123a80fc4f40e06872b9cb54ebc6 Details →
Filename auto.bat Details →
MD5 45cf5916fab4272a1313c26e67aa9220 Details →
Filename in.bat Details →
MD5 4e6d5c4770d5a822d7fcce6a74f7ad73 Details →
MD5 5e26df131ff0a679a0a2699b723b46e3 Details →
MD5 18dc8bff47cc282508354771d0c8cf8c Details →
Filename RecordedTV.exe Details →
Filename recordutil.exe Details →
MD5 9a1dd1d96481d61934dcc2d568971d06 Details →
Filename 7z.exe Details →

MITRE ATT&CK TTPs 41 techniques

T1001 Data Obfuscation · Command And Control T1001.002 Steganography · Command And Control T1001.003 Protocol or Service Impersonation · Command And Control T1003 OS Credential Dumping · Credential Access T1012 Query Registry · Discovery T1021 Remote Services · Lateral Movement T1021.001 Remote Desktop Protocol · Lateral Movement T1021.002 SMB/Windows Admin Shares · Lateral Movement T1027 Obfuscated Files or Information · Defense Evasion T1027.002 Software Packing · Defense Evasion T1036 Masquerading · Defense Evasion T1036.005 Match Legitimate Name or Location · Defense Evasion T1041 Exfiltration Over C2 Channel · Exfiltration T1055 Process Injection · Defense Evasion T1055.001 Dynamic-link Library Injection · Defense Evasion T1056.001 Keylogging · Collection T1059 Command and Scripting Interpreter · Execution T1059.001 PowerShell · Execution T1059.003 Windows Command Shell · Execution T1070.001 Clear Windows Event Logs · Defense Evasion T1070.002 Clear Linux or Mac System Logs · Defense Evasion T1070.003 Clear Command History · Defense Evasion T1070.004 File Deletion · Defense Evasion T1070.005 Network Share Connection Removal · Defense Evasion T1070.006 Timestomp · Defense Evasion T1071 Application Layer Protocol · Command And Control T1071.001 Web Protocols · Command And Control T1081 T1081 T1082 System Information Discovery · Discovery T1090 Proxy · Command And Control T1090.001 Internal Proxy · Command And Control T1110 Brute Force · Credential Access T1133 External Remote Services · Persistence T1204.002 Malicious File · Execution T1555 Credentials from Password Stores · Credential Access T1566 Phishing · Initial Access T1566.001 Spearphishing Attachment · Initial Access T1057 Process Discovery · Discovery T1083 File and Directory Discovery · Discovery T1105 Ingress Tool Transfer · Command And Control T1124 System Time Discovery · Discovery