The Ghost in the Ministry: How Two Backdoors Haunted Central Asian Governments for a Year and a Half
A government employee in Tajikistan sits down at their desk on an ordinary Tuesday, logs in, and gets to work. Email, a couple of browser tabs, nothing unusual. No red flags, no pop-ups, no reason to think twice.
Meanwhile, tucked away in that machine’s memory, something has been sitting quietly for months. It reads keystrokes. It pulls saved passwords out of the browser. It maps out who else is on the network. Every so often it reaches out to a server somewhere far away and reports what it’s found. It barely touches the hard drive, and if you copied it onto a different computer to study it, it wouldn’t even work properly — it was built for one machine, and one machine only.
That’s not a scene from a thriller. It’s what Kaspersky’s researchers actually found when they published a report in July 2026 on two backdoors nobody had seen before: OctLurk and SilkLurk. The more you dig into how this thing was built, the more you understand why the people who analyze malware for a living came away a little rattled by it.
This wasn’t a smash-and-grab
When people picture a hack, they usually imagine something loud — a locked screen, a ransom note, a defaced website. This is the opposite of that.
Since January 2025, a threat actor Kaspersky believes is Chinese-speaking has been getting into government networks across Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and Syria. And it’s not the flashy targets you’d expect — no banks, no crypto exchanges. Foreign ministries. Police departments. Hospitals. Universities. City planning offices. The kind of institutions that don’t make headlines but quietly run a country day to day.
Eighteen months of quiet activity, bookended by two separate research teams noticing pieces of the same picture.
The affected sectors, spread across six countries in Central Asia and Syria.
There’s no ransom demand in any of this. No public statement, no defaced homepage. Just slow, deliberate intelligence gathering — the sort of thing you’d expect from a state-backed team, not a criminal outfit chasing a payday.
Nobody’s quite sure how they got in
This is the part of the story that doesn’t wrap up neatly. Even Kaspersky can’t say for certain how the attackers get their first foothold — was it a phishing email, stolen VPN credentials, some exposed server nobody patched? That piece of the puzzle is still missing.
What we do know is what happens right after. By the time OctLurk or SilkLurk shows up on a machine, the attackers already have admin credentials in hand. They use those to set up a scheduled task with a deliberately dull name — “GoogleUpDate” is one they’ve used more than once — that fires off once, with full system privileges, moments after it’s created. That task runs a batch script, which sets up a Windows service (names like NgcCIntSvc or vmicagent show up), and that service loads the malicious loader the second it starts.
It’s basically someone letting themselves in through a door they already have a key to, then quietly wedging a few more doors open on the way in, just in case.
SilkLurk goes about it a bit differently — it hitches a ride on software people already trust. The attackers set up services that launch perfectly legitimate, signed programs (NVIDIA utilities, Realtek audio tools), and take advantage of the fact that those programs load their supporting files without checking too closely what’s actually in the folder. Put a malicious file with the right name next to a trusted NVIDIA tool, and the tool loads it without complaint. To security software, it just looks like a known, trusted process doing its normal thing. It has no idea it picked up a passenger.
The trick that makes this stuff nearly impossible to reuse in a lab
Here’s the detail that actually made analysts stop and take notice.
Both OctLurk and SilkLurk are built so that the little loader file left behind on disk is basically useless by itself. To actually unlock the real payload, it needs one more thing — something specific to that exact machine.
- OctLurk uses the serial number of the machine’s C: drive.
- SilkLurk uses a hash of the computer’s name.
Each loader’s decryption key is unique to the machine it infected — the same file simply won’t unlock anywhere else.
Without that one piece of information, the payload just won’t decrypt. So if you took a copy of this malware from an infected laptop in Tajikistan and tried to run it — or even analyze it — on a different machine, it wouldn’t work. It’s not just obfuscated, it’s tailored, like a lock cut for a key that only exists on one specific computer.
It’s a smart bit of anti-forensics, honestly. Most malware detection works by studying one sample and writing a rule that catches every copy after it. This approach quietly breaks that whole idea — every single infection basically has to be analyzed on its own terms.
What happens once they’re actually inside
This is where it stops feeling like a story about a mysterious hacker and starts feeling like watching someone who’s clearly done this many times before, working through a checklist.
Both backdoors follow roughly the same pattern: get into memory, send home some basic system info, then sit and wait for the operator to send down a “plugin” — extra functionality that gets loaded straight into memory, never saved to disk as its own file. Depending on what gets sent, the attackers can open a live command shell and type away as if they were sitting right there, poke around the file system copying and deleting things, or even take screenshots, read the clipboard, and fake mouse clicks and keystrokes.
Then the humans take over. Kaspersky watched them, step by step:
- Run a script that pulls an almost overwhelming amount of detail about the machine — what antivirus is installed, BIOS info, a full list of everyone’s home folders, you name it
- Dig through Windows security logs specifically for remote desktop logins, presumably to figure out who has remote access to what
- Use a renamed copy of a well-known credential-dumping tool (disguised as “Adobe.exe”) to pull password hashes straight off the domain controllers — the machines that essentially hold the keys to the whole network
- Drop a keylogger dressed up as AnyDesk, a program most IT departments trust completely, and set it to launch automatically whenever anyone logs in
- Run a separate tool built to crack open saved Chrome and Firefox passwords
- Quietly install a real, working remote-access tool (Pandora RC) as a backup, in case the custom malware ever gets caught and removed
- Scan the internal network for exposed SSH and database ports, then try a list of stolen credentials against them
- Log directly into victims’ email accounts
- Map out shared network drives with stolen admin logins, hunt for anything sensitive, disconnect quickly to cover their tracks, then zip everything up with WinRAR or 7-Zip before it leaves the network
The attacker’s actual toolkit — almost entirely legitimate, everyday software, aimed at the wrong target.
Look at that list again. Almost none of it is exotic malware. It’s mostly ordinary software doing exactly what it was built to do — just aimed at the wrong target by the wrong people. That’s really the whole trick: from the outside, it looks a lot like a busy IT admin having a productive day.
How the pieces fit together
The diagram below sketches out the shape of a single intrusion — from that still-unknown moment of first entry through to the point the stolen data actually leaves the network.
The attack chain from initial access to data exfiltration, based on Kaspersky’s technical analysis.
The detail that ties two cases together
This next part reads a bit like the moment in a detective story where two separate leads turn out to be the same case.
In at least one intrusion, the attackers used a shell they’d gotten through OctLurk to drop the SilkLurk loader onto that same machine themselves. That’s not a coincidence — it’s the same people, reaching for a second tool from the same kit. Elsewhere, both backdoors’ loader files turned up sitting in the exact same folder.
And in some of the SilkLurk cases, the attackers went further and deployed PlugX — an old, well-known backdoor that’s been floating around since roughly 2008 and has a long track record with Chinese state-linked hacking groups. It was set up to pose as a fake “Symantec RAS” service, tucked in among the legitimate security software already running on the machine.
Four tools, one operator — plus a dotted line to an older Linux campaign that shares some of the same infrastructure.
Kaspersky also noticed overlapping infrastructure with a completely separate campaign — one aimed at Linux systems that Kazakhstan’s State Technical Service had already flagged back in March 2025, involving something called TrustFall (or MystRodX, or SilentRaid, depending on which vendor you ask). Whether it’s the same team running both at once, or just some recycled servers, isn’t clear yet. But it’s exactly the kind of loose thread that keeps threat intelligence teams digging.
Put all of that together — the shared tooling, the PlugX connection, the overlapping infrastructure — and Kaspersky lands on “Chinese-speaking threat actor” with medium confidence. Not a named group yet. Just a clearly deliberate, clearly patient operation that hasn’t earned a catchy nickname in the security world just yet.
Why this matters even if you’ve never worked near a Central Asian ministry
It’s easy to read something like this and shrug it off if you’re nowhere near the targeted organizations. But a few things about this campaign are worth sitting with regardless of where you work.
It’s a preview
Tricks like victim-specific encryption and hiding inside trusted, signed software don’t stay confined to one region forever. Once something works, it gets reused elsewhere.
The tools are ordinary — that’s the point
The reliance on completely ordinary tools — Impacket, Fscan, WinRAR, 7-Zip, a legitimate remote-access agent — says something bigger about where attacks are headed. The line between “normal admin work” and “active intrusion” keeps getting blurrier, and defenders increasingly have to ask why a tool is running, not just what it is.
Eighteen months
That’s how long this ran, quietly, inside real government networks, before anyone had gathered enough to publish on it. That’s not a threat model built around stopping a single breach. That’s a threat model built around assuming someone might already be inside — and figuring out how you’d actually find them.
FAQ
What are OctLurk and SilkLurk?
Two newly discovered backdoors, both designed to run almost entirely in memory, used in an espionage campaign against government targets in Central Asia and Syria. Each can pull down extra plugins on the fly to steal credentials, log keystrokes, scan networks, and take remote control of a machine.
Who’s behind it?
Kaspersky believes, with medium confidence, that it’s a Chinese-speaking threat actor — based on shared tooling between the two backdoors and links to PlugX, which has a long history with Chinese state-linked groups. No specific named group has been confirmed yet.
Who’s actually being targeted?
Government and public-sector organizations in Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and Syria — foreign ministries, police agencies, hospitals, research institutions, schools.
How long has this been going on?
At least since January 2025. Kaspersky’s report came out in July 2026, so this ran quietly for well over a year before it became public.
How do the attackers actually get in?
That part’s still unknown. What is known is that by the time these backdoors show up, the attackers already have stolen admin credentials — the initial break-in happens somewhere earlier and hasn’t been pinned down.
Why is this malware so hard to catch or analyze?
It barely touches disk, and its payload only decrypts properly on the specific machine it infected — using that machine’s drive serial number or computer name as part of the key. A sample from one infected computer generally won’t run anywhere else.
Is there anything exotic or zero-day about this?
Not really. Most of what the attackers do after breaking in relies on ordinary, legitimate tools — Impacket, Fscan, WinRAR, 7-Zip, a real remote-access program — rather than flashy custom malware. That’s a big part of why it stayed hidden for so long.
Why does PlugX matter here?
PlugX is a well-established backdoor with a long history of use by Chinese state-linked hackers. Finding it alongside SilkLurk in some intrusions adds more weight to the attribution.
Is there a patch for this?
Not really, because this isn’t a software vulnerability being exploited — it’s a set of intrusion techniques built on top of stolen credentials. Defense here looks like auditing new scheduled tasks and services, watching for DLL side-loading in trusted apps, keeping an eye out for tools like Impacket and Fscan running internally, and tightening up who has access to domain controllers.
Where can I read the full technical writeup?
Kaspersky’s Securelist team published the complete research — malware internals, C2 details, indicators of compromise — in their report “OctLurk and SilkLurk: newly identified tailored backdoors in cyber-espionage campaign in Central Asia.”