New Backdoors Let Hackers Keylog, Steal Passwords and Control Government Computers

Government networks in Central Asia have been hit by two custom-built backdoors that give intruders deep control over infected computers.

Known as OctLurk and SilkLurk, the tools can record keystrokes, collect browser passwords, steal email, and run commands remotely.

The campaign has been active since January 2025 and has affected organizations in Afghanistan, Kazakhstan, Kyrgyzstan, Tajikistan, Uzbekistan, and Syria.

Victims include ministries, law enforcement agencies, healthcare bodies, research institutions, logistics organizations, schools, and urban planning offices.

Securelist said in a report shared with Cyber Security News (CSN) that both malware families are used by the same likely Chinese-speaking threat actor, although the operation has not been tied to a known group.

The intrusion shows how a determined espionage team can turn one compromised machine into a doorway to a wider government network.

The attackers used stolen administrator credentials, scheduled tasks, malicious services, and additional tools to maintain access and gather sensitive information.

New Backdoors Let Hackers Keylog, Steal Passwords

OctLurk is built to stay hidden while giving its operators a wide range of options after a system is breached.

Its loader is customized for each victim and uses machine-specific information to unlock the final payload, which makes automated analysis and detection harder.

Once active, OctLurk can pull additional plugins directly into memory instead of relying on many visible files.

Those plugins let attackers browse and copy files, open command shells, capture screenshots, read clipboard contents, scan networks, and simulate keyboard and mouse actions.

The operators also used a keylogger and a browser password recovery utility to capture credentials from compromised systems.

The keylogger saved keystrokes and clipboard data locally, while the browser tool targeted stored sign-in data from Chrome and Firefox.

This combination creates a serious risk for public-sector organizations because a single employee account can lead to more valuable systems.

The attackers also used a password-dumping tool against domain controllers, seeking credentials that could help them move across the network.

Their use of scheduled tasks is especially concerning because the tasks ran with high-level system privileges and were named to look ordinary.

Similar scheduled task persistence techniques are widely used to help attackers keep access after a restart or an initial cleanup effort.

OctLurk also supported a proxy component that could relay traffic through a compromised device.

That capability can help operators reach internal systems that are not directly exposed to the internet, reducing the chance that their activity is immediately noticed.

SilkLurk Expands Espionage

SilkLurk uses a different loading method, hiding behind legitimate-looking Windows programs and malicious DLL files.

It verifies the host program, decrypts its payload using the victim computer name, injects it into memory, and creates a service to remain active.

After gaining access, the attackers used SilkLurk to search shared network drives for confidential documents.

They then compressed collected files with archiving utilities, a common step before data is moved out of an organization.

The campaign also deployed PlugX, a long-running remote-access trojan associated with several Chinese-linked operations.

Readers tracking related activity can review Chinese APT PlugX campaigns, which illustrate how modular backdoors can support espionage through file theft, screenshots, keystroke capture, and remote commands.

Government defenders should review administrator account use, investigate unfamiliar services and scheduled tasks, and monitor for unusual access to domain controllers, browser credential stores, and shared drives.

Teams should also check endpoint and network telemetry for the indicators below, rotate exposed credentials, and isolate affected hosts during incident response.

The campaign underlines the value of watching behavior rather than depending only on file-based detection.

Organizations that regularly review task creation, service installation, remote logons, and suspicious internal scanning have a better chance of finding an intrusion before it becomes a broader compromise.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
Domain	dns.ssentialserv[.]xyz	LurkProxy command-and-control domain
IP address	154.196.162[.]76	LurkProxy command-and-control server
Domain	dns.multitoconference[.]com	OctLurk command-and-control domain
Domain	gycudore.kozow[.]com	PlugX command-and-control domain
Domain	ctyuhjerf.kozow[.]com	SilkLurk command-and-control domain
IP address	64.7.198[.]130	PlugX command-and-control address
MD5	6ecf84fb18f6747ed08d7598364d853a	OctLurk deployment batch script
MD5	082d49ef9f14e6811d68c7e0e82e5069	OctLurk loader DLL
MD5	b874123a80fc4f40e06872b9cb54ebc6	LurkProxy deployment batch script
MD5	45cf5916fab4272a1313c26e67aa9220	Victim-fingerprinting batch script
MD5	4e6d5c4770d5a822d7fcce6a74f7ad73	Victim-fingerprinting batch script
MD5	32a5985543433a4f60da2fafd873b927	Credential-dumping executable
MD5	2a571f6cee42a17d873f4c942649813f	Keylogger executable
MD5	37dc84e4bcad92fa28f1e7778d088283	Browser password decryptor
MD5	5e26df131ff0a679a0a2699b723b46e3	Remote-control agent deployment script
MD5	cf903e4a1629aa0582fd0363b5786676	Fscan network-scanning tool
MD5	3c9a1ba8e0c7475706adc6376e9d7b7c	PlugX dropper
MD5	62944e26b36b1dcace429ae26ba66164	PlugX sideloaded executable
MD5	ef59aad625eebda8650aec5820d6ce69	PlugX loader DLL
MD5	be4731c09734da2e8eb6814a9c82f266	SilkLurk loader DLL
MD5	7c2f64461bb519c6cbf1fc687675514c	OctLurk loader DLL
MD5	f4578e869a735cfad691f927bae3e638	OctLurk loader DLL
MD5	2f18472866f38c1e1c2c5c14b9a6ab56	SilkLurk loader DLL
Filename	oleasapi.dll	OctLurk loader DLL
Filename	msbasesysdc.dll	LurkProxy loader DLL
Filename	Adobe.exe	Credential-dumping utility
Filename	OneDrive.dat	SilkLurk payload file
Filename	nvml.dll	SilkLurk loader DLL
Filename	vulkan-1.dll	SilkLurk loader DLL
Filename	RtkSmbusLoc.dll	SilkLurk loader DLL
Filename	RtkNGUI64Loc.dll	SilkLurk loader DLL
Filename	C.dll	PlugX loader DLL
Filename	C.dll.res	PlugX payload file
Filename	GoogleUpDate	Malicious scheduled task name
Filename	AnyDesk	Keylogger scheduled task name
Filename	NgcCIntSvc	OctLurk malicious service
Filename	Cusrxsrv	LurkProxy malicious service
Filename	RmSs	SilkLurk persistence service

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Building Resilience Against Phishing & Malware and Analyze it in a safe environment – Power your SOC with ANY.RUN