DriveSilkRAT

SilkParasite runs seven RAT families behind six signed-application side-loading pairs — and the reusable detection is the pairing itself, not any DLL name: a signed binary loading a library placed beside it from an unusual location

Bitdefender published an analysis on 2026-08-19 of SilkParasite, a cluster designation for espionage activity against government bodies in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan and Kazakhstan using regionally tailored lures — several impersonating specific ministries — with one further document recovered from a public malware-sharing platform addressed to a Georgian government entity (Bitdefender, 2026-08-19). Seven remote-access families are involved. Two were previously documented by other vendors; five are newly named here — DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT and NodeEdgeRAT.

Two of the five are worth a defender's attention for their command-and-control choices rather than their capabilities. DriveSilkRAT runs its tasking entirely through a shared Google Drive folder: operators drop command files in, the infected host polls the folder, downloads the tasking, executes it through a system of twelve custom in-memory .NET plugins covering process listing, system and network enumeration, file management and command execution, and uploads results back to the same folder. Its command execution runs through Windows Management Instrumentation rather than spawning a command interpreter directly, which removes the parent-child process shape most detections key on. Bitdefender observed roughly 65 infection instances at the time of writing, stating that figure is an upper bound rather than a machine count because the victim identifiers derive from hardware fingerprinting. CookiETagRAT puts its tasking in HTTP Cookie and ETag response headers, returning results in the body, with each host deriving its own stream-cipher key and nonce from a unique system identifier plus a fixed suffix — so captured traffic from one victim cannot decrypt another's. It also runs its malicious logic directly from the library's entry point rather than waiting for an exported function to be called, which makes it fire immediately in a sandbox as well as on a victim.

Initial access is a malicious Microsoft Office document, most likely spearphished, rather than the side-loading itself; what side-loading gives is the most consistent detection surface across the campaign — Bitdefender's phrasing is "most of the toolset", not all of it. Six side-loading pairs are named, each a legitimately signed application loading a malicious library placed alongside it: Calibre's ebook editor, ABBYY FineReader, a Quick Heal component, Mp3tag, a Windows Defender service binary, and one still-unidentified signed host. Bitdefender's own formulation of the detection is the reusable part: "The most consistent detection surface across the campaign is DLL sideloading, and the reliable signal is the pairing, not the DLL name alone: a legitimately signed application loading a library placed beside it while running from an unusual location." On the question of AI involvement it is measured rather than breathless — "SilkParasite is primarily assisted: capable humans do the engineering and lean on AI to move faster, leaving behind a few tells but none of the degradation" — with the tells being leftover test functions in the Go orchestrator, a hardcoded placeholder encryption key, a configuration field still carrying a change-me name, and a suspiciously close architectural resemblance between two implants written in different languages.

Triage: signed applications legitimately load libraries from their own install directory constantly, which is why the location and not the load is the discriminator — the same signed binary running from its vendor install path is normal, and running from a user profile, temporary or removable-media path is the anomaly worth an alert. For the Defender-component pair specifically, the benign twin is the real service running from its own protected directory; a copy of it running from anywhere else is not a false positive. On the network side, consumer cloud-storage and code-hosting traffic from a workstation is ordinary; the discriminators are the client identity and the rhythm — a long-lived process that is not a sync client or a browser, polling the same folder or endpoint on a fixed interval, with request and response sizes that stay small and regular.

Builds on: 2026-08-23/weekly-w34-c2-rendezvous-moved-to-services-you-cannot-block · 2026-08-23/weekly-w34-ai-bought-throughput-not-capability