China-Linked SilkParasite Campaign Targets Central Asian Governments With Five New Malware Families

A China-linked cyberespionage campaign dubbed SilkParasite is targeting government organizations across Central Asia with spear-phishing emails, malicious archives, and DLL sideloading. Researchers identified seven malware families, including five newly documented tools: DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, and NodeEdgeRAT.

The campaign targets organizations across Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, Kazakhstan, and Georgia. Attackers use trusted Windows applications and cloud services such as Google Drive to conceal malware activity and maintain remote access.

Security teams should restrict Office macros, inspect password-protected archives, monitor suspicious DLL sideloading, and investigate unusual cloud-service connections, scheduled tasks, and in-memory execution.

NPAV EDR — Detects suspicious processes, DLL sideloading, persistence, and abnormal endpoint behavior.