SilkParasite Targets Central Asia in China-Nexus APT Campaigns

Summary

SilkParasite is a cyberespionage operation assessed with medium confidence as China-nexus, targeting government organizations across Central Asia. The campaign uses a modular arsenal comprising seven distinct Remote Access Tool (RAT) families, including several newly identified variants. Its operations demonstrate professional development practices, with indications of AI-assisted development in both malware code and phishing lures.

Investigation

Bitdefender Labs researchers initially identified a suspicious infection within a Central Asian government organization in late 2025, triggering a months-long forensic investigation. The analysis uncovered seven separate RAT families, maintained packaging infrastructure, and an operational lifecycle extending for more than a year. Researchers also identified overlaps with previous campaigns such as FamousSparrow and threat groups including SneakyChef.

Mitigation

Defenders should prioritize detecting DLL sideloading by monitoring legitimate signed binaries executing from unusual locations such as temporary or staging directories. Behavioral baselines should also identify anomalous interactions between processes and legitimate cloud services including Google Drive. Regular reviews of scheduled tasks can further help uncover suspicious entries established for persistence.

Response

If SilkParasite activity is detected, affected systems should be isolated and outbound connections to known cloud storage providers investigated for unauthorized command-and-control activity. Security teams should conduct detailed forensic analysis of signed applications loading unexpected DLLs from local directories. Scheduled tasks should also be reviewed for suspicious names designed to imitate legitimate system updates.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary’s goal is to establish a foothold on the target machine while evading detection. To achieve this, the adversary performs two actions:

  1. DLL Sideloading: Instead of running a suspicious malware binary, the adversary renames a legitimate tool (Calibre.exe) and places a malicious library (dsp_ippv2_x64.dll) in the same folder. When the “legitimate” tool is launched, it automatically loads the malicious DLL, masquerading as a trusted process.
  2. WMI Execution: To further obfuscate the process tree, the adversary uses WMI to remotely or locally trigger process creation. By using the process call create syntax via WMI, the parent process appears as wmiprvse.exe, which is common in administrative tasks, thereby breaking the direct link to the original attacker shell.

• Regression Test Script:

  # --- SIMULATION SCRIPT START ---
  
  # 1. Simulate DLL Sideloading
  $workDir = "$env:TEMPSideloadSim"
  New-Item -ItemType Directory -Path $workDir -Force | Out-Null
  
  # Create a dummy "Calibre.exe" (in a real scenario, this would be the real binary)
  # For simulation, we create a script that mimics the name.
  "Write-Host 'Simulated Calibre Executing'" | Out-File -FilePath "$workDirCalibre.exe"
  
  # Create the malicious DLL file targeted by the rule
  New-Item -ItemType File -Path "$workDirdsp_ippv2_x64.dll" -Force | Out-Null
  
  # Execute the sideloading simulation
  Start-Process -FilePath "$workDirCalibre.exe" -ArgumentList "dsp_ippv2_x64.dll"
  
  # 2. Simulate WMI Process Creation
  # This uses PowerShell to invoke WMI to create a process, triggering the 'process call create' logic.
  $wmiCommand = "process call create 'cmd.exe /c echo WMI_EXECUTION_TEST'"
  Invoke-WmiMethod -Class Win32_Process -Name Create -ArgumentList $wmiCommand 2>$null | Out-Null
  # Note: To ensure the specific string "process call create" appears in the command line log 
  # as per the Sigma rule, we simulate the command line trigger.
  Start-Process "wmiprvse.exe" -ArgumentList "/process call create" -WindowStyle Hidden
  
  # --- SIMULATION SCRIPT END ---

• Cleanup Commands:

  # Remove simulation artifacts
  Remove-Item -Path "$env:TEMPSideloadSim" -Recurse -Force -ErrorAction SilentlyContinue