SilkParasiteThreat actor
SilkParasite is an activity cluster tracked by Bitdefender across Central Asia, primarily targeting government and telecommunications entities in Kyrgyzstan, Uzbekistan and Kazakhstan. Bitdefender assesses a China-nexus with medium confidence and states explicitly that it does not believe the evidence supports attribution to a named group, so this is recorded as an activity cluster rather than as…From MISP Galaxy
Last reported 1 month ago, by Silent Push3 reports
ATT&CK techniques
6 of 7 · each with the sentence it comes from- T1056.001Keylogging
“This means initial implants are relatively small and plugins are used to provide capabilities for clipboard monitoring, keylogging, file management, or interactive shell access.”
- T1204.003Malicious Image
“The vulnerabilities allow attackers to use malicious image files to run malicious code on remote services.”
- T1213.003Code Repositories
“The leak included databases for Geedge's Jira and Confluence portals, but also all its Git source code repositories, containing commit history going back to November 2024.”
- T1213.005Messaging Applications
“Named Manic, the trojan can target Ukrainian banks, government agencies, identity services, and local messaging applications.”
- T1505.003Web Shell
“Clop's new custom web shell: ReliaQuest's John Dilgen and Connor Short have published a report on Clop's new mass exploitation campaign targeting PTC Windchill servers and the new custom web shell they've been deploying for initial access.”
- T1552.004Private Keys
“The modules loaded malicious code that extracted and stole crypto-wallet private keys.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
Risky Bulletin: Academics find source code overlaps between Geedge and China's Great Firewall“SilkParasite: A suspected Chinese APT group has been seen hacking government bodies across Central Asia using an assortment of AI-assisted malware, such as DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, NodeEdgeRAT, and more.”
-
Risky Bulletin: Gemini hacked three companies too“New SilkParasite infrastructure: Security researchers have found new infrastructure operated by the SilkParasite APT and linked the group to attacks on at least five Central Asian countries dating back to at least mid-2022.”
-
China's AI-Enabled APT Operations Are Getting Interesting“All seven were created by a single cyberespionage actor Bitdefender called SilkParasite and five were previously undocumented.”
Indicators in its reports
named in the reports above- itorrents[.]orgin 1 report
- onionmail[.]comin 1 report
- marktsec.bsky[.]socialin 1 report
- sethmlarson[.]devin 1 report
- shakirov2036.bsky[.]socialin 1 report
- pwn[.]aiin 1 report
Copy these 6 indicators · defanged
Thanks — we review every report.