Chinese‑Speaking Threat Actors Target Central Asian Governments

A new wave of cyber attacks against government entities in Central Asia has been linked to a Chinese‑speaking threat actor believed behind the OctLurk and SilkLurk malware families. The campaign began in January 2025 and targets agencies in Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and Syria ¹.

OctLurk operates by sideloading a custom DLL into legitimate system processes—a technique designed to bypass traditional endpoint detection tools. This method mirrors tactics used by APT41 in Southeast Asia since 2019, suggesting shared infrastructure or personnel given similar obfuscation methods such as XOR encryption with hardcoded keys that can be cracked quickly by modern automated analysis tools.

SilkLurk appears to be a variant on the APT36 framework, which has been tied to attacks against Southeast Asia since 2018. Its developers recompile payloads with unique identifiers each time for evasion—an approach often seen when state sponsors repurpose compromised infrastructure.

Target selection suggests an escalation beyond typical cyber espionage towards potentially disruptive objectives aimed at destabilizing regional governments. Analysts note this pattern aligns with other documented state‑actor campaigns over prior years.

From a privacy perspective, these operations threaten not only data integrity but also the confidentiality of sensitive policy discussions and citizen information stored within affected agencies. The use of sophisticated injection techniques means standard security measures may fail unless organizations adopt more granular process monitoring and employ code integrity checks.

Experts warn that because Central Asian nations tend to have less mature cyber defense mechanisms compared to Western counterparts, attackers are likely to continue focusing on this region until defensive capabilities improve. They advise heightened vigilance around anomalous DLL loading events and recommend regular audits of system binaries for unauthorized modifications.

In practice, the immediate impact is twofold: first, operational disruption as legitimate processes become hijacked; second, potential exfiltration or sabotage of critical government data. While no direct evidence yet shows large-scale data theft, the very presence of OctLurk and SilkLurk in multiple jurisdictions signals a coordinated effort that could undermine trust in digital governance across Central Asia.

The campaign underscores how modern threat actors blend advanced development tools—Go for loaders and Rust for backdoors—to create resilient malware families that can adapt quickly to new defenses. As governments in the region respond, they must invest in both technical hardening and staff training to recognize subtle sideloading attempts.

Overall, the emergence of OctLurk and SilkLurk marks a significant escalation in state-sponsored cyber activity targeting Central Asian public institutions, raising urgent concerns about privacy, stability, and national security.