ctipilot.ch

OctLurk

malware · malware:octlurk single-source

Plugin-based Windows backdoor deployed against government, healthcare, research, law-enforcement and education organisations in Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan and Syria since at least January 2025. Delivered by a malicious loader DLL invoked through a repointed Windows service ServiceMain value, which decrypts its payload with a hard-coded key plus a second key derived from the victim machine's C: drive serial number and loads it reflectively into memory. Pulls File Manager, Command Shell and Interaction Manager plugins directly from its command server into memory (Kaspersky GReAT, 2026-07-30).

Coverage timeline
3
first 2026-07-31 → last 2026-08-10
Peak priority
notable
3 notable
Sources cited
7
5 hosts
Sections touched
3
active-threats, updates, weekly-research
Co-occurring entities
5
see Related entities below
ATT&CK techniques
28
pinned v19.2 · see below

Hunting pivots

ATT&CK techniques
T1027 ×2T1543.003 ×2T1620 ×2T1003T1046T1053.005T1055T1056.001T1057T1059.003T1070.006T1095T1113T1114T1115T1132.002T1134.001T1134.003T1140T1185T1219T1480.001T1497.001T1518.001
Affected products
Apple macOSMicrosoft WindowsVMware ESXi
Tags
espionage ×3infostealer ×3nation-state ×3china-nexusmobileorganized-crimeransomware

ATT&CK techniques

28 techniques observed across 3 entries — derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

Execution TA0002

T1053.005Scheduled Task/Job: Scheduled Task×1

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.

Evidence: 2026-07-31/octlurk-silklurk-service-dll-plugin-backdoors-government · ATT&CK page ↗

T1059.003Command and Scripting Interpreter: Windows Command Shell×1

Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via Remote Services such as SSH.

Evidence: 2026-07-31/octlurk-silklurk-service-dll-plugin-backdoors-government · ATT&CK page ↗

T1574.001Hijack Execution Flow: DLL×1

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.

Evidence: 2026-08-02/weekly-w31-malware-keyed-to-the-victim-host · ATT&CK page ↗

Persistence TA0003

T1053.005Scheduled Task/Job: Scheduled Task×1

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.

Evidence: 2026-07-31/octlurk-silklurk-service-dll-plugin-backdoors-government · ATT&CK page ↗

T1543.003Create or Modify System Process: Windows Service×2

Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions. Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.

Evidence: 2026-08-02/weekly-w31-malware-keyed-to-the-victim-host · 2026-07-31/octlurk-silklurk-service-dll-plugin-backdoors-government · ATT&CK page ↗

Privilege Escalation TA0004

T1053.005Scheduled Task/Job: Scheduled Task×1

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.

Evidence: 2026-07-31/octlurk-silklurk-service-dll-plugin-backdoors-government · ATT&CK page ↗

T1055Process Injection×1

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.

Evidence: 2026-08-02/weekly-w31-malware-keyed-to-the-victim-host · ATT&CK page ↗

T1134.001Access Token Manipulation: Token Impersonation/Theft×1

Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls. For example, an adversary can duplicate an existing token using `DuplicateToken` or `DuplicateTokenEx`. The token can then be used with `ImpersonateLoggedOnUser` to allow the calling thread to impersonate a logged on user's security context, or with `SetThreadToken` to assign the impersonated token to a thread.

Evidence: 2026-08-10/bindcloak-rtlqueueworkitem-reflective-loading · ATT&CK page ↗

T1134.003Access Token Manipulation: Make and Impersonate Token×1

Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls. For example, if an adversary has a username and password but the user is not logged onto the system the adversary can then create a logon session for the user using the `LogonUser` function. The function will return a copy of the new session's access token and the adversary can use `SetThreadToken` to assign the token to a thread.

Evidence: 2026-08-10/bindcloak-rtlqueueworkitem-reflective-loading · ATT&CK page ↗

T1543.003Create or Modify System Process: Windows Service×2

Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions. Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.

Evidence: 2026-08-02/weekly-w31-malware-keyed-to-the-victim-host · 2026-07-31/octlurk-silklurk-service-dll-plugin-backdoors-government · ATT&CK page ↗

Stealth TA0005

T1027Obfuscated Files or Information×2

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.

Evidence: 2026-08-02/weekly-w31-malware-keyed-to-the-victim-host · 2026-07-31/octlurk-silklurk-service-dll-plugin-backdoors-government · ATT&CK page ↗

T1055Process Injection×1

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.

Evidence: 2026-08-02/weekly-w31-malware-keyed-to-the-victim-host · ATT&CK page ↗

T1070.006Indicator Removal: Timestomp×1

Adversaries may modify file time attributes to hide new files or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder and blend malicious files with legitimate files.

Evidence: 2026-07-31/octlurk-silklurk-service-dll-plugin-backdoors-government · ATT&CK page ↗

T1134.001Access Token Manipulation: Token Impersonation/Theft×1

Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls. For example, an adversary can duplicate an existing token using `DuplicateToken` or `DuplicateTokenEx`. The token can then be used with `ImpersonateLoggedOnUser` to allow the calling thread to impersonate a logged on user's security context, or with `SetThreadToken` to assign the impersonated token to a thread.

Evidence: 2026-08-10/bindcloak-rtlqueueworkitem-reflective-loading · ATT&CK page ↗

T1134.003Access Token Manipulation: Make and Impersonate Token×1

Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls. For example, if an adversary has a username and password but the user is not logged onto the system the adversary can then create a logon session for the user using the `LogonUser` function. The function will return a copy of the new session's access token and the adversary can use `SetThreadToken` to assign the token to a thread.

Evidence: 2026-08-10/bindcloak-rtlqueueworkitem-reflective-loading · ATT&CK page ↗

T1140Deobfuscate/Decode Files or Information×1

Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.

Evidence: 2026-08-02/weekly-w31-malware-keyed-to-the-victim-host · ATT&CK page ↗

T1480.001Execution Guardrails: Environmental Keying×1

Adversaries may environmentally key payloads or other features of malware to evade defenses and constraint execution to a specific target environment. Environmental keying uses cryptography to constrain execution or actions based on adversary supplied environment specific conditions that are expected to be present on the target. Environmental keying is an implementation of Execution Guardrails that utilizes cryptographic techniques for deriving encryption/decryption keys from specific types of values in a given computing environment.

Evidence: 2026-08-02/weekly-w31-malware-keyed-to-the-victim-host · ATT&CK page ↗

T1497.001Virtualization/Sandbox Evasion: System Checks×1

Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.

Evidence: 2026-08-02/weekly-w31-malware-keyed-to-the-victim-host · ATT&CK page ↗

T1574.001Hijack Execution Flow: DLL×1

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.

Evidence: 2026-08-02/weekly-w31-malware-keyed-to-the-victim-host · ATT&CK page ↗

T1620Reflective Code Loading×2

Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk (e.g., Shared Modules).

Evidence: 2026-08-10/bindcloak-rtlqueueworkitem-reflective-loading · 2026-07-31/octlurk-silklurk-service-dll-plugin-backdoors-government · ATT&CK page ↗

T1622Debugger Evasion×1

Adversaries may employ various means to detect and avoid debuggers. Debuggers are typically used by defenders to trace and/or analyze the execution of potential malware payloads.

Evidence: 2026-08-02/weekly-w31-malware-keyed-to-the-victim-host · ATT&CK page ↗

Defense Impairment TA0112

T1685Disable or Modify Tools×1

Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.

Evidence: 2026-08-02/weekly-w31-malware-keyed-to-the-victim-host · ATT&CK page ↗

Credential Access TA0006

T1003OS Credential Dumping×1

Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures. Credentials can then be used to perform Lateral Movement and access restricted information.

Evidence: 2026-07-31/octlurk-silklurk-service-dll-plugin-backdoors-government · ATT&CK page ↗

T1056.001Input Capture: Keylogging×1

Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when OS Credential Dumping efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems.

Evidence: 2026-07-31/octlurk-silklurk-service-dll-plugin-backdoors-government · ATT&CK page ↗

T1555.003Credentials from Password Stores: Credentials from Web Browsers×1

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.

Evidence: 2026-07-31/octlurk-silklurk-service-dll-plugin-backdoors-government · ATT&CK page ↗

Discovery TA0007

T1046Network Service Discovery×1

Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port, vulnerability, and/or wordlist scans using tools that are brought onto a system.

Evidence: 2026-07-31/octlurk-silklurk-service-dll-plugin-backdoors-government · ATT&CK page ↗

T1057Process Discovery×1

Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Administrator or otherwise elevated access may provide better process details. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Evidence: 2026-08-10/bindcloak-rtlqueueworkitem-reflective-loading · ATT&CK page ↗

T1497.001Virtualization/Sandbox Evasion: System Checks×1

Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.

Evidence: 2026-08-02/weekly-w31-malware-keyed-to-the-victim-host · ATT&CK page ↗

T1518.001Software Discovery: Security Software Discovery×1

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as cloud monitoring agents and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Evidence: 2026-07-31/octlurk-silklurk-service-dll-plugin-backdoors-government · ATT&CK page ↗

T1622Debugger Evasion×1

Adversaries may employ various means to detect and avoid debuggers. Debuggers are typically used by defenders to trace and/or analyze the execution of potential malware payloads.

Evidence: 2026-08-02/weekly-w31-malware-keyed-to-the-victim-host · ATT&CK page ↗

Collection TA0009

T1056.001Input Capture: Keylogging×1

Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when OS Credential Dumping efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems.

Evidence: 2026-07-31/octlurk-silklurk-service-dll-plugin-backdoors-government · ATT&CK page ↗

T1113Screen Capture×1

Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as <code>CopyFromScreen</code>, <code>xwd</code>, or <code>screencapture</code>.

Evidence: 2026-07-31/octlurk-silklurk-service-dll-plugin-backdoors-government · ATT&CK page ↗

T1114Email Collection×1

Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Emails may also contain details of ongoing incident response operations, which may allow adversaries to adjust their techniques in order to maintain persistence or evade defenses. Adversaries can collect or forward email from mail servers or clients.

Evidence: 2026-07-31/octlurk-silklurk-service-dll-plugin-backdoors-government · ATT&CK page ↗

T1115Clipboard Data×1

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

Evidence: 2026-07-31/octlurk-silklurk-service-dll-plugin-backdoors-government · ATT&CK page ↗

T1185Browser Session Hijacking×1

Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.

Evidence: 2026-08-02/weekly-w31-malware-keyed-to-the-victim-host · ATT&CK page ↗

Command and Control TA0011

T1095Non-Application Layer Protocol×1

Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive. Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).

Evidence: 2026-08-10/bindcloak-rtlqueueworkitem-reflective-loading · ATT&CK page ↗

T1132.002Data Encoding: Non-Standard Encoding×1

Adversaries may encode data with a non-standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a non-standard data encoding system that diverges from existing protocol specifications. Non-standard data encoding schemes may be based on or related to standard data encoding schemes, such as a modified Base64 encoding for the message body of an HTTP request.

Evidence: 2026-08-10/bindcloak-rtlqueueworkitem-reflective-loading · ATT&CK page ↗

T1219Remote Access Tools×1

An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management. Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.

Evidence: 2026-07-31/octlurk-silklurk-service-dll-plugin-backdoors-government · ATT&CK page ↗

Story timeline

  1. 2026-08-10UPDATE — BINDCLOAK unpacked: a modular C++ backdoor that routes every DLL load through RtlQueueWorkItem to keep LoadLibraryW off unbacked memory, assessed high-confidence an OctLurk variant
    updatesZscaler's second instalment details the toolkit's final stage and extends the campaign to Middle East energy targets
  2. 2026-08-02This week's tradecraft was built against the analyst's environment, not the endpoint agent — samples that refuse to run without a keyed argument, loaders that cannot decrypt away from the host they infected, and operators driving the victim's own logged-in session
    weekly-researchFive W31 families converge on environmental keying — the sample will not detonate or decrypt outside its target
  3. 2026-07-31OctLurk and SilkLurk — sibling plugin backdoors whose loaders key their payload decryption to the victim machine itself, deployed against Central Asian and Syrian government bodies
    active-threatsKaspersky documents loaders that cannot be unpacked away from the host they infected, delivering in-memory-only plugins

Relationships explore in graph

Typed, source-stated connections from the entity registry — each edge cites the entry whose reporting establishes it.

overlaps with

has variant

Where this entity is cited

  • active-threats1
  • weekly-research1
  • updates1

Source distribution

  • securelist.com3 (43%)
  • blackfog.com1 (14%)
  • securityweek.com1 (14%)
  • unit42.paloaltonetworks.com1 (14%)
  • zscaler.com1 (14%)

Co-occurring entities

Derived — referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

All cited sources (7)

Entries about OctLurk (3)

2026-08-10 · view entry permalink →

NOTABLEupdateNATOB2

UPDATE — BINDCLOAK unpacked: a modular C++ backdoor that routes every DLL load through RtlQueueWorkItem to keep LoadLibraryW off unbacked memory, assessed high-confidence an OctLurk variant

UPDATE · originally covered TELESHIM / MIXEDKEY / BINDCLOAK — DLL side-loading under a legitimate vendor binary, Telegram-API C2 and volume-serial environmental keying against government networks (2026-07-26)

the earlier entry covered Part 1 of this series — the TELESHIM backdoor and the MIXEDKEY loader, and the environmental keying that ties a payload to the host it infected. Zscaler ThreatLabz has now published Part 2, a teardown of the toolkit's final stage (Zscaler ThreatLabz, 2026-08-03). Two things in it are new rather than restatement: the loading tradecraft, and a targeting expansion.

BINDCLOAK is described as "a 64-bit modular backdoor written in C++ that uses a complex message routing mechanism to manage the C2 communication channel," running two built-in modules alongside plugin DLLs delivered from the command server. The detail worth carrying into detection engineering is how those DLLs get loaded. Plugin modules are reflectively loaded, and when resolving their imports the backdoor queues LoadLibraryW through RtlQueueWorkItem rather than calling it directly — Zscaler is explicit about the reason, which is that a LoadLibraryW call originating from an unbacked executable memory region is exactly what endpoint tooling flags. This is evasion aimed at a specific, widely deployed heuristic: the call still happens, but the thread that makes it belongs to the thread pool rather than to the injected region, so the stack the detection inspects no longer points where it expects.

The rest of the design continues Part 1's environmental-keying theme without repeating it. A four-byte per-victim identifier is derived by summing the ASCII values of the computer name and adding the volume serial number, and travels in every command-and-control message. Traffic is encoded under two layers of XOR and carried over TLS on TCP. Eleven commands are grouped around tokens — collecting user tokens through an authentication call, enumerating processes to decide which tokens are worth taking, and starting modules under either a stolen user token or a duplicated process token — with the remainder covering module lifecycle and one command whose purpose ThreatLabz says it has not determined.

The attribution language matters and is carried exactly as published: ThreatLabz "assesses with high-confidence that BINDCLOAK is a variant of OctLurk." That is an assessment of family relationship, not an identity claim, and OctLurk itself is a family Kaspersky separately documented against Central Asian and Syrian government targets (Kaspersky GReAT, 2026-07-30). The targeting delta is that the July 2026 campaign shows "a notable expansion of operations to target the Middle East with a key focus on the energy vertical."

Detection, telemetry class first. The reflective-loading behaviour surfaces in image-load and thread telemetry rather than on disk: a module load whose initiating thread belongs to the process thread pool while the corresponding executable memory region has no backing file is the shape, and it is precisely the correlation that a stack-based LoadLibraryW heuristic alone will miss. Token activity is the second class — process enumeration immediately followed by token duplication with primary-token assignment rights, then a new module executing under a different user context within the same process. Network telemetry shows TLS over TCP with a fixed short identifier repeated across sessions from the same host. Triage: thread-pool work items and LoadLibraryW are both entirely ordinary in benign software, and legitimate services duplicate tokens routinely; the discriminator is the combination of an unbacked executable region in the same process, a module load initiated from a pool thread, and token duplication following process enumeration — no single element is anomalous alone.

BINDCLOAK is a 64-bit modular backdoor written in C++ that uses a complex message routing mechanism to manage the C2 communication channel.

When resolving imports, each DLL is loaded via RtlQueueWorkItem with LoadLibraryW and the DLL name as arguments to evade EDRs since LoadLibraryW calls from unbacked executable memory regions are considered highly suspicious by EDRs.

ThreatLabz assesses with high-confidence that BINDCLOAK is a variant of OctLurk.

the new campaign we identified in July 2026 highlights a notable expansion of operations to target the Middle East with a key focus on the energy vertical.

Zscaler ThreatLabz 2026-08-03
threat10 Aug 04:46Zmulti-sourceOpen finding ↗
Sources: Zscaler ThreatLabz · Kaspersky GReAT

2026-08-02 · view entry permalink →

NOTABLENATOB2

This week's tradecraft was built against the analyst's environment, not the endpoint agent — samples that refuse to run without a keyed argument, loaders that cannot decrypt away from the host they infected, and operators driving the victim's own logged-in session

Most evasion research describes malware hiding from a product. This week's crop describes malware hiding from the process — refusing to reveal itself outside the exact machine it was built for, which defeats the sandbox, the shared sample repository and the offline unpack in one move.

The clearest expression is in the loaders Kaspersky documented against government, healthcare, research and law-enforcement organisations in Central Asia and Syria. OctLurk and SilkLurk both install a Windows service pointing at a malicious loader DLL, and the loader is the interesting part: "the backdoor loaders are customized for each victim and use information from the victim's machine to decrypt the payload. Both the loaders and the backdoors are heavily obfuscated, making analysis more complicated." (Kaspersky Securelist, 2026-07-30). For OctLurk one of the two decryption keys derives from the C: volume serial number and for SilkLurk from a hash of the computer name — meaning a sample pulled off a compromised host and shared with a partner organisation, a vendor or a CERT is inert cryptographic noise to everyone who did not own that machine. Kaspersky assesses a single Chinese-speaking actor behind both at medium confidence while stating it could not attribute the activity to any known group (Kaspersky Securelist, 2026-07-30).

Mirage Kitten's NightLedger applies the same principle to execution rather than decryption: it limits execution to a specific username by "hardcoding a 3-character control value that must appear as a substring in the lowercased Windows username retrieved via GetUserNameA. If the match fails, the implant silently exits, confirming per-target tailoring of each deployed binary." (Kaspersky Securelist, 2026-07-28). A detonation on any analysis VM produces a clean, silent exit — indistinguishable from a benign file. The same toolset also masquerades as SspiCli.dll to load under a legitimate AppVShNotify.exe through RPCRT4.dll's delay-load path (Kaspersky Securelist, 2026-07-28), and Kaspersky's telemetry places its victims in Middle Eastern and African countries rather than the Central Asian set above (Kaspersky Securelist, 2026-07-28).

GenieLocker adds the anti-analysis layer and one deliberate omission that is a direct answer to a common detection. It "starts a new parallel thread called watchdog. It runs in an infinite loop that performs a number of checks to detect well-known debuggers every 500 milliseconds. If at least one of the checks fails, the whole GenieLocker process immediately terminates." (Kaspersky Securelist, 2026-07-30). It also declines to leave the artifact most ransomware detection keys on: "GenieLocker doesn't save the ransom notes on the victim's system. The Trojan doesn't contain any attackers' contact info or negotiation addresses. Instead, the attackers will need to deliver the ransom demands and contacts manually during the attack." (Kaspersky Securelist, 2026-07-30) — a design decision that trades operator convenience for defeating mass-readme-creation heuristics. Its own entry into the analysed environment came through a trusted-partner OpenVPN connection using stolen but still valid credentials (Kaspersky Securelist, 2026-07-30).

The last two attack the defender's tooling and the defender's assumptions rather than their analysis. XCSSET v40 stops leaving scripts on disk between cycles, writing "a Base64-encoded staging payload into a preferences domain it generates per host" (Palo Alto Networks Unit 42, 2026-07-31), and then reaches for the platform's own defences: "the malware spawns a Perl process that tries to acquire and hold access to the endpoint's YARA-rule database (XPdb). This exclusive file lock on the XProtect signature database ensures that if the endpoint does receive a security update, its content could not be written to disk." (Palo Alto Networks Unit 42, 2026-07-31) — the signature update is delivered and then cannot land. And MedusaHVNC removes the anomaly from fraud controls entirely by operating inside the session that is already trusted: "the browser still runs on the victim's device, so it can load an existing profile, including cookies and session state." (BlackFog, 2026-07-27). Its loader is injected into charmap.exe, the standard Windows Character Map utility, using a trusted system binary as the payload host (BlackFog, 2026-07-27); hidden desktops themselves are a legitimate Windows capability used by specialised software (SecurityWeek, 2026-07-27).

Triage: because the samples are inert off-host, the detectable events are the ones the mechanism cannot avoid producing on the victim. For the keyed loaders: a Windows service or scheduled task whose target DLL sits outside the vendor's install tree, reading the volume serial number or computer name shortly before decrypting and mapping executable memory. For GenieLocker: mass file modification with no readme creation, which inverts the usual heuristic, alongside process termination correlated with debugger attachment. For XCSSET: a Perl or scripting process holding an open exclusive handle on the XProtect database, and writes to a per-host preferences domain the user never configured. For MedusaHVNC: creation of a second interactive desktop, and a browser process launched with an existing profile whose parent is a scripting or automation binary rather than the shell — legitimate specialised software does use hidden desktops, so the parent lineage and the profile reuse together are the discriminator rather than the desktop alone.

GenieLocker starts a new parallel thread called watchdog. It runs in an infinite loop that performs a number of checks to detect well-known debuggers every 500 milliseconds. If at least one of the checks fails, the whole GenieLocker process immediately terminates.

GenieLocker doesn't save the ransom notes on the victim's system. The Trojan doesn't contain any attackers' contact info or negotiation addresses. Instead, the attackers will need to deliver the ransom demands and contacts manually during the attack.

Kaspersky Securelist 2026-07-30

The backdoor loaders are customized for each victim and use information from the victim's machine to decrypt the payload. Both the loaders and the backdoors are heavily obfuscated, making analysis more complicated.

Still, it implements the same technique of limiting execution to a specific username on the infected machine by hardcoding a 3-character control value that must appear as a substring in the lowercased Windows username retrieved via GetUserNameA. If the match fails, the implant silently exits, confirming per-target tailoring of each deployed binary.

Kaspersky Securelist (GReAT) 2026-07-30

The malware spawns a Perl process that tries to acquire and hold access to the endpoint's YARA-rule database (XPdb). This exclusive file lock on the XProtect signature database ensures that if the endpoint does receive a security update, its content could not be written to disk.

Palo Alto Networks Unit 42 2026-07-31

The browser still runs on the victim’s device, so it can load an existing profile, including cookies and session state.

BlackFog 2026-07-27

Builds on: 2026-07-31/genielocker-toy-ghouls-no-ransom-note-esxi-ransomware · 2026-07-31/octlurk-silklurk-service-dll-plugin-backdoors-government · 2026-07-29/mirage-kitten-nightledger-proxy-aware-websocket-tunnelers · 2026-08-01/xcsset-v40-macos-defaults-fileless-persistence · 2026-07-28/medusahvnc-hidden-desktop-browser-session-hijacking

research02 Aug 23:57Zmulti-sourceOpen finding ↗
Sources: Kaspersky Securelist · Kaspersky Securelist (GReAT) · Palo Alto Networks Unit 42 · BlackFog · SecurityWeek

2026-07-31 · view entry permalink →

NOTABLENATOB2

OctLurk and SilkLurk — sibling plugin backdoors whose loaders key their payload decryption to the victim machine itself, deployed against Central Asian and Syrian government bodies

Kaspersky GReAT published analysis of two new plugin-based backdoors on 2026-07-30, naming them OctLurk and SilkLurk (Kaspersky Securelist, 2026-07-30). Victim organisations sit in Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan and Syria, across healthcare, research, government offices, foreign-affairs ministries, logistics, law enforcement, urban planning and public education. The victimology is out of scope for this constituency; the loader design and the plugin architecture are the reason the entry is here, because both are aimed squarely at the analysis and detection workflow a government SOC would use against them.

Everything here starts after the attacker already has administrative credentials. OctLurk's chain begins with a scheduled task created on remote machines with admin rights, set to run once under the System account immediately after creation. That task runs a batch script from a user profile folder or a temporary directory, which installs a Windows service; the service's ServiceMain registry parameter is then repointed to invoke an export of a malicious loader DLL rather than a legitimate service binary. The loader exports two functions, and the one the service calls simply invokes the other, which carries the actual logic. SilkLurk reaches the same place by a different route — its own service name, and side-loading under a legitimate binary rather than the ServiceMain repoint.

The loader is built to be useless to an analyst who does not also have the victim's machine. Taking OctLurk's, it locates its payload by decrypting a hard-coded byte blob through two successive XOR passes and a decompression step, then applies the identical process to the payload itself to produce the backdoor DLL. Two keys are involved: one is baked into the binary, and the second is derived at runtime from the serial number of the victim's C: drive. SilkLurk's loader does the same thing with a different host identifier, computing a hash of the victim's computer name. A sample lifted from one host therefore cannot be unpacked on an analyst's workstation, in a sandbox, or against any other victim — Kaspersky states plainly that the loaders are customised per victim and use information from the victim's machine to decrypt the payload. The resulting backdoor DLL is loaded reflectively into memory and never written to disk in decrypted form. The same double-XOR-and-compress framing wraps command-server traffic in both directions, with a freshly generated random key travelling in each packet header, so the wire format changes every session even though the static key does not.

Plugins arrive from the command server and stay in memory. Kaspersky documents three. A file manager enumerates volumes and directories, reads and writes files in chunks with integrity checking, executes commands, and — worth noting for anyone doing timeline work afterwards — deliberately rewrites file timestamps to attacker-supplied values. A command shell either maintains an interactive cmd.exe session or, when none is running, executes each command non-interactively with output redirected to a temporary file that it reads back and then deletes. An interaction manager captures the screen on demand or on an interval, reads and writes the clipboard, and synthesises mouse movement, clicks and keystrokes through low-level Windows input events — full hands-on-keyboard control delivered as a plugin rather than as a separate remote-access tool.

Post-compromise, the operators run a fingerprinting script that inventories sessions, Kerberos tickets, running tasks, antivirus products and Defender's tamper-protection and exclusion settings, network connections and hardware, and specifically queries the Windows Security log for the last few successful remote-interactive logons. They then deploy Impacket's secretsdump for credential extraction, a keylogger persisted under a scheduled task named after a legitimate remote-access product, a browser-password decryptor targeting Chrome and Firefox credential stores, Pandora RC agents for durable remote access, the FSCAN network scanner, and email-harvesting tooling. SilkLurk victims additionally receive PlugX — which Kaspersky describes as a modular remote-access trojan active since at least 2008 and historically linked to Chinese-speaking threat actors, and which is part of what supports its attribution language — and SilkLurk intrusions show operators mounting shares with harvested admin credentials, hunting documents by hand, and archiving them before exfiltration.

Kaspersky also reports that several command-server addresses used by OctLurk and its companion proxy utility appear in a Kazakhstani State Technical Service report on a separate Linux-targeting implant — tracked as TrustFall by that agency, MystRodX by Qianxin and SilentRaid by Cisco Talos — and it is explicit that this points to shared infrastructure across campaigns without establishing whether they ran at the same time.

Detection. Four behaviours here are strong hunt anchors and none of them depend on knowing this malware. First, service creation where the ServiceMain parameter points at a DLL export in a path outside the normal system directories — a configuration that legitimate services essentially never use. Second, a scheduled task created remotely to run once under System immediately after creation, executing a script from a user profile or temporary directory. Third, in process telemetry, the non-interactive shell pattern: a cmd.exe child redirecting output to a temporary file in the user temp directory, followed within moments by a read of that file and its deletion — the create-read-delete triple on a short-lived temp file is far more distinctive than any one of the three events. Fourth, in the same log the operators query, an inventory sweep that touches session enumeration, Kerberos ticket listing, antivirus product enumeration and Defender exclusion registry keys inside a single short window from one process lineage.

Triage: administrators run every one of those discovery commands individually, and management agents create services and scheduled tasks constantly. The discriminators are sequence and origin: the fingerprinting commands arrive as one uninterrupted batch from a single script rather than typed over minutes; the service points at a DLL export rather than an executable; and the scheduled task runs exactly once and never again, which is the opposite of what a legitimate maintenance task looks like.

We assess with medium confidence that the same threat actor is behind both backdoors, and that they are Chinese-speaking. However, at the time of publication, we couldn't attribute this activity to any known group.

The backdoor loaders are customized for each victim and use information from the victim's machine to decrypt the payload. Both the loaders and the backdoors are heavily obfuscated, making analysis more complicated.

Kaspersky Securelist (GReAT) 2026-07-30
threat31 Jul 04:09Zsingle-sourceOpen finding ↗
Sources: Kaspersky Securelist (GReAT)