Geography and targets: ministries, hospitals, and schools
Kaspersky says the campaign has struck a broad set of public sector and civic institutions across Central Asia and the Syrian Arab Republic. Affected organizations operate in healthcare, research, government offices, ministries of foreign affairs, logistics, law‑enforcement agencies, urban planning and facilities management, and public educational establishments. The activity "has not been linked to any known adversary or group," Kaspersky reported.
OctLurk: memory‑resident backdoor, loader behavior, and C2 infrastructure
Kaspersky is tracking a new obfuscated backdoor family it calls OctLurk. According to researchers Saurabh Sharma and Yaroslav Kikel, OctLurk is injected into memory and deployed via a loader that first checks internet connectivity to the domain dns.ssentialserv[.]xyz before executing a batch script that launches a specialized proxy utility, LurkProxy. OctLurk then establishes contact with a remote server at 154.196.162[.]76 for command‑and‑control (C2).
OctLurk collects system information, encrypts it, and sends it to a hard‑coded C2 server at dns.multitoconference[.]com over a stream socket connection. The implant is designed to load plugins into memory on demand. Researchers say OctLurk and its plugins can perform a wide range of post‑compromise tasks including launching command shells, performing file system activity, synthesizing keyboard and mouse events, network scanning, credential dumping, keylogging, password theft from browsers, email collection, and remote access.
- Operational details observed include host fingerprinting and harvesting system data; exporting and querying successful remote interactive logon events; and harvesting password hashes from domain controllers using Impacket's "secretsdump.py" tool.
- Operators dropped a keylogger masquerading as AnyDesk, decrypted and extracted passwords from Google Chrome and Mozilla Firefox, and established remote access using a Pandora RC agent.
- OctLurk's loader uses machine‑specific data — the drive serial number — to decode payload locations and contents, limiting artifacts on disk and complicating automated detection.
LurkProxy: dual‑mode reverse proxying to route traffic
LurkProxy is the campaign's specialized utility for proxying network traffic. Kaspersky describes it as capable of functioning as a reverse proxy in two distinct modes: SOCKS5 or a transparent proxy. At any one time, the malware operates in only a single mode to route traffic through a target address, allowing operators to pivot or mask inbound and outbound access through compromised hosts.
SilkLurk: DLL side‑loading, data staging, and PlugX delivery
SilkLurk is the second backdoor family Kaspersky identified. It is launched via a DLL executed through a DLL side‑loading sequence. After loading, the DLL creates a TCP socket to a configured C2 server, gathers victim information and transmits it, then awaits server commands. The C2 can request the system's local time, set a sleep interval for polling cadence, push or update configuration, and send additional plugins to be injected into memory.
Observed post‑compromise behavior attributed to SilkLurk includes invoking cmd.exe to launch PowerShell to connect to shared network resources with administrative credentials, search and stage confidential documents, then archive stolen files with WinRAR or 7‑Zip prior to exfiltration. Operators also initiated a DLL side‑loading chain to drop PlugX, a known backdoor, from the infected machine. SilkLurk's loader uses the computer name as part of victim‑specific encoding, again reducing static artifacts on disk.
Infrastructure overlap with SilentRaid (MystRodX/TrustFall) and implications
Kaspersky found infrastructure overlaps between the OctLurk/SilkLurk campaign and a prior set of attacks involving a C++ implant tracked as SilentRaid (aka MystRodX and TrustFall). The company said this "points to shared infrastructure across multiple OS‑targeting campaigns," while noting it is unclear whether the activities ran concurrently or at different times. Both OctLurk and SilkLurk operate primarily in memory, leaving only a minimalistic loader on disk — a technique Kaspersky highlights as aiding evasion and complicating automated detection.
What this means for technologists, policymakers, and affected government organizations
- Technologists and security teams: watch for memory‑resident loaders and plugins, monitor for anomalous checks to dns.ssentialserv[.]xyz and connections to dns.multitoconference[.]com and 154.196.162[.]76, and treat machine‑specific decoding (drive serial number, computer name) as an indicator of targeted, host‑tailored payloads.
- Policymakers and regional security planners: the campaign's cross‑border focus on ministries, law enforcement, healthcare and education underscores the need for coordinated incident response among affected states and information‑sharing on observed infrastructure overlaps such as the link to SilentRaid/MystRodX/TrustFall.
- Affected government organizations (healthcare, research, urban planning, logistics, education): be alert to credential theft tools (secretsdump.py), keyloggers masquerading as legitimate remote tools, browser password extraction, use of Pandora RC, Fscan network discovery and attempts to authenticate to internal services using harvested credentials.
Kaspersky's account leaves several operational details — notably the initial access vector — unspecified, but the technical footprint the company documents is concrete: memory‑resident multi‑plugin frameworks, host‑specific payload encoding, a dedicated proxy utility, and infrastructure that overlaps with previous campaigns. That combination suggests an operator prioritizing stealth and persistence in a geographically concentrated set of government targets; who is running that infrastructure, and why these particular sectors were selected, remain open questions.
