CikaBika Bot uses fake documents to infect Windows systems, then abuses Discord and Ngrok to execute commands, spy on victims, and steal files.

Darktrace researchers have documented a new campaign distributing a remote access trojan called CikaBika Bot, written in Rust and controlled entirely through Discord. The infection chain starts with a disk image that looks like a business proposal, and ends with an attacker who can run arbitrary commands, steal files, and capture your screen, all through messages in a chat platform.

“The infection chain begins with a disk image and a malicious Windows shortcut. A Nim loader extracts the final payload and attempts to plant it in Microsoft Edge’s installation directory using a PowerShell UAC bypass.” reads the analysis published by Darktrace. “Once running, the RAT collects host information, registers the device with Discord, and accepts commands through a dedicated channel.”

The attackers use a disk image named Proposition_Projet.img as a lure; it contains two files, a PDF that appears to be a legitimate French-language document about writing summaries, and a Windows shortcut disguised as a Word document.

Open the shortcut and a hidden PowerShell process starts running in the background while the PDF displays on screen to keep the victim occupied.

The shortcut starts PowerShell, which reads the fake PDF as raw data. It uses a value hidden inside the file as a key to decrypt and extract a program, then saves it to a temporary folder. This program is a loader written in Nim, a programming language that is less common in malware than C. Attackers may use Nim because security tools are less familiar with it. The loader contains two more components: a Rust DLL and a PowerShell script.

The PowerShell script then tries to copy the DLL into Microsoft Edge’s installation folder and name it dbghelp.dll. This is the name of a legitimate debugging library that Edge normally loads. To access the protected folder without triggering a User Account Control (UAC) prompt, the script changes a Windows registry setting and misuses computerdefaults.exe to bypass the security check. Darktrace describes the technique as DLL search-order hijacking.

“The attacker appears to be exploiting this dependency through DLL search-order hijacking. However, it does not export every function in Edge’s delay-import table, meaning its compatibility with the host is incomplete.” the analysis continues.”The observed code establishes the intended sideloading route, rather than proving that Edge successfully loaded the planted DLL.”

However, the researchers note that the malicious DLL does not provide all the functions Edge expects, so this technique may not work on every system.

Assuming the implant lands and runs, it immediately registers the infected machine with Discord, creating a dedicated channel for that specific device. It then collects system information, runs tasklist and ipconfig, takes a screenshot, and sends everything back to the operator through that channel. The attacker gets a full picture of the machine within the first few seconds of infection.

The command set from there covers most of what an attacker would need. Remote shell access, process listing and termination, file upload and download, and surveillance functions including screenshot capture, camera access, and screen streaming.

“Once installed, CikaBika Bot uses Discord as its C2 platform, allowing the attacker to manage compromised devices, execute commands, and retrieve files without maintaining dedicated C2 infrastructure.” the cybersecurity firm states. “The observed use of Discord channels for individual victims, alongside additional data exfiltration through ngrok, shows how legitimate services can be repurposed to support malicious operations.”

Discord is a legitimate service used by millions of people and organizations every day. Traffic to Discord doesn’t look unusual on most networks, it’s not blocked by default, and standard endpoint security tools aren’t designed to treat Discord messages as potential command-and-control traffic. The attacker never has to spin up a dedicated server, register a suspicious domain, or deal with infrastructure that can get taken down. They just need a Discord account.

One drawback for attackers is that Discord can detect abuse and shut down the accounts and servers they use. However, creating new accounts is easy and costs very little. The attackers also use Ngrok to transfer files instead of sending large amounts of data through Discord. This reduces their reliance on Discord and limits the impact if the platform shuts down their accounts.

“CikaBika Bot demonstrates how attackers continue to rely on social engineering techniques to deliver malware.” concludes the report. “Although the initial distribution method has not been confirmed, the use of a disk image containing a shortcut disguised as a Word document, alongside a legitimate-looking PDF, suggests the campaign was designed for phishing.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, malware)

Netskope tracks four XWorm versions in the wild, 46 plugins, and new tools for location, audio and live browser control, with detections up fourfold.

Netskope Threat Labs has been following XWorm since September 2024, and its latest report shows the malware has changed a lot. Over the past year the team identified four distinct versions running at the same time in the wild. Detection volume is still high, with 1,236 events across more than 100 customer organizations in the third quarter of 2026, four times the number from the same quarter in 2025.

The leak fueled the surge. In June 2025, a cracked version of the XWorm builder was released publicly. In August, the source code for a modified version, 6.4, also leaked. These leaks gave XWorm more exposure and helped drive its growth.

Netskope’s data shows how long the impact lasted. Detections more than quadrupled between the third and fourth quarters of 2025. In the first quarter of 2026, they reached seven times the original level and stayed there through the second quarter. Detections fell to 1,236 in the third quarter of 2026, but September alone accounted for 601, matching the monthly average during the peak in the first half of the year.

The victims skew toward money. Financial services make up about 35% of affected customers, and activity is concentrated in India, Brazil, Italy, Panama and the United States.

“The public leak of the V6.4 builder in mid-2025 drove this initial surge, keeping activity consistently above pre-leak baselines ever since.” reads Netskope’s analysis. “The financial services sector accounts for approximately 35% of affected customers, with activity concentrated in India, Brazil, Italy, Panama, and the United States.”

Since Netskope published its report on version 6.0 in July 2025, four new versions of the malware have been discovered: V6.4, V6.5 (“XWorm Reborn”), V7.2, and V7.4. Three of these versions were released after the malware generator tool became publicly available. The number of known plugin features has also increased from 35 to 46. This includes new modules, such as SteamTokenRecovery, Rootkit, ResetSurvival, and Cmstp-Bypass, as well as several plugins that were previously removed in V6.0 but have now been brought back.

Each new version includes small but significant updates:

• V6.4 includes file details that link it to celestialproject.org.
• V6.5 updates its branding link to c3lestial.fun, adds five new plugins, and introduces a built-in license check for the tool itself.
• V7.2 adds stronger code protection to hide its activity, uses six different tricks to avoid running in virtual analysis environments, and disguises its file details as the software Voicemod.
• V7.4 introduces a new file delivery system (dropper), uses a technique to bypass Windows security monitoring, switches to a new communication channel for commands, and reinstates license checks.

The surveillance side is where it gets uncomfortable. Netskope says XWorm has moved from an infostealer to a full surveillance platform. Three plugins matter most: Maps, Microphone and HBrowser, and webcam capture is also available on demand.

HBrowser changes how account theft works. Starting with version 6, it gives the operator a live view of the victim’s running browser, relays the operator’s mouse, keyboard and paste actions into it, and streams the screen back. The commands travel over XWorm’s usual encrypted channel and run on the victim’s machine.

This creates a full remote browser session for the attacker. Because every logged-in tab remains open, the attacker can access accounts directly without needing to steal passwords or bypass multi-factor authentication (MFA). Netskope notes that this plugin grants full account access without ever extracting login credentials.

The location-tracking feature bypasses the standard Windows permission prompt. It first modifies a Windows system setting to suppress consent requests, then attempts to fetch precise GPS coordinates within 15 seconds to send to the attacker. If GPS is unavailable, it falls back to IP-based location tracking. Because the modified setting remains in place, future location requests continue to bypass user permission.

“XWorm continues to evolve and has now added surveillance capabilities. It can track geolocation and record the victim’s audio without requesting the victim’s permission.” continues the report. “The HBrowser plugin gives operators direct control of the victim’s live browser session, granting access to accounts without needing to exfiltrate credentials and making MFA irrelevant.”

Microphone does what the name says. It captures audio from any device on the machine, with the operator choosing which one, and streams it back in half-second chunks that are compressed, encoded and encrypted, so audio reaches the operator with about half a second of delay. The microphone stays active for as long as the operator keeps the session open, and both Maps and Microphone run without privilege escalation or a visible prompt.

Netskope expects more of the same. Since the builder and source code were leaked, it expects continued upgrades and use of the toolkit. Its indicators of compromise are on the team’s GitHub, and its protection flags the samples as Gen:Variant.Application.Lazy and Trojan.Generic.

The key lesson for security teams is that multi-factor authentication (MFA) cannot protect accounts once an attacker has already gained access to an active browser session. This vulnerability applies to any account currently logged in on an infected computer.

The HBrowser plugin clearly demonstrates this risk: from the attacker’s perspective, it provides a complete, live remote browser session with full access to open accounts.

“Since its builder and source code were leaked, we expect continued upgrades and use of this toolkit. Netskope Threat Labs will continue to monitor XWorm.” NetSkope concludes.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

Threat actors abused fake ChatGPT Custom GPTs and ClickFix to deliver a multi-stage RAT.

ChatGPT’s Custom GPT feature is the latest legitimate surface being turned into a delivery mechanism, and Huntress researchers caught it in action across at least 40 incidents. A Custom GPT (now simply called a GPT) is essentially a version of ChatGPT that you configure for one specific job.

Think of it as creating your own specialist assistant rather than starting from a blank ChatGPT conversation.

The setup is simple and effective. Someone searches Google for “ChatGPT,” clicks a sponsored result, and lands on a Custom GPT page at the real chatgpt.com domain. The page is titled “Plus 5.6,” designed to look like a new ChatGPT model. Interact with it in any way and it responds with a single message: the service is experiencing limited availability on its primary domain, and to continue, you need to visit a “backup domain.” That backup domain is a Google Sites page serving a fake Cloudflare CAPTCHA, and from there it’s a standard ClickFix attack: copy a command, paste it into Windows Run, press Enter. The command is a PowerShell one-liner that downloads and installs a malicious MSI.

“The campaign uses a ClickFix lure to trick victims into running PowerShell, which downloads a malicious MSI and begins a multi-stage, obfuscated infection chain.” reads the report published by Huntress. “The payload establishes resilient access through dual persistence and DLL sideloading, using a Canon-signed executable (and, in a later wave, a Stardock-signed one) to load malicious code. Huntress investigated at least 40 related incidents, including two confirmed Custom GPT-driven infections.”

Huntress reported the first Custom GPT to OpenAI, and OpenAI took it down on September 25. Just two days later, another GPT linked to the same campaign was already online.

The attack uses eight stages, with each one hiding the next. The PowerShell command uses a decimal IP address instead of the usual dotted format, which Windows accepts but some URL filters may not recognize. It then downloads a 27,000-character script made up of negative numbers. The script decodes itself in memory, so the readable code never gets saved to disk.

It then quietly installs an MSI called ISOSimple.msi. The file pretends to be an “Advanced Printer Configuration Reader” from a publisher called Softplicity and hides itself from the normal list of installed programs. Microsoft Defender detected and quarantined the MSI in at least one case. By that point, however, the malware had already created a Run key and a scheduled task, allowing the attack to continue.

The technical heart of this campaign is DLL sideloading through a legitimately signed Canon application, COTFileReadApp.exe, from Canon’s CaptureOnTouch product.

“COTFileReadApp.exe is a real Canon binary from CaptureOnTouch, and its signature checks out. Its companion, COTFileReadApp.dll, calls into Canon’s logging library, ceiinfolog.dll.” continues the report. “When a program asks for a DLL by name, Windows checks the program’s own folder first, so whatever sits next to the EXE with the right name gets loaded. That’s DLL sideloading, and it’s the door the attackers used.”

The application loads its logging library from its own folder, which is standard Windows behavior. Attackers replaced that logging library with a modified version that still exports the functions Canon expects but also imports one extra DLL that Canon never asked for, rdCore.dll, where the malicious code actually lives. Canon’s binary is genuine and its signature checks out. The logging library looks almost identical to the real one because it mostly is. The only thing that changed is one line in its import table.

From there the chain keeps going. rdCore.dll extracts an encrypted loader from a WAV audio file bundled with the installer. The file has a valid audio header and begins with real audio data, but halfway through the actual sound data stops and encrypted payload bytes start. The WAV header claims the file is about 700KB when it’s actually over 1MB. A rolling XOR cipher decodes the loader directly into memory so nothing readable ever hits the disk, and then the loader goes looking for monitor.raw, a custom encrypted archive that contains 315 folders, 806 files, a persistence script, and the final remote access trojan.

That custom archive is worth pausing on. Somebody built an entire homemade encrypted filesystem just to package and deliver a RAT past automated tooling. Each file in the archive has its own encryption key, the index itself is scrambled with per-entry salts, and none of it is readable without a master key embedded in the loader. Huntress researchers decoded the whole thing by reading the math and reimplementing the decryption, which is a considerably less convenient way to spend your time than the attackers had building it.

The RAT at the end of the chain gives attackers a lot of control. It can run remote desktop sessions, capture the screen, camera and audio, access data from 17 different browsers, search files across the system, and download or run additional payloads in nine formats. It finds its command server through DNS-over-HTTPS using Cloudflare, Google and Quad9, hiding its DNS requests inside normal HTTPS traffic and keeping them out of local DNS logs.

Soon after the Canon-based version appeared, attackers released another version using a binary signed by Stardock. The loader, persistence script and RAT were exactly the same. Only the signed application, file names and hiding technique changed. This time, the loader was hidden inside a genuine Microsoft NuGet package instead of a WAV file.

The delivery script also changed. It now removes the Mark-of-the-Web tag from the MSI before launching it, which gets rid of the warning that the file came from the internet and allows the malware to run without triggering a SmartScreen prompt.

This isn’t the first time AI platforms have been used this way. Huntress has previously tracked attackers abusing shared ChatGPT and Grok conversations to push macOS malware, a sponsored Google result leading to a malicious Claude conversation that deployed a stealer, and a fake Claude Artifact impersonating a Claude Desktop download page. These campaigns typically stay live for hours or days before the provider removes them, which is long enough to hit dozens of people.

The detection advice from Huntress is worth taking seriously: look for PowerShell launching msiexec on a GUID-named MSI in the temp folder, Canon or Stardock binaries running from a fake product folder under AppData, and a Run key or scheduled task that comes back after you delete it. But the bigger point is the last one in the report: ‘Detections tied to Canon or Stardock names will miss the next swap.’

The behaviors carry over between versions. The signed binary changes. The names change. The actual attack sequence, PowerShell to msiexec to signed-app sideload to persistence to RAT, has stayed consistent across every variant Huntress analyzed, and that’s where detection needs to live.

“Overall, threat actors continue to turn trusted platforms into convincing entry points for social engineering, whether via ChatGPT’s Custom GPT feature or through Google Sites for hosting a ClickFix attack.” concludes the report. “This campaign tricked dozens of victims to run PowerShell and install a malicious payload.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, ChatGPT Custom GPTs)

Blackpoint uncovers ChainScript, a Node.js RAT that queries a Polygon smart contract to find and rotate its command server.

Blackpoint’s Adversary Pursuit Group was chasing a ClickFix campaign spreading an unknown RAT namend ChainScript. The malicious code is a previously undocumented Node.js remote access trojan that hides its command server on a public blockchain.

The infection starts with a familiar ClickFix trick. The victim gets talked into pasting and running a command that fires up msiexec.exe, which pulls down an installer dressed up as Spotify. Inside that installer sits a full Node.js runtime and a JavaScript agent ready to launch.

Once it runs, the installer scatters its pieces across folders with Microsoft-sounding names, blending into the rest of the system. A hidden PowerShell script kicks off a VBScript file, which then starts the bundled Node.js runtime. None of this needs admin rights, since the installer is set to run entirely within the user’s own profile.

The main part of the malware is contained in a single file: app\src\index.js. This file does almost everything. It handles the configuration, collects information about the infected computer, finds the command server, manages WebSocket connections, runs commands, updates the malware and cleans things up. The other components, including the PowerShell and VBScript files and the helper binaries, are mainly there to launch this file and make sure it stays running.

The interesting part is how ChainScript finds its command server. Instead of having a fixed server address that security teams could block, the malware asks a smart contract on the Polygon blockchain for the address. It sends a request to the contract, gets an address back and then connects to it.

This technique is known as EtherHiding. It is not a new idea, but ChainScript uses it effectively. The malware contacts the smart contract and receives a string starting with ws:// or wss://. It then saves that address for five minutes and uses it to connect to the attackers’ server.

If the attackers want to move to a different server, they only need to update the smart contract. They don’t have to change or rein

“For C2 discovery, ChainScript uses an EtherHiding style technique that treats a Polygon smart contract as the authoritative resolver for the active WebSocket panel. The analyzed build targeted contract 0xf9099d0d747368cce8C10226CC9AF2bFD4DDbCF4 on chain ID 137 and supplied function selector 0x4ab7874e in an eth_call request.” read the report published by Blackpoint’. “ChainScript ABI decodes the returned string, verifies that it begins with ws:// or wss://, caches the result for five minutes, and uses it in place of the panel value stored directly in the configuration” 

Blackpoint watched this play out live. During analysis, the contract first pointed the agent to one server, which stayed active for about 18 minutes while exchanging heartbeat traffic. Twelve minutes after the connection reset, the same contract handed back a completely different address, proving the backend can rotate without anyone ever updating the malware itself.

One detail, flagged by an independent researcher on GitHub, is almost funny given the stakes. The smart contract behind one sample was deployed just 23 seconds before the installer was compiled. That’s too tight a window for a human to have done it by hand. Contract creation is almost certainly baked into the same build pipeline that produces the malware.

Once connected, ChainScript doesn’t just sit and listen. It hands operators a full interactive shell, file read and write access, desktop screenshots, the ability to push additional payloads, a scan for installed crypto wallets, arbitrary JavaScript execution, and a self-update function. That’s complete control of the machine, with a cleanup command built in for when the job is done.

On the wallet front, the malware stops at reconnaissance. It lists which wallets are installed and where, but there’s no dedicated code for stealing seed phrases or private keys. Given the shell access it already has, that distinction matters less than it should.

Blackpoint found the same agent wearing different outfits. Alongside the Spotify build, other versions turned up posing as Zoom Workplace and Microsoft Teams, each with its own package name but the same code underneath. The costume changes. The thing wearing it doesn’t.

“The malware was uncovered while investigating ClickFix activity that led to the execution of a malicious Windows Installer disguised as Spotify software.” reads the report. “Once executed, the MSI deployed its own Node.js runtime and launched a JavaScript agent through hidden PowerShell and VBScript stages. The running agent then established persistence in the user profile.”

This isn’t happening in isolation either. Research into other malware families, Tsundere and EtherRAT among them, has already documented the same recipe: Node.js, a malicious installer, and blockchain-based server discovery. The pattern keeps showing up, and that’s the uncomfortable part. Splitting the malware from its infrastructure is turning into a design choice, not a one-off trick.

For defenders, this changes where they should focus their attention. Tracking domains and IP addresses is still useful, but those indicators may not stay valid for long if the attackers can simply change the blockchain contract. Looking at the chain of processes can be much more effective: msiexec starting wscript, wscript launching the VBScript, and node.exe running app\src\index.js. These relationships are much harder for attackers to change than the server address they happen to be using this week.

Defenders should also watch for less obvious signs of activity. For example, a node.exe process suddenly making outbound blockchain RPC requests and then opening a WebSocket connection should attract attention.

Neither of these behaviors is necessarily malicious on its own. But when they happen together, they become a much stronger indicator of compromise than simply looking for a specific domain or IP address on a blocklist.

“ChainScript combines familiar RAT functionality with a flexible C2 design built around blockchain based infrastructure discovery.” concludes the report.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

Hunt.io links SpiceRAT, NodeEdgeRAT and NomadRAT to a four-year SilkParasite campaign targeting governments and critical sectors in Central Asia.

Hunt.io and researcher Guy Yasur have traced a tight cluster of SpiceRAT command‑and‑control servers that predate and extend Bitdefender’s August 2026 SilkParasite report. The work doesn’t dissect malware samples; it maps the network side of the operation with enough precision to tie three of SilkParasite’s seven RAT families (SpiceRAT, NodeEdgeRAT, and NomadRAT) through shared certificates, domains, and hosting patterns.

“Shared parent domains and an identical TLS certificate connect this infrastructure to hosts Bitdefender attributed to SpiceRAT, NodeEdgeRAT, and NomadRAT, three of the seven malware families documented in the SilkParasite report.” reads the report published by Hunt.io.

“The certificate imitating the Uzbekistan railway entity was issued by TLC, a certificate authority wholly funded by CAICT, a Chinese state research institute under the Ministry of Industry and Information Technology.”

In March 2026, Hunt.io identified five SpiceRAT command-and-control servers hosted by different providers and in different countries. Researchers linked them through several common elements, including the same hostnames, TLS certificates, and a cloned webpage used as the default page.

Instead of focusing only on the malware itself, this approach looks at the infrastructure behind it. Shared certificates or identical webpage hashes can provide strong and practical indicators that defenders can use to identify other servers linked to the campaign.

One certificate in particular stands out. It impersonates Uzbekistan’s state railway authority (azure.uzrailwaystax[.]com) and was issued by TLC DV TLS CA, a CA wholly funded by CAICT, a Chinese state research institute under the Ministry of Industry and Information Technology. The issuer alone isn’t an indicator—nearly 3,000 servers host TLC certificates—but a domain‑validated cert spoofing a Central Asian state entity from a China‑based CA does suggest a deliberate procurement channel.

Requests to ns2.asiainfo.it[.]com on 188.190.29[.]126 returned a full copy of RTX Corporation’s homepage, complete with navigation, subsidiary links, and a stock ticker. The page contained no malicious code and wasn’t unique to that server, but its reuse across the cluster made it a powerful fingerprint.

“Hunt.io’s C2 Infrastructure module tracks servers matching detection signatures for known malware families, including SpiceRAT. In mid-March 2026, we observed a cluster of five active SpiceRAT servers: 46.30.191[.]230, 188.190.29[.]126, 193.29.59[.]159, 31.58.220[.]250, and 171.22.16[.]187. The five were active together in mid-March 2026, across multiple hosting providers and countries.” continues the report.

A HuntSQL query on the page’s SHA‑256 hash returned exactly 13 hosts; three were already in Bitdefender’s SpiceRAT list, two more matched Hunt.io’s SpiceRAT signature, and the remaining eight extended the footprint through shared nginx versions and the same static page.

Why RTX? The report offers two plausible explanations: the page rendered cleanly and was grabbed as a convenient template, or it reflects shared tooling where the clone functions as a default deployment asset. Either way, for defenders it’s a low‑noise, high‑precision signature: byte‑for‑byte identical wherever it lands.

Bitdefender’s SilkParasite report treated several RAT families as distinct, but Hunt.io’s network view shows they share parent domains and certificates. For example, help.hoster‑kg[.]com (on 193.29.58[.]192) presented the same railway‑spoofing certificate, while Bitdefender attributed evo.hoster‑kg[.]com to NodeEdgeRAT; the two are linked through shared registration of hoster‑kg[.]com, not a shared server. Similarly, kg.tdtu[.]org shares a parent domain with mineconom.tdtu[.]org, a NomadRAT C2 indicator in the SilkParasite report.

This doesn’t prove a single operator, but it does show a support function or toolset shared across the campaign. From a detection standpoint, it means pivoting on domains, certificates, and hosting profiles can surface nodes that sample‑based analysis would miss.

The cluster’s domains don’t just look governmental; they spoof specific ministries and state enterprises. Examples include help.galkynysh[.]net (Galkynysh gas field, Turkmenistan), tmgaz‑server[.]com (Türkmengaz), tm‑mfa[.]com (Turkmenistan’s Ministry of Foreign Affairs), and tojiktelecomtj[.]com (Tojiktelecom, Tajikistan). Additional domains impersonate Turkmen energy (sanly.oilgas‑tm[.]com), Uzbek administration (azure.adm‑devon[.]com), and even the Kyrgyz president’s residence (data.yntymak‑ordo[.]com).

Bitdefender’s targeting came from lures and infection telemetry; Hunt.io’s infrastructure analysis names the same sectors with concrete entities. Passive DNS and subdomain enumeration push the timeline back to mid‑2022, suggesting this isn’t a new campaign with a fresh brand—it’s a longer‑running operation now labeled SilkParasite.

SilkParasite overlaps with FamousSparrow, a suspected China‑nexus actor previously seen targeting hotels, governments, and international organizations. The infrastructure also mirrors IndigoZebra (Speccom), documented by Check Point in 2021 as targeting Central Asian ministries with similar domain patterns (mail, service, help) and overlapping naming conventions. These parallels don’t settle attribution, but they do reinforce a consistent operational style across China‑nexus activity in Central Asia.

If you’re responsible for OT/ICS, telecom, or government networks in the region, start by checking your edge and DMZ for the indicators below, especially the RTX page hash and the railway‑spoofing certificate. Monitor for high‑numbered RDP‑over‑TLS ports (64350, 64330, 65535, 65111) on the ASNs most prevalent in the cluster, and watch for domains impersonating local hosting providers or state entities. The original Hunt.io post includes the full IoC tables and HuntSQL queries; linking to it is essential for precise awareness and for teams that want to reproduce the pivots.

“The targeting picture that emerges from this infrastructure, named ministries and state enterprises across five Central Asian countries dating back to at least mid-2022 suggests SilkParasite is a more recent label for an operation with much longer and wider footprint.” concludes the report. “Organizations in the affected sectors and regions can make use of the above indicators and observations to assess their own exposure.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, SilkParasite)