SilkParasite Cyber Campaign Targets Central Asian Governments
Researchers uncover shared infrastructure linking multiple malware families in a long-running operation.
1Campaign infrastructure uncovered
Hunt.io researchers have mapped a network of command-and-control servers linking three malware families (SpiceRAT, NodeEdgeRAT, and NomadRAT) through shared certificates, domains, and hosting patterns. The infrastructure predates Bitdefender's August 2026 SilkParasite report, revealing a longer-running operation than previously known. Five active SpiceRAT servers were identified across multiple hosting providers and countries in March 2026, connected through identical TLS certificates and cloned webpages.
2Chinese-linked certificate evidence
A key finding is a TLS certificate impersonating Uzbekistan's state railway authority, issued by TLC - a certificate authority funded by CAICT, a Chinese state research institute. While the issuer alone isn't conclusive (3,000 servers host TLC certificates), the combination of a China-based CA issuing domain-validated certs spoofing Central Asian state entities suggests deliberate procurement. This certificate connected multiple servers across the campaign's infrastructure.
3RTX Corporation page as fingerprint
Researchers discovered a full copy of RTX Corporation's homepage being reused across multiple servers in the cluster. While containing no malicious code, this byte-for-byte identical page served as a high-precision detection signature. A HuntSQL query on the page's SHA-256 hash revealed 13 hosts, with five matching known SpiceRAT signatures and eight more linked through shared technical characteristics.
4Government impersonation patterns
The campaign's domains systematically spoof specific Central Asian government entities and state enterprises. Examples include domains mimicking Turkmenistan's Ministry of Foreign Affairs, Tajikistan's Tojiktelecom, and even the Kyrgyz president's residence. This targeting aligns with Bitdefender's earlier findings but provides concrete infrastructure links to these entities through domain registration patterns and certificate reuse.
5Operational parallels
The infrastructure shows similarities with known China-nexus threat actors like FamousSparrow and IndigoZebra, particularly in targeting patterns and domain naming conventions. While not conclusive for attribution, these parallels reveal consistent operational styles in China-linked cyber activity targeting Central Asia. The campaign's timeline extends back to mid-2022 through passive DNS analysis, indicating a long-running operation.
6Shared tooling evidence
The research uncovered shared parent domains and certificates connecting malware families previously considered distinct. For example, help.hoster-kg.com and evo.hoster-kg.com were linked through domain registration despite being attributed to different RATs. Similarly, kg.tdtu.org shares a parent domain with a known NomadRAT C2 server, suggesting shared support functions across the operation.
7Defensive recommendations
The report provides specific indicators for organizations in Central Asia's government, telecom, and critical infrastructure sectors to detect potential compromise. Key recommendations include checking for the RTX page hash, railway-spoofing certificate, and monitoring high-numbered RDP-over-TLS ports on relevant ASNs. The infrastructure analysis enables defenders to identify nodes that traditional sample-based analysis might miss.
8Strategic implications
The findings reveal a sophisticated, long-running cyber espionage campaign with consistent targeting of Central Asian government entities. The shared infrastructure across multiple malware families suggests possible coordination or resource sharing among threat actors. For security teams, the research demonstrates the value of network-level analysis to complement traditional malware research in uncovering broader operations.
Original article: Security Affairs — SilkParasite Cyber Campaign Targets Central Asian Governments