SilkParasite-Linked Malware Infrastructure Traced Back Four Years Across Central Asia

SilkParasite is a cyberespionage operation aimed at government, energy and telecommunications interests in Central Asia. New infrastructure analysis indicates that the activity behind the campaign may be older and broader than its recent name suggests.

The operation has used spear-phishing emails carrying convincing government-themed documents and trusted Windows programs to plant remote-access malware. These tools can give operators a foothold in a victim network, allowing operators to collect information and issue commands.

Hunt.io analysts, working with researcher Guy Yasur, identified a connected group of SpiceRAT command-and-control servers active from late 2025 to August 2026.

Hunt.io said in a report shared with Cyber Security News (CSN) that the infrastructure links to SilkParasite, which used seven remote-access toolsets against Central Asian governments.

The discovery matters because it joins seemingly separate systems through repeated technical traces rather than one malware sample. Public-facing infrastructure can reveal how a long-running spying operation builds and reuses its systems.

SilkParasite-Linked Malware Infrastructure

The shared parent domains, a matching digital certificate and a copied web page connect SpiceRAT servers to systems attributed to NodeEdgeRAT and NomadRAT. This does not prove one operator controls every host, but suggests a common operation or shared support function.

Analysts first flagged SpiceRAT-related servers in late 2025 using earlier detection logic. In March 2026, five servers appeared within days across different providers and countries. Shared hostnames and certificates were stronger links, because a detection only shows what ran on one machine.

One recurring decoy was a complete but outdated copy of an RTX Corporation homepage. The page contained no malicious code, credential form or delivery mechanism.

Yet its identical content hash appeared on 13 servers and gave researchers a reliable way to map infrastructure that otherwise looked unrelated, much like patterns seen in remote access malware operations.

Certificate reuse strengthened the link. A certificate made to resemble an Uzbek railway entity appeared on eight hosts, including systems carrying the cloned page.

The certificate was issued by TLC, a certificate authority operated by an organization funded by China’s state-linked communications research institute, although the issuer alone is not an indicator of malicious activity.

Passive DNS records extended the timeline further. Related subdomains were seen as early as mid-2022, suggesting the infrastructure has existed for at least four years. This suggests SilkParasite may be a newer label for a longer-running effort.

Central Asian Targets and Defense

The infrastructure used names resembling government agencies, state energy operators and telecom organizations across Turkmenistan, Tajikistan, Uzbekistan, Kyrgyzstan and Kazakhstan.

These names should be treated as apparent impersonation targets, not evidence that the named organizations were breached. Hunt.io said it notified affected organizations and relevant national CERTs before publication.

The targeting overlaps with China-linked SilkParasite espionage campaign, which used document lures and a mix of established and newly documented remote-access tools.

That report assessed a China-nexus link with medium confidence. The newer network evidence offers useful context, but it does not independently establish attribution.

Researchers also noted naming similarities with infrastructure previously tied to suspected China-nexus activity known as IndigoZebra, as well as overlaps cited with FamousSparrow.

Such patterns can result from shared tools, service providers or conventions, so they are leads for investigation rather than proof of a direct operational relationship.

For defenders, the practical lesson is to search network logs, DNS records and certificate data for the indicators published below, especially in the affected sectors.

Teams should review unusual remote desktop exposure and investigate lookalike domains promptly. Recent cases involving malware abusing developer tunnels show why outbound connections and remote-management paths deserve continuous scrutiny.

Organizations should also strengthen phishing defenses, verify unexpected government-themed documents through separate channels, restrict unnecessary remote access and monitor for repeated web-page or certificate artifacts.

Correlating those signals can expose staging and command systems that may not be caught by endpoint detections alone, giving incident responders a broader picture of potential exposure. This includes systems with privileged access to critical services.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC