CTIPilot

SilkParasite

campaign · campaign:silkparasite-central-asia-2026 single-source

Bitdefender Labs designation for a cyberespionage operation it assesses at medium confidence as China-nexus, targeting government bodies handling economic policy across Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, Kazakhstan and Georgia since roughly late 2025. Seven remote-access tool families are in use, five of them newly documented; command-and-control channels include a shared Google Drive folder and HTTP cookie and ETag header values, and the toolset carries indicators Bitdefender reads as AI-assisted development at medium confidence (Bitdefender Labs, 2026-08-19).

Coverage timeline
2
first 2026-08-23 → last 2026-08-28
Peak priority
notable
2 notable
Sources cited
2
2 hosts
Sections touched
2
active-threats, research
Co-occurring entities
7
see Co-occurring entities below
ATT&CK techniques
8
pinned v19.2 · see below
2026-08-242 appearances2026-08-28

Hunting pivots

ATT&CK techniques
T1027T1047T1071.001T1102.002T1566.001T1573.001T1574.001T1620
Tags
ai-abuse ×2china-nexuscloudespionageinfostealernation-stateransomware

ATT&CK techniques

8 techniques observed across 1 entry, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

Initial Access TA0001

T1566.001Phishing: Spearphishing Attachment×1

Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon User Execution to gain execution. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.

Evidence: 2026-08-24/silkparasite-dll-sideload-pairing-google-drive-c2 · ATT&CK page ↗

Execution TA0002

T1047Windows Management Instrumentation×1

Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is designed for programmers and is the infrastructure for management data and operations on Windows systems. WMI is an administration feature that provides a uniform environment to access Windows system components.

Evidence: 2026-08-24/silkparasite-dll-sideload-pairing-google-drive-c2 · ATT&CK page ↗

T1574.001Hijack Execution Flow: DLL×1

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.

Evidence: 2026-08-24/silkparasite-dll-sideload-pairing-google-drive-c2 · ATT&CK page ↗

Stealth TA0005

T1027Obfuscated Files or Information×1

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.

Evidence: 2026-08-24/silkparasite-dll-sideload-pairing-google-drive-c2 · ATT&CK page ↗

T1574.001Hijack Execution Flow: DLL×1

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.

Evidence: 2026-08-24/silkparasite-dll-sideload-pairing-google-drive-c2 · ATT&CK page ↗

T1620Reflective Code Loading×1

Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk (e.g., Shared Modules).

Evidence: 2026-08-24/silkparasite-dll-sideload-pairing-google-drive-c2 · ATT&CK page ↗

Command and Control TA0011

T1071.001Application Layer Protocol: Web Protocols×1

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Evidence: 2026-08-24/silkparasite-dll-sideload-pairing-google-drive-c2 · ATT&CK page ↗

T1102.002Web Service: Bidirectional Communication×1

Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel. The return traffic may occur in a variety of ways, depending on the Web service being utilized. For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet.

Evidence: 2026-08-24/silkparasite-dll-sideload-pairing-google-drive-c2 · ATT&CK page ↗

T1573.001Encrypted Channel: Symmetric Cryptography×1

Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, DES, 3DES, Blowfish, and RC4.

Evidence: 2026-08-24/silkparasite-dll-sideload-pairing-google-drive-c2 · ATT&CK page ↗

Story timeline

  1. 2026-08-28Unit 42's dataset of 405 AI-enabled malware samples finds 97% never leave sandboxes, and every sample that reached a production environment was caught by existing behavioural detection with no novel approach required
    researchThe counter-hype finding: AI-written malware still triggers the same sandbox, behavioural-analytics and entropy detections that catch conventional malware
  2. 2026-08-24SilkParasite runs seven RAT families behind six signed-application side-loading pairs, and the reusable detection is the pairing itself, not any DLL name: a signed binary loading a library placed beside it from an unusual location
    active-threatsSilkParasite gets five named RAT families and one reusable detection: the side-loading pairing, not the DLL name

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

uses

Where this entity is cited

  • active-threats1
  • research1

Source distribution

  • bitdefender.com1 (50%)
  • unit42.paloaltonetworks.com1 (50%)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

All cited sources (2)

Entries about SilkParasite (2)

2026-08-28 · view entry permalink →

NOTABLENATOB2

Unit 42's dataset of 405 AI-enabled malware samples finds 97% never leave sandboxes, and every sample that reached a production environment was caught by existing behavioural detection with no novel approach required

Unit 42 analysed 405 AI-enabled malware samples and reports that approximately 97% exist only in research repositories and public sandboxes such as VirusTotal; "approximately 97% of the samples we examined exist only in sandboxes and on VirusTotal" (Palo Alto Networks Unit 42, 2026-08-25), with just 12 samples observed attempting to reach production environments across Cortex XDR-protected endpoints, and every one of those 12 detected and blocked before execution completed. Five malware families accounted for the in-the-wild attempts: FunkSec ransomware, a set of trojanised AI-branded applications, the Oyster backdoor, the Rhadamanthys stealer, and a COM-hijacking DLL.

The most concrete evidence of LLM-assisted development speed is FunkSec, which the report says produced seven distinct ransomware-builder variants in six days: "seven distinct builds in six days is a pace that suggests LLM-assisted development, where generating a new variant is closer to a prompt generation rather than a software development task" (Palo Alto Networks Unit 42, 2026-08-25). The report's central, counter-hype finding is that none of the 405 samples required a novel detection approach: "none of the AI-enabled samples in our dataset required a novel detection approach. The AI component influenced how the malware was written, but the resulting binary still exhibits the same behavioral indicators that existing detection logic targets" (Palo Alto Networks Unit 42, 2026-08-25), sandbox detonation, behavioural analytics, code-signing anomaly detection and entropy analysis caught every sample without modification.

This is a direct, data-rich complement to the "AI bought throughput not capability" thread already covered here on 2026-08-23 (Talos/UAT-10147, Bitdefender/SilkParasite, CISA/Siemens-S7-tooling, Insikt/PurpleDelta): Unit 42 supplies the quantitative production-versus-sandbox ratio and detection-sufficiency claim that the earlier reporting argued qualitatively, without repeating any of that reporting's own findings.

The direct calibration input for a SOC is whether to invest in AI-malware-specific detection tooling versus trusting existing behavioural and sandbox pipelines, Unit 42's own data argues for the latter, though as a vendor's account of its own products' performance rather than an independently-verified detection-rate statistic.

None of the AI-enabled samples in our dataset required a novel detection approach. The AI component influenced how the malware was written, but the resulting binary still exhibits the same behavioral indicators that existing detection logic targets.

Seven distinct builds in six days is a pace that suggests LLM-assisted development, where generating a new variant is closer to a prompt generation rather than a software development task.

Approximately 97% of the samples we examined exist only in sandboxes and on VirusTotal.

Palo Alto Networks products detected and blocked every sample that attempted to reach a customer environment.

Palo Alto Networks Unit 42 2026-08-25
research28 Aug 06:40Zsingle-sourceOpen finding ↗
Sources: Palo Alto Networks Unit 42

2026-08-24 · view entry permalink →

NOTABLENATOB2

SilkParasite runs seven RAT families behind six signed-application side-loading pairs, and the reusable detection is the pairing itself, not any DLL name: a signed binary loading a library placed beside it from an unusual location

Bitdefender published an analysis on 2026-08-19 of SilkParasite, a cluster designation for espionage activity against government bodies in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan and Kazakhstan using regionally tailored lures (several impersonating specific ministries) with one further document recovered from a public malware-sharing platform addressed to a Georgian government entity (Bitdefender, 2026-08-19). Seven remote-access families are involved. Two were previously documented by other vendors; five are newly named here, DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT and NodeEdgeRAT.

Two of the five are worth a defender's attention for their command-and-control choices rather than their capabilities. DriveSilkRAT runs its tasking entirely through a shared Google Drive folder: operators drop command files in, the infected host polls the folder, downloads the tasking, executes it through a system of twelve custom in-memory .NET plugins covering process listing, system and network enumeration, file management and command execution, and uploads results back to the same folder. Its command execution runs through Windows Management Instrumentation rather than spawning a command interpreter directly, which removes the parent-child process shape most detections key on. Bitdefender observed roughly 65 infection instances at the time of writing, stating that figure is an upper bound rather than a machine count because the victim identifiers derive from hardware fingerprinting. CookiETagRAT puts its tasking in HTTP Cookie and ETag response headers, returning results in the body, with each host deriving its own stream-cipher key and nonce from a unique system identifier plus a fixed suffix, so captured traffic from one victim cannot decrypt another's. It also runs its malicious logic directly from the library's entry point rather than waiting for an exported function to be called, which makes it fire immediately in a sandbox as well as on a victim.

Initial access is a malicious Microsoft Office document, most likely spearphished, rather than the side-loading itself; what side-loading gives is the most consistent detection surface across the campaign; Bitdefender's phrasing is "most of the toolset", not all of it. Six side-loading pairs are named, each a legitimately signed application loading a malicious library placed alongside it: Calibre's ebook editor, ABBYY FineReader, a Quick Heal component, Mp3tag, a Windows Defender service binary, and one still-unidentified signed host. Bitdefender's own formulation of the detection is the reusable part: "The most consistent detection surface across the campaign is DLL sideloading, and the reliable signal is the pairing, not the DLL name alone: a legitimately signed application loading a library placed beside it while running from an unusual location." On the question of AI involvement it is measured rather than breathless ("SilkParasite is primarily assisted: capable humans do the engineering and lean on AI to move faster, leaving behind a few tells but none of the degradation") with the tells being leftover test functions in the Go orchestrator, a hardcoded placeholder encryption key, a configuration field still carrying a change-me name, and a suspiciously close architectural resemblance between two implants written in different languages.

Triage: signed applications legitimately load libraries from their own install directory constantly, which is why the location and not the load is the discriminator; the same signed binary running from its vendor install path is normal, and running from a user profile, temporary or removable-media path is the anomaly worth an alert. For the Defender-component pair specifically, the benign twin is the real service running from its own protected directory; a copy of it running from anywhere else is not a false positive. On the network side, consumer cloud-storage and code-hosting traffic from a workstation is ordinary; the discriminators are the client identity and the rhythm; a long-lived process that is not a sync client or a browser, polling the same folder or endpoint on a fixed interval, with request and response sizes that stay small and regular.

The most consistent detection surface across the campaign is DLL sideloading, and the reliable signal is the pairing, not the DLL name alone: a legitimately signed application loading a library placed beside it while running from an unusual location.

SilkParasite is primarily assisted: capable humans do the engineering and lean on AI to move faster, leaving behind a few tells but none of the degradation.

Bitdefender 2026-08-19
threat24 Aug 09:18Zsingle-sourceOpen finding ↗
Sources: Bitdefender