In short: On July 30, 2026 Kaspersky GReAT published a technical breakdown of a cyber-espionage campaign targeting government and state-affiliated organizations across Central Asia and Syria. The attackers deployed two new backdoors — OctLurk and SilkLurk — that run exclusively in memory, leave no disk traces, and activate only on the specific device they were built for. The campaign has been active since at least January 2025.
What are OctLurk and SilkLurk
OctLurk and SilkLurk are two previously unknown modular backdoors discovered by Kaspersky GReAT during incident investigations in Kazakhstan, Kyrgyzstan, Tajikistan, Uzbekistan, Afghanistan, and Syria. Victims include government ministries, foreign affairs departments, law enforcement agencies, research institutes, healthcare facilities, and logistics companies.
The defining feature of both tools is a unique hardware-based activation mechanism. OctLurk derives its decryption key from the serial number of the C: drive, while SilkLurk computes a 32-bit hash from the target computer name. Each sample is custom-built for a single victim — a copy placed on any other machine simply will not run. This hardware-fingerprint approach makes the malware invisible to conventional signature-based antivirus engines. Our security blog covers layered defense strategies in more detail.
How the attacks worked
After gaining initial access, attackers used DLL side-loading through legitimately signed NVIDIA and Realtek components: malicious libraries masqueraded as AnyDesk.exe or Adobe.exe files, while the encrypted payload was stored as a file named Welcome01.wav. The backdoors injected into memory and connected to a command-and-control server over port 443 — blending seamlessly into normal HTTPS traffic.
Persistence was established via Windows Scheduled Tasks and malicious services. Supporting tools included LurkProxy (a reverse-proxy tunneling utility), the PlugX remote access trojan, and on Linux systems the TrustFall backdoor (also known as MystRodX/SilentRaid). Once entrenched, attackers ran network reconnaissance with Fscan, harvested credentials and documents, archived files with WinRAR and 7-Zip, and exfiltrated data to external servers.
Who is behind the campaign
Kaspersky GReAT attributes the attacks to an unidentified Chinese-speaking APT group with "medium confidence" — researchers have not yet linked the campaign to any previously known threat actor. Infrastructure overlaps with prior operations against Kazakhstan's critical infrastructure. Kazakhstan's State Technical Service helped connect several separate incidents into a single picture, a rare example of effective local monitoring contributing to a global investigation.
What this means for data security
The OctLurk and SilkLurk story illustrates a clear shift: conventional security tools alone are no longer sufficient. Malware that lives only in memory and never appears on disk in decrypted form is invisible to most standard antivirus scanners — and this is now routine APT operating procedure, not an edge case.
For organizations, this means monitoring traffic at the network level, not just the filesystem. Anomalous outbound connections to command-and-control servers, suspicious port-443 traffic from unexpected processes — these signals can detect threats that antivirus misses. Traffic encryption and network segmentation raise the cost of an attack significantly for the adversary.
For individual users the core takeaway is different: understanding that attacks of this class operate silently for months is important context for building sound digital hygiene habits. Network-level protection — including encrypting your traffic with LiMP VPN — does not stop a sophisticated backdoor already installed on a device, but it materially complicates the initial network reconnaissance and data exfiltration over open channels that both OctLurk and SilkLurk operators relied on.