OctLurk and SilkLurk: newly identified tailored backdoors in cyber-espionage campaign in Central Asia

A Chinese-speaking threat actor has been deploying two backdoors, OctLurk and SilkLurk, targeting government organizations and critical infrastructure in Central Asia since January 2025. These backdoors, along with associated tools like LurkProxy, are used to steal sensitive information, including credentials, network configurations, and user activity. The attackers leverage administrative accounts to install scheduled tasks that download and execute malicious payloads, including a keylogger, browser password decryptor, and remote access tool (Pandora RC agent). They also utilize tools like Fscan for network scanning and email harvesting. The activity is linked to a campaign aimed at gathering intelligence and potentially establishing long-term access to compromised systems.