Threats · 53 days ago
Bitdefender Labs documented SilkParasite, a previously unreported China-nexus espionage cluster targeting government bodies in Central Asia with seven remote access tool (RAT) families, five of them newly documented. The set includes DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, and NodeEdgeRAT.
The group delivers password-protected RAR archives with malicious Office documents, then uses a macro to trigger DLL sideloading, where a legitimate program loads the malware for it. That lets the code run under a trusted binary and makes single-sample detection less dependable, especially when the actor can swap among multiple implants.
Bitdefender says the code shows signs of likely AI-assisted development, but the operation still appears human-directed and professionally built. For government networks in Central Asia, the lasting issue is not one named RAT but a tooling set that can change shape while the campaign stays on target.
4 sources covering this story
The Record from Recorded Future
China’s ‘SilkParasite’ espionage operation targeting Central Asia with AI-assisted malware
Suspected military-grade hackers based in China used artificial intelligence to develop malware in a campaign to penetrate Central Asian governments.
Bitdefender traces SilkParasite cyberespionage campaign across Central Asia to seven RAT families and China-nexus tooling.
SilkParasite Threatens Central Asian Orgs With Flurry of RATs
A spear-phishing campaign by a Chinese-nexus group linked to FamousSparrow provides insight into technical and strategic global moves by APTs.
SilkParasite Espionage Campaign Targets Central Asian Governments with Five New RATs
SilkParasite targets Central Asian governments with seven RATs, five newly documented, using DLL sideloading and likely AI-assisted development.
Part of the PlainSec briefing for 2026-08-20