A previously unreported cyber espionage operation dubbed SilkParasite has been observed targeting government bodies in Central Asia.
The intrusion set makes use of seven remote access tool (RAT) families, five of which have never been previously documented: DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, and NodeEdgeRAT. SilkParasite, first discovered in late 2025, is assessed to be a China-nexus threat cluster with medium confidence.
“What makes SilkParasite interesting is the traces of AI-assisted development running through otherwise expert code, which is a different thing from AI-generated malware,” Bitdefender Labs said in a technical report shared with The Hacker News.
Unlike other operations that rely on AI-generated malware, SilkParasite’s arsenal exhibits all hallmarks typically associated with professional espionage tooling that’s developed by a team of human operators while AI is likely used to streamline the process.
The Romanian cybersecurity vendor said the clearest sign of the technology use comes from a phishing lure that’s indubitably AI-generated. It’s also the only place the adversary seems to have been sloppy, which has raised the possibility that it may have been a deliberate choice to confuse attribution efforts.
SilkParasite is the third prominent threat actor to strike Central Asia in recent years, after UAC-0063 and FamousSparrow. One notable aspect that ties the operation to China is the use of a backdoor dubbed BLOODALCHEMY, which is an updated version of Deed RAT, itself a successor to ShadowPad. ShadowPad, for its part, is an evolution of PlugX. Both ShadowPad and PlugX are widely put to use by Chinese hacking groups.
First documented by Elastic Security Labs in October 2023, BLOODALCHEMY was observed as part of attacks mounted by REF5961 targeting government organizations in Southern and Southeast Asia. The C-based backdoor is said to be part of a broader toolset that’s launched by means of a DLL loader that’s sideloaded using a legitimate binary.
The malware supports basic commands to gather host information, overwrite the malware binary, the loader, or the main trusted binary that’s vulnerable to DLL sideloading, and terminate and uninstall itself.
Another indicator that points to China-nexus is the use of an updated version of SpiceRAT, which is equipped to download and run executable binaries and arbitrary commands. It’s attributed to another Chinese-speaking threat actor codenamed SneakyChef.
Attack chains begin with password-protected RAR archives bearing malicious Microsoft Office documents that are likely delivered via spear-phishing emails. The password to open the archive is supplied in the email body. Opening the document launches a macro responsible for trigger a DLL sideloading sequence to drop the first-stage payload.
“The lures were regionally tailored,” Bitdefender said. “Recovered documents were crafted to look relevant to government
entities in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, and Kazakhstan, several impersonating specific ministries. A further document, recovered from a public malware-sharing platform, was addressed to a Georgian government entity.”
Perhaps more significantly, the macro checks if Kaspersky’s antivirus software is installed and running on the machine before execution. This is indicative of attempts to bypass detection given the prevalence of the security program in the region.
Almost every single tool deployed over the course of the attack implements a plugin-oriented architecture that allows the operators to expand its capabilities at will, while selectively serving payloads that can better adapt to the victim environment and keeping the detection footprint small.
What’s more, the modular system offers another crucial advantage in that it enables the threat actors to upgrade the components’ capabilities without having to replace the underlying foundations. The seven implants span four different programming languages — .NET, C++, Go, and JavaScript — and use DLL sideloading as the main delivery vector.
The approach involves bringing their own copy of a legitimately signed program, as opposed to leveraging an already installed binary, and placing the rogue DLL under a name the executable looks for, causing the malicious code to be run. A brief description of each of the malware family is as follows –
- DriveSilkRAT (.NET/C++), which uses Google Drive as command-and-control (C2) to poll a specific folder for tasking, run it through an in-memory .NET plugin system, and upload the results of the execution back to the same folder. It supports 12 plugins for process listing, system and network enumeration, file management, and command execution.
- CookiETagRAT (C++), which uses HTTP Cookie / ETag response headers as C2 to receive and execute commands.
- NomadRAT (C++), which features a main orchestrator, a dedicated transmitter library that handles all C2 traffic, and plugins fetched from the server by numeric identifiers only when they are required.
- GoginRAT (Go), which has architectural similarities with NomadRAT and uses a separate transmitter for C2, and implements file system and shell capabilities as independent plugins. The results of the plugin execution are routed through a shared callback.
- NodeEdgeRAT (JavaScript), which ships its entire functionality spanning command execution, file management, and file transfer in one script.
Bitdefender said it observed roughly 65 instances infected with DriveSilkRAT, most of them located in the Asia region.
Clues that suggest some level of AI assistance show up in GoginRAT, which ships with Go test functions and a hard-coded AES key set to “0123456789abcdef,” and NodeEdgeRAT, which carries a configuration field for an encryption key set to the literal “change_this_key.” Another AI tell is that both NomadRAT and GoginRAT share a similar architecture that suggests a single high-level design was implemented twice in two languages, something that scaled using AI-assisted workflows.
“The most consistent detection surface across the campaign is DLL sideloading, and the reliable signal is the pairing, not the DLL name alone: a legitimately signed application loading a library placed beside it while running from an unusual location,” Bitdefender said.
“More broadly, low-footprint plugin-based implants operating through legitimate cloud services are poorly served by volume-based detection. Catching them reliably takes behavioral baselines that flag unusual relationships between processes and network services, rather than signatures for any single artifact.”
