Cyber threats / Threat actors

SilkParasite

CN Suspected sponsor: China
0
APAC targets
0
Techniques
0
Incidents
0
News · 30d
Profile

SilkParasite is an activity cluster tracked by Bitdefender across Central Asia, primarily targeting government and telecommunications entities in Kyrgyzstan, Uzbekistan and Kazakhstan. Bitdefender assesses a China-nexus with medium confidence and states explicitly that it does not believe the evidence supports attribution to a named group, so this is recorded as an activity cluster rather than as an established actor. Observed tooling spans seven implant families: five named by Bitdefender (DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, NodeEdgeRAT) plus SpiceRAT, previously reported by Cisco Talos in connection with SneakyChef, and BloodAlchemy, a lineage descended from ShadowPad and Deed RAT. The operators favour DLL sideloading and cloud services as command-and-control channels, and register domains impersonating local hosting providers.

Related profiles: SneakyChef

Profiles whose description names this actor, that this description names, or that share one of its names. The sources mention them together; they are not necessarily the same group.

ATT&CK techniques
MITRE ATT&CK has no technique mapping for this actor.
Incidents attributed
  • No incident in the register is attributed to this actor.
In the news
  • No Asia-Pacific article names this actor yet.
Targets
No victim countries in the sources.
Relevance to the EU
EU relevance: Low
No EU member state among its known victims and no overlap with EU projects
No EU cooperation projects recorded in its target countries.
References
Sources: MISP