--- title: OctLurk and SilkLurk: new Backdoors in Central Asia description: Kaspersky researchers have uncovered two new backdoors, OctLurk and SilkLurk, targeting government organizations in Central Asia (Afghanistan, Kyrgyzstan,... canonical: https://daily.dev/posts/octlurk-and-silklurk-new-backdoors-in-central-asia-gibuex51u twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: OctLurk and SilkLurk: new Backdoors in Central Asia | daily.dev og:description: Kaspersky researchers have uncovered two new backdoors, OctLurk and SilkLurk, targeting government organizations in Central Asia (Afghanistan, Kyrgyzstan,... og:url: https://daily.dev/posts/octlurk-and-silklurk-new-backdoors-in-central-asia-gibuex51u og:image: https://api.daily.dev/og/posts/Gibuex51U.png og:image:alt: OctLurk and SilkLurk: new Backdoors in Central Asia og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # OctLurk and SilkLurk: new Backdoors in Central Asia **[Securelist](https://daily.dev/sources/securelist)** · 29 min read · 0 upvotes · 0 comments ## Summary Kaspersky researchers have uncovered two new backdoors, OctLurk and SilkLurk, targeting government organizations in Central Asia (Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and Syria) since January 2025. Both backdoors operate primarily in memory, use victim-specific encryption (OctLurk uses the C: drive serial number; SilkLurk uses the computer name) to decode payloads, and are heavily obfuscated. They support plugin injection for command shells, file management, keylogging, credential dumping, network scanning, browser password theft, and email harvesting. A companion tool, LurkProxy, provides SOCKS5 and transparent proxy capabilities. Post-compromise activity includes use of Impacket secretsdump, Pandora RC agent for remote access, FSCAN for network scanning, and PlugX as a second-stage payload. The threat actor is assessed with medium confidence to be Chinese-speaking, with infrastructure overlapping a previously reported Linux-targeting campaign (TrustFall/MystRodX/SilentRaid) in Kazakhstan. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [GoSerpent backdoor attacks in Southeast Asia](https://daily.dev/posts/goserpent-backdoor-attacks-in-southeast-asia-s7okvghei) · Securelist · 13 upvotes · 1 comments - [Windows version of SprySOCKS Linux malware used to attack govt orgs](https://daily.dev/posts/windows-version-of-sprysocks-linux-malware-used-to-attack-govt-orgs-iyygrdkhw) · BleepingComputer · 1 upvotes · 0 comments - [Chinese Cyber Threat Lurks In Critical Asian Sectors for Years](https://daily.dev/posts/chinese-cyber-threat-lurks-in-critical-asian-sectors-for-years-8fwvgxfsv) · Dark Reading · 0 upvotes · 0 comments - [SloppyLemming Deploys BurrowShell and Rust-Based RAT to Target Pakistan and Bangladesh](https://daily.dev/posts/sloppylemming-deploys-burrowshell-and-rust-based-rat-to-target-pakistan-and-bangladesh-lvfsvypgh) · Arctic Wolf · 0 upvotes · 0 comments --- Tags: [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/octlurk-and-silklurk-new-backdoors-in-central-asia-gibuex51u) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"OctLurk and SilkLurk: new Backdoors in Central Asia","url":"https://daily.dev/posts/octlurk-and-silklurk-new-backdoors-in-central-asia-gibuex51u","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/octlurk-and-silklurk-new-backdoors-in-central-asia-gibuex51u"},"datePublished":"2026-07-30T11:01:01.280Z","dateModified":"2026-07-30T11:01:39.953Z","description":"Kaspersky researchers have uncovered two new backdoors, OctLurk and SilkLurk, targeting government organizations in Central Asia (Afghanistan, Kyrgyzstan,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/df5e3fb733c7b74e579c05f7ed240471?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/df5e3fb733c7b74e579c05f7ed240471?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Securelist","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Securelist","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/e4b9f556af7a4e74a179787362dd5b07","url":"https://daily.dev/sources/securelist"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/octlurk-and-silklurk-new-backdoors-in-central-asia-gibuex51u","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"malware","timeRequired":"PT29M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Securelist","item":"https://daily.dev/sources/securelist"},{"@type":"ListItem","position":3,"name":"OctLurk and SilkLurk: new Backdoors in Central Asia"}]} ```