Threats & Adversaries · APT / Espionage
SilkParasite Fields Five New RATs in Central Asia Bitdefender Labs documented SilkParasite, a previously unreported China-nexus espionage cluster targeting government bodies in Central Asia with seven remote access tool (RAT) families, five of them newly documented. The set includes DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, and NodeEdgeRAT.
The group delivers password-protected RAR archives with malicious Office documents, then uses a macro to trigger DLL sideloading, where a legitimate program loads the malware for it. That lets the code run under a trusted binary and makes single-sample detection less dependable, especially when the actor can swap among multiple implants.
Bitdefender says the code shows signs of likely AI-assisted development, but the operation still appears human-directed and professionally built. For government networks in Central Asia, the lasting issue is not one named RAT but a tooling set that can change shape while the campaign stays on target.
4 sources · Aug 23
Timeline Sources Aug 23 Industrial Cyber
Bitdefender traces SilkParasite cyberespionage campaign across Central Asia to seven RAT families, China-nexus tooling - Industrial Cyber
Bitdefender traces SilkParasite cyberespionage campaign across Central Asia to seven RAT families and China-nexus tooling.
original Aug 20 The Record from Recorded Future
China’s ‘SilkParasite’ espionage operation targeting Central Asia with AI-assisted malware
Suspected military-grade hackers based in China used artificial intelligence to develop malware in a campaign to penetrate Central Asian governments.
original Aug 19 Dark Reading
SilkParasite Threatens Central Asian Orgs With Flurry of RATs
A spear-phishing campaign by a Chinese-nexus group linked to FamousSparrow provides insight into technical and strategic global moves by APTs.
original Part of the PlainSec briefing for 2026-08-19
Every edition of this story: SilkParasite Fields Five New RATs in Central Asia
More from today Threats & Adversaries · APT / Espionage
SilkParasite Fields Five New RATs in Central Asia Bitdefender Labs documented SilkParasite, a previously unreported China-nexus espionage cluster targeting government bodies in Central Asia with seven remote access tool (RAT) families, five of them newly documented. The set includes DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, and NodeEdgeRAT.
The group delivers password-protected RAR archives with malicious Office documents, then uses a macro to trigger DLL sideloading, where a legitimate program loads the malware for it. That lets the code run under a trusted binary and makes single-sample detection less dependable, especially when the actor can swap among multiple implants.
Bitdefender says the code shows signs of likely AI-assisted development, but the operation still appears human-directed and professionally built. For government networks in Central Asia, the lasting issue is not one named RAT but a tooling set that can change shape while the campaign stays on target.
4 sources · Aug 23
Timeline Sources Aug 23 Industrial Cyber
Bitdefender traces SilkParasite cyberespionage campaign across Central Asia to seven RAT families, China-nexus tooling - Industrial Cyber
Bitdefender traces SilkParasite cyberespionage campaign across Central Asia to seven RAT families and China-nexus tooling.
original Aug 20 The Record from Recorded Future
China’s ‘SilkParasite’ espionage operation targeting Central Asia with AI-assisted malware
Suspected military-grade hackers based in China used artificial intelligence to develop malware in a campaign to penetrate Central Asian governments.
original Aug 19 Dark Reading
SilkParasite Threatens Central Asian Orgs With Flurry of RATs
A spear-phishing campaign by a Chinese-nexus group linked to FamousSparrow provides insight into technical and strategic global moves by APTs.
original Part of the PlainSec briefing for 2026-08-19
Every edition of this story: SilkParasite Fields Five New RATs in Central Asia
More from today