SilkParasite: cyber-espionage campaign against Central Asian governments with 7 RAT and IA support

In late 2025, Bitdefender research teams detected a cyber-espionage campaign directed at Central Asian government agencies that analysts have named as SilkParasite. The intrusion set uses at least seven families of remote-access Trojans (RAT), five of them undocumented previously - DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT and NodeEdgeRAT - and combines traditional techniques of persistence and silage with signs of support in artificial intelligence tools to accelerate development and operational activities. According to the report, the attribution points to average confidence in a nexus with Chinese actors but that connection is based on technical prints and re-use of known code rather than a direct and complete evidence attribution.

Confirmed facts: attackers deliver their initial loads by password-protected RAR files containing Microsoft Office documents with malicious macro; opening the document fires a sequence of DLL sideloading that loads the first payload; the campaign displays a modular plugin-based design that allows you to expand capabilities without replacing the base; and the practice of loading DLL placed next to a legitimate signed binary is the most observed execution vector. Bitdefender also reported the presence of a C-related backdoor (BLOODALCHEMY, which comes from the Deed RAT → ShadowPad → PlugX line) and the re-use of a RAT known as SpiceRAT in an updated version.

Technically, SilkParasite operates in several layers. The initial delivery explores confidence in apparent transmitters by speaking-phishing with carefully contextualized documents for ministries and organizations in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan and Kazakhstan. The password-protected RAR file reduces the automatic visibility of sandboxes and filters. When the victim opens the document and enables the macro, it triggers a dynamic load of code: DLL sideloading is to run a legitimate binary (signed) that, when you look for a bookstore in your execution folder, load a malicious DLL placed adjacent. This pattern - legitimate binary by loading an adverse bookstore from an unusual location - is the most reliable indicator for detecting, more than the specific name of the DLL. (See more about this technique in the MITRE ATT & CK matrix: https: / / attack.mitre.org / techniques / T1574 / 001 /.)

The arsenal is implemented in four languages (.NET, C + +, Go and JavaScript) and adopts a plugin-based architecture: the central controller requests modules only when necessary, reduces the detection surface and allows for incremental updates. DriveSilkRAT uses Google Drive for communication with the C2; CookiETagRAT uses HTTP headers (Cookie / ETag) as a covert channel; NomadRAT and GoginRAT operate with separate transmitter components and plugins referenced by numerical identifiers; NodeEdgeRAT is a JavaScript script that implements all behavior in a single file. In addition, Bitdefender observed functions and literals that suggest support for generative tools (e.g., encryption keys with trivial values and configurable fields such as "change _ this _ key"), which researchers interpret as evidence of Automated development assistance and not like malware completely generated by IA.

What is confirmed and what is estimated: it is confirmed that the campaign mainly affected governmental organizations in the region and that Bitdefender identified approximately 65 instances of DriveSilkRAT, the majority in Asia. The Chinese nexus hypothesis is an analytical judgment based on code similarities and the reappearance of families historically associated with groups of that origin (e.g. ShadowPad / PlugX and BLOODALCHEMY), but the complete attribution needs more evidence (human intelligence, extended telemetry and time correlation). The use of IA is inferred from concrete artifacts - lure text clearly generated by replicated language models and development patterns between implementations - without evidence that the IA has launched attacks autonomously; it is, rather, a help for human operators.

Real impact and risks: organizations with a presence in Central Asia are the main affected; given the modular design, attackers can scale from basic recognition and exfiltration to deeper host controls (remote execution, lateral movement and replacement of reliable binaries). The use of legitimate cloud services (Google Drive) and covert channels (HTTP headers) makes signature-based detection difficult and increases the need to monitor network behavior and context. The testing of the macros to detect Kaspersky's presence suggests a recognition of the objective environment and an express intention to evade common defences in the region.

Specific measures to be taken by managers and users - priority and tangible action -: do not enable macros in documents received by email unless their origin is verified by internal processes; deal with suspicion any password-protected compressed file delivered by mail and verify by alternative channels; apply macro-execution blocking policies (e.g., enable protected view and block non-ready VBA macros); use lists of permitted applications and restrict execution of signed binaries out of expected locations; monitor abnormal relationships between processes and network services (e.g., legitimate processes by launching connections to Google Drive or by making requests with unusual ETag / Cookie headers); and deploy on-up standard folders that can alert to unexecuted DLL files. For charge defense guidance that abuse macros, Microsoft offers Office-level configuration recommendations that should be reviewed.

If you suspect commitment: isolate the affected machines, collect memory and disks to preserve evidence, search for DLL files placed next to signed executables and documented RAT artifacts (e.g., downloaded plugins, communications with Google Drive folders, HTTP patterns with ETag), and coordinate with response and incident team or national cybersecurity authority. Disposal without forensic analysis can remove critical indicators; therefore, document everything before cleaning.

Finally, the operational lesson is clear: the convergence between IA-assisted development and professional malware proven practices increases the scale and speed of operations without reducing their sophistication. Defending itself requires moving from signature-based detection to models that correct for behavior, context and the relationship between external processes and services. For further information on avoidance techniques such as DLL sideloading and detection strategies, please refer to the above mentioned MITRE ATT & CK page and the technical research published by security providers such as Bitdefender, which are documenting this campaign on your technical analysis channel ( https: / / www.bitdefender.com / blog / labs /).