SilkParasite — China-Nexus Cyberespionage Across Central Asia

Seven-family RAT toolset (5 previously undocumented) targeting government ministries in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, Kazakhstan and Georgia · active since approx. October 2025

Threat

SilkParasite

Severity

ACTIVE APT

Type

Cyberespionage / Nation-State APT

Access

Spear-phishing → Office macro → DLL sideload

Version

v0.1 (Draft) · 2026-08-26

Author

HuntPack

Confidence

Medium (China-nexus attribution)

Executive Summary

SilkParasite is a cyberespionage operation, assessed by Bitdefender Labs at medium confidence as China-nexus, that has run against government bodies across Central Asia for roughly a year. The attacker's objective is durable, low-noise access to the economic-policy arms of Central Asian governments — Bitdefender frames this as China filling the intelligence vacuum left by Russia's declining regional influence since 2022. Initial access runs through spear-phishing email carrying malicious Office documents, frequently packaged in password-protected RAR archives to slip email-gateway scanning; opening the document drops a DLL-sideloading chain that launches one of seven distinct RAT families, five of which (DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, NodeEdgeRAT) had never been documented before this research. The two previously known families — SpiceRAT (Cisco Talos / SneakyChef) and BloodAlchemy (ShadowPad / Deed RAT lineage, tying this cluster to Bitdefender's earlier FamousSparrow research) — show meaningfully evolved tradecraft versus prior public reporting.

The toolset is small, modular, and professionally engineered — plugin architectures, per-build key rotation, a maintained packaging pipeline — and carries specific, named traces of AI-assisted (not AI-generated) development: leftover Go test scaffolding and a sequential placeholder AES key (0123456789abcdef) in GoginRAT, and a literal change_this_key placeholder in NodeEdgeRAT. DriveSilkRAT is the operational backbone (~65 observed infections, most in Asia) and is notable for tasking itself entirely through a shared Google Drive folder rather than a dedicated C2 server — a "living off trusted services" (LOTS) channel that blends into allowlisted, low-scrutiny cloud traffic.

The single most durable, cross-family detection surface is DLL sideloading: a legitimately signed application (Calibre, ABBYY FineReader, Quick Heal, Windows Defender's own service host, Mp3tag) running from an unexpected location and loading an unfamiliar same-directory DLL. That pairing, plus the named scheduled-task personas and the enumerated C2 infrastructure below, form the backbone of the CQL coverage in this pack.

Defender priority: hunt the confirmed host/DLL sideload pairs and the two named scheduled tasks (SysEdgeUpdateTaskMachineCore, fl_bridge) first — both are high-confidence, low-FP, and cover four of the seven families in a single pass. Treat any hit as a full-host triage, not an isolated alert: this operator's design goal is minimal footprint per victim, so one confirmed artifact usually means the rest of the chain is already present.

Source Review & Web Hunter Notes

Tier	Source	Key Finding	Carry Forward
1	Bitdefender Business Insights — SilkParasite report	Primary technical source: all seven RAT family write-ups, sideload host/DLL pairs, AI-assisted-dev tells, attribution reasoning, hunt recommendations	Yes
1	Bitdefender corporate blog — mirror of the same report	Identical technical content to the Business Insights URL; fetched and saved independently per pipeline instruction	Yes (duplicate content, cited alongside the mirror)
1	Bitdefender malware-ioc GitHub repo — SilkParasite indicator CSV	Full atomic IOC set: domains, IPs, file hashes, mutexes, scheduled-task names, email addresses, cryptographic keys, linked from both blog posts	Yes — this is the provenance source for every atomic IOC in this pack
2	The Record (Recorded Future News) — Jonathan Greig, Aug 20 2026	Independent corroboration of scope, victim countries, AI-assisted-development framing, and DriveSilkRAT's Google Drive C2; adds that a Georgia-targeting lure was recovered from a public malware-sharing platform	Partial — narrative corroboration only, no new atomic IOCs
3	Dark Reading — "SilkParasite Threatens Central Asian Orgs With Flurry of RATs"	Direct fetch blocked (Cloudflare bot-check interstitial via curl, HTTP 403 via automated fetch) — no verbatim text obtained. Corroborating detail included via search-index summary only; see source snapshot 03 for the full access note.	No — consulted, access-restricted; not used for any technical or IOC claim in this pack

Research notes: No fetched page contained text addressed to an AI agent, embedded instructions, or any attempt to redirect this research session — all four primary/secondary sources returned ordinary editorial or vendor-research content. The Dark Reading URL could not be retrieved as text by either fetch method attempted; it is retained in References (Section 18) as "consulted, access-restricted" per the source-review table above, and the parent pipeline should treat it as non-authoritative for any specific claim.

Hunt Brief & Attack Chain

Hunt hypotheses (ordered by fidelity)

#	Hypothesis	MITRE	Telemetry	Expected FP	Confidence
H1	A signed carrier binary (Calibre / FineReader / Quick Heal / Defender service host / Mp3tag) has a SilkParasite-named DLL written beside it	T1574.002	PeFileWritten	Low	High
H2	One of those same carrier binaries is executing from a non-standard directory (AppData/ProgramData/Temp)	T1574.002, T1036.005	ProcessRollup2	Medium	Medium
H3	A process is spawned by `WmiPrvSE.exe` without an interactive WMIC/PowerShell session (DriveSilkRAT's WMI-based command-exec plugin)	T1047	ProcessRollup2	Medium	Medium
H4	A binary named `GoogleDriveClient.exe` matching a known-bad hash executes or is written to disk	T1102.002, T1036.005	ProcessRollup2 / PeFileWritten	Low	High
H5	A scheduled task named `SysEdgeUpdateTaskMachineCore` is registered (NodeEdgeRAT persistence)	T1053.005, T1036.005	ScheduledTaskRegistered	Low	High
H6	A scheduled task named `fl_bridge` is registered (BloodAlchemy persistence)	T1053.005	ScheduledTaskRegistered	Low	High
H7	A process executes from `C:\ProgramData\USOShared\Logs\` (SpiceRAT relaunch path)	T1053.005, T1036.005	ProcessRollup2	Low	High
H8	DNS/network activity to any of the eleven enumerated SilkParasite C2 domains or seventeen C2 IPs	T1071.001, T1102.002	DnsRequest, NetworkConnectIP4	Low–Medium	High
H9	An Office application (WINWORD/EXCEL/POWERPNT) spawns a script or shell interpreter (macro-drop pattern from the password-protected-archive lure)	T1204.002, T1059.005	ProcessRollup2	Medium	Medium

Attack chain

Step	Stage	Telemetry	Hunt Angle
1	Spear-phishing delivery of a password-protected RAR containing a malicious Office document, password supplied in the email body	Email gateway logs	Attachment/password-in-body heuristic (native hunt, Section 7)
2	Document opened; macro checks for Kaspersky's `avp.exe`, then drops a signed-application sideloading chain	ProcessRollup2, PeFileWritten	H9 (macro-spawned interpreter); H1/H2 (dropped DLL)
3	Signed carrier binary loads the malicious sibling DLL; first-stage payload executes	PeFileWritten, ProcessRollup2	H1, H2 — the durable cross-family signal
4	DriveSilkRAT establishes tasking via a shared Google Drive folder; polls for commands, uploads results	NetworkConnectIP4, DnsRequest (Google infra)	H4 (GoogleDriveClient.exe artifact); behavioral baseline of Drive traffic without user activity
5	Additional RAT families (SpiceRAT, CookiETagRAT, BloodAlchemy, NomadRAT, GoginRAT, NodeEdgeRAT) incrementally deployed via DriveSilkRAT or their own sideload chains	ProcessRollup2, PeFileWritten, ScheduledTaskRegistered	H1, H5, H6, H7
6	Persistence established (scheduled tasks named to blend into routine maintenance)	ScheduledTaskRegistered	H5, H6, H7
7	Command execution via WMI (breaks parent-child chain), in-memory plugin loading, reconnaissance (whoami/ipconfig/dir/systeminfo equivalents)	ProcessRollup2	H3
8	Ongoing C2 over HTTP, HTTP Cookie/ETag headers, DNS, TCP, or the Google Drive channel; results exfiltrated over the same channel	DnsRequest, NetworkConnectIP4	H8

Steps 4 (in-memory plugin loading itself, as opposed to the C2 channel that carries it) and the credential/clipboard/keylog collection performed by BloodAlchemy's embedded plugins have no reliable file-write or process-tree artifact distinct from what H3/H8 already cover — see Section 15 for these as explicit coverage gaps rather than silently dropped hypotheses.

Consolidated IOC Table

Representative atomic indicators from Bitdefender's published IOC set (malware-ioc GitHub repo, 241 rows total). File hashes below are one representative sample per family plus the HelpLoader sideload DLL and one phishing-document hash; the complete hash set (~180 file indicators) is linked in Section 10. Mutexes, scheduled-task names, persistence paths, and cryptographic keys are listed as behavioral indicators in Section 10 rather than here, since they are not blockable atomic IOCs in the conventional sense.

Type	Value	Confidence	Action	Context	Expiry
domain	evo[.]hoster-kg[.]com	High	detect	NodeEdgeRAT C2 (impersonates real Kyrgyz host hoster.kg)	2027-02-26
ipv4	193[.]29[.]56[.]216	High	detect	NodeEdgeRAT C2 IP	2027-02-26
domain	uzrailway[.]devon-uz[.]com	High	detect	BloodAlchemy C2 (port 443)	2027-02-26
domain	it[.]hpsupporter[.]com	High	detect	NomadRAT C2	2027-02-26
ipv4	195[.]88[.]191[.]234	High	detect	NomadRAT C2 IP	2027-02-26
domain	mineconom[.]tdtu[.]org	High	detect	NomadRAT C2	2027-02-26
ipv4	2[.]58[.]15[.]14	High	detect	NomadRAT C2 IP	2027-02-26
domain	info[.]ktnet[.]org	High	detect	GoginRAT C2	2027-02-26
ipv4	193[.]29[.]56[.]205	High	detect	GoginRAT C2 IP	2027-02-26
domain	manager[.]skycom[.]support	Medium	detect	SpiceRAT C2	2027-02-26
domain	infrastructure[.]minings[.]blog	Medium	detect	SpiceRAT C2	2027-02-26
domain	contact[.]onenote-service[.]com	Medium	detect	SpiceRAT C2	2027-02-26
domain	www[.]mubrn[.]com	Medium	detect	SpiceRAT C2	2027-02-26
domain	www[.]tmtransport[.]org	Medium	detect	SpiceRAT C2	2027-02-26
domain	kg[.]cwisuz[.]com	Medium	detect	SpiceRAT C2	2027-02-26
ipv4	2[.]58[.]15[.]164	Medium	detect	SpiceRAT C2 IP	2027-02-26
ipv4	45[.]153[.]125[.]200	Medium	detect	SpiceRAT C2 IP	2027-02-26
ipv4	45[.]153[.]125[.]20	Medium	detect	SpiceRAT C2 IP	2027-02-26
ipv4	45[.]153[.]127[.]226	Medium	detect	SpiceRAT C2 IP	2027-02-26
ipv4	188[.]214[.]39[.]243	Medium	detect	SpiceRAT C2 IP	2027-02-26
ipv4	194[.]14[.]217[.]146	Medium	detect	SpiceRAT C2 IP	2027-02-26
ipv4	91[.]132[.]94[.]58	Medium	detect	SpiceRAT C2 IP	2027-02-26
ipv4	91[.]132[.]94[.]36	Medium	detect	SpiceRAT C2 IP	2027-02-26
ipv4	194[.]68[.]44[.]133	Medium	detect	SpiceRAT C2 IP	2027-02-26
ipv4	193[.]29[.]59[.]242	Medium	detect	SpiceRAT C2 IP	2027-02-26
ipv4	45[.]153[.]125[.]117	Low	enrich	Associated with the threat actor, unattributed to a specific family	2026-09-26
ipv4	185[.]26[.]236[.]16	Low	enrich	Associated with the threat actor, unattributed to a specific family	2026-09-26
ipv4	217[.]9[.]250[.]86	Low	enrich	Associated with the threat actor, unattributed to a specific family	2026-09-26
email	acc-427@serveracc.iam.gserviceaccount.com	High	enrich	DriveSilkRAT-linked Google service account	2026-09-26
email	raiyanabegum2@gmail.com	Low	enrich	Associated with the threat actor	2026-09-26
email	ehdteoitFBMotz0psorz9ShFu9Mxe3@proton.me	Low	enrich	Associated with the threat actor	2026-09-26
email	sifanag132@aixind.com	Low	enrich	Associated with the threat actor	2026-09-26
sha256	47bb9e8f110f364d1c09d43f4df980c5d2ca87ca2b6e1c8f98abdf8cb3e69e0e	High	detect	DriveSilkRAT GoogleDriveClient.exe (one of eleven observed builds)	2027-02-26
sha256	a1784169dd84cf886ed75219a32ffde24e93bca7650dafd6a51a9062f52f7f35	High	detect	HelpLoader calibre-launcher.dll — SpiceRAT sideload payload	2027-02-26
sha256	aab828ceb2db599e5fd2f9a742645dcf17eeac3b3e322d71fe068ea74dfc7fba	High	detect	BloodAlchemy dsp_ippv2_x64.dll sideload payload	2027-02-26
sha256	9cdab6c300f7fc6044d78836dbafa13b48b5d746dcbf2e99d2aa8244847a9242	High	detect	CookiETagRAT tak_deco_lib.dll sideload payload	2027-02-26
sha256	db4c75da33810493a14d9fdc7807367d9fa70f8a815951335771f32016254d46	High	detect	NomadRAT scansts.dll sideload payload	2027-02-26
sha256	6c440a5fc99eb09b1dc0b8c79f2a7448f8407e1d8b78a949a333511f0bb13b25	High	detect	GoginRAT mscorsvc.dll sideload payload	2027-02-26
sha256	d16507495078941d106e4de52606bf573548e2b2125ee35d21b4b639b1001219	High	detect	NodeEdgeRAT update.js	2027-02-26
sha256	ff22419b8ec3994542f23c78dc21a7c5abcb634008d99b7fa1fff1bb23102a00	High	detect	SpiceRAT phishing Office document (one of nineteen observed samples)	2027-02-26

Affected Surface & Telemetry Matrix

Surface	Required Telemetry	Priority	Gap Risk
Windows endpoint — process execution	ProcessRollup2 / SyntheticProcessRollup2	Critical	Low — standard Falcon sensor telemetry
Windows endpoint — file writes	PeFileWritten	Critical	Low — required for the H1 sideload-DLL hunt, the highest-fidelity query in this pack
Windows endpoint — persistence	ScheduledTaskRegistered	Critical	Low, assuming default sensor policy; confirm the sensor's scheduled-task collection is not disabled by an over-aggressive noise-reduction policy
Network — DNS resolution	DnsRequest	High	Low on managed endpoints; higher for BYOD/roaming hosts using DoH/DoT that bypass local resolver visibility
Network — outbound connections	NetworkConnectIP4	High	Low
Email gateway	Attachment/archive inspection logs, sender headers	High — this is the initial-access chokepoint	Medium — depends entirely on gateway vendor; password-protected archives defeat most default sandbox detonation
Google Workspace / Drive audit log	Admin console API/Drive activity log, service-account activity	Medium	High — most organizations do not baseline Drive API traffic from unfamiliar service accounts; this is the LOTS channel's blind spot by design
In-memory / reflective execution (plugin loading, credential and clipboard collection)	No reliable Falcon file or process artifact distinct from the sideload/C2 signals already covered	Medium	High — see Section 15 coverage gaps; requires behavioral/ML-based memory-scan detection rather than a CQL query

ATT&CK Mapping

Tactic	Technique	Name	Observed Behavior
Initial Access	T1566.001	Phishing: Spearphishing Attachment	Malicious Office documents delivered by email, regionally tailored per ministry
Initial Access	T1027	Obfuscated Files or Information	Lure documents packaged in password-protected RAR archives, password supplied in the email body, to evade gateway/sandbox scanning
Execution	T1204.002	User Execution: Malicious File	Victim opens the Office document, triggering the macro
Execution	T1059.005	Command and Scripting Interpreter: Visual Basic	VBA macro checks for Kaspersky's `avp.exe`, then drops the sideload chain
Defense Evasion / Persistence	T1574.002	Hijack Execution Flow: DLL Side-Loading	Six confirmed signed-host/malicious-DLL pairs across five RAT families — the primary delivery mechanism campaign-wide
Defense Evasion	T1036.005	Masquerading: Match Legitimate Name or Location	Scheduled-task and file naming designed to read as routine (SysEdgeUpdateTaskMachineCore, fl_bridge, GoogleDriveClient.exe, "Kovid Goyal EBook Task")
Defense Evasion	T1620	Reflective Code Loading	In-memory .NET/PE plugin loading across nearly every family's plugin architecture
Defense Evasion	T1027.007	Dynamic API Resolution	SpiceRAT resolves Windows APIs by hash rather than static imports in its newer variants
Defense Evasion	T1562.001	Impair Defenses: Disable or Modify Tools	BloodAlchemy's HalosGate syscall evasion with hardware breakpoints and vectored exception handlers, sidestepping userland EDR hooks
Discovery	T1518.001	Security Software Discovery	Delivery macro checks for Kaspersky's `avp.exe` process before executing
Discovery	T1082 / T1016 / T1057 / T1083	System Information / Network Config / Process / File Discovery	DriveSilkRAT's twelve .NET plugins cover process listing, system/network enumeration, and file management
Persistence	T1053.005	Scheduled Task	Named tasks per family: SysEdgeUpdateTaskMachineCore, fl_bridge, Kovid Goyal EBook Task variants, MicrosoftEdgeUpdateTaskMachineUA{...}, plus SpiceRAT's 2-minute relaunch from USOShared\Logs
Execution	T1047	Windows Management Instrumentation	DriveSilkRAT's command-execution plugin runs processes via WMI instead of spawning cmd.exe, breaking the parent-child chain EDR watches
Command and Control	T1102.002	Web Service: Bidirectional Communication	DriveSilkRAT tasking and results routed entirely through a shared Google Drive folder (LOTS)
Command and Control	T1071.001	Application Layer Protocol: Web Protocols	HTTP/HTTPS C2 for SpiceRAT, NomadRAT, GoginRAT, NodeEdgeRAT; CookiETagRAT hides tasking in HTTP Cookie/ETag response headers
Command and Control	T1573	Encrypted Channel	Per-host-derived ChaCha20 keys (CookiETagRAT, SpiceRAT), RC4 (DriveSilkRAT), AES (GoginRAT) protecting C2 traffic
Command and Control	T1132	Data Encoding	NomadRAT layers MessagePack + base64 encoding for registration data and nested command payloads
Collection	T1115	Clipboard Data	BloodAlchemy's embedded cliplogger plugin
Collection	T1056.001	Input Capture: Keylogging	BloodAlchemy's embedded keylogger plugin
Privilege Escalation / Access	T1134	Access Token Manipulation	BloodAlchemy's impapi plugin performs user-session impersonation for process execution under another user's context
Exfiltration	T1041	Exfiltration Over C2 Channel	Results uploaded back over the same channel used for tasking (Google Drive, HTTP, Cookie/ETag headers)

Native Audit-Log Hunts

Checks that do not require Falcon telemetry — useful where EDR coverage is thin, or as a second, independent signal source.

Windows Event Log — Scheduled Task Created (Event ID 4698)

Filter TaskName for the named personas this campaign uses: SysEdgeUpdateTaskMachineCore, fl_bridge, any Kovid Goyal EBook Task-S-1-5-21-* variant, and MicrosoftEdgeUpdateTaskMachineUA{73444F9E-3124-440E-972P-9239645R6BB2} (note the malformed GUID segment — a real Microsoft-issued task GUID would not contain the letters P/R inside what should be a pure hex segment, which is itself a usable discriminator). Requires Task Scheduler auditing enabled via auditpol /set /subcategory:"Other Object Access Events" /success:enable.

Email gateway — password-protected archive from external sender

Search transport/gateway logs for inbound mail where an attached RAR/ZIP is password-protected (gateway cannot open it for inspection) and the message body contains a short alphanumeric token near words like "password," "пароль," or the local-language equivalent, sent to a government or ministry-domain recipient from an external or newly-registered sender domain. This is the initial-access chokepoint and the highest-leverage place to stop the chain before any endpoint telemetry fires.

Google Workspace / Drive Admin audit log

Review the Drive activity and API access logs for service accounts matching the acc-###@serveracc.iam.gserviceaccount.com naming pattern, or any service account with sustained file create/read/list activity against a shared folder with no corresponding interactive human sign-in nearby in time. DriveSilkRAT's entire tasking channel lives here and is invisible to endpoint EDR by design — this is the one place in the chain where the LOTS technique itself, not just its symptoms, is directly observable.

Sysmon Event ID 7 (Image Loaded) — where Sysmon runs alongside Falcon

Hash-match image loads into the six carrier processes (ebook-edit.exe, FineReader.exe, emlproui.exe, Mp3tag.exe, MpDefenderCoreService.exe) against the sideload DLL hash set in Section 4/10. Sysmon's ImageLoaded field captures the full path, which is a useful secondary confirmation of the unusual-directory signal in CQL query Q2.

Documented TTP with no reliable native telemetry

The delivery macro's check for a running avp.exe process (security-software discovery, T1518.001) happens inside the Office macro's own process-enumeration API calls and leaves no standard Windows Event Log or Sysmon artifact distinguishable from any other macro that enumerates processes. Record this as a known TTP for analyst awareness during document forensics rather than as a hunting query.

CrowdStrike LogScale CQL Hunt Queries

Falcon cloud (drives "Open in Falcon"): Pick your tenant's cloud first — every "Open in Falcon" button below uses this selection.

Q1 · Confirmed sideload DLL written to disk (six host/DLL pairs)

CONF HIGHFP LOWCOST LOW

Looks for: a PE file write matching one of the six confirmed SilkParasite sideload DLL basenames, regardless of directory. FP: a legitimate reinstall/update of the vendor's own signed installer producing an identically-named DLL — rare, and worth a one-time hash check against the vendor's real release before excluding.

// HUNT: SilkParasite sideload payload DLL written to disk (confirmed basenames)
// MITRE: T1574.002
// CONF: high  FP: low  COST: low
// REQUIRES: PeFileWritten
// FALSE POSITIVES: a signed vendor reinstall/update producing an identically named DLL from that vendor's own installer
#event_simpleName=PeFileWritten
| TargetFileName=/(calibre-launcher|dsp_ippv2_x64|scansts|tak_deco_lib|mscorsvc|easyhook64)\.dll$/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, TargetFileName, SHA256HashData])
| sort(@timestamp, order=desc)

Q2 · Sideload carrier binary running from a non-standard directory

CONF MEDIUMFP MEDIUMCOST LOW

Looks for: any of the five confirmed carrier binaries executing from AppData, ProgramData, Temp, a public user profile, or Downloads — none of these are legitimate install locations for these applications. FP: portable-app deployments or an IT-approved packaging pilot placing the real vendor binary outside Program Files.

// HUNT: SilkParasite sideload carrier binary running from a non-standard directory
// MITRE: T1574.002, T1036.005
// CONF: medium  FP: medium  COST: low
// REQUIRES: ProcessRollup2
// FALSE POSITIVES: portable-app deployments or IT-approved packaging pilots placing Calibre/FineReader/Quick Heal/Mp3tag outside Program Files
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(ebook-edit|FineReader|emlproui|Mp3tag|MpDefenderCoreService)\.exe$/i
| ImageFileName=/\\(AppData|ProgramData|Temp|Public|Downloads)\\/i
| table([@timestamp, ComputerName, UserName, ImageFileName, FileName, ParentBaseFileName, CommandLine])
| sort(@timestamp, order=desc)
// TUNING: exclude known-good portable-app deployment paths approved by IT, e.g. | ImageFileName != /\\ApprovedPortableApps\\/i

Q3 · Process spawned via WMI without an interactive WMIC/PowerShell session

CONF MEDIUMFP MEDIUMCOST MEDIUM

Looks for: DriveSilkRAT's command-execution plugin spawns children through WMI rather than cmd.exe, so the child's parent shows as WmiPrvSE.exe directly. FP: legitimate RMM/patch tooling (SCCM, Ninja, PDQ, Datto) also launches actions via WMI — baseline your RMM's known child processes first.

// HUNT: Process execution via WMI with no interactive parent (DriveSilkRAT command-exec plugin pattern)
// MITRE: T1047
// CONF: medium  FP: medium  COST: medium
// REQUIRES: ProcessRollup2
// FALSE POSITIVES: legitimate RMM/patch-management tooling that also launches actions via WMI
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^WmiPrvSE\.exe$/i
| FileName=/^(cmd|powershell|whoami|ipconfig|net|systeminfo)\.exe$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc)
// TUNING: exclude known RMM agent hashes/paths (SHA256HashData in your approved-RMM allowlist) and hosts tagged as SCCM/Ninja managed endpoints

Q4 · DriveSilkRAT loader artifact (GoogleDriveClient.exe, known-bad hash)

CONF HIGHFP LOWCOST LOW

Looks for: DriveSilkRAT's own loader, executed or written under a name that mimics the Google Drive desktop client, matched against four of the eleven known-bad hashes. FP: none expected — these are campaign-specific hashes.

// HUNT: DriveSilkRAT loader artifact (GoogleDriveClient.exe, known-bad hash set)
// MITRE: T1102.002, T1036.005
// CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 or PeFileWritten
// FALSE POSITIVES: none expected -- these are campaign-specific SHA256 hashes, not the real Google Drive desktop client
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2|PeFileWritten/
| FileName=/^GoogleDriveClient\.exe$/i
| in(SHA256HashData, values=["47bb9e8f110f364d1c09d43f4df980c5d2ca87ca2b6e1c8f98abdf8cb3e69e0e", "f2848e1f8d44b2d29d49f57721a9ffbdc128e882158a6c84ba4cf1c524824df6", "7906f921049423de61def95798b7f556bd1f8a47326522788aebd271243a342d", "16317e41f35cea5089ffe6af9153199dc4951dd9c1e2d333443b3b931ce99a9e"])
| table([@timestamp, ComputerName, UserName, ImageFileName, SHA256HashData])
| sort(@timestamp, order=desc)
// See Section 10 for the complete eleven-hash GoogleDriveClient.exe set

Q5 · NodeEdgeRAT persistence — SysEdgeUpdateTaskMachineCore scheduled task

CONF HIGHFP LOWCOST LOW

Looks for: the exact task name NodeEdgeRAT registers to look like a Microsoft Edge update job. FP: none expected — the real Edge updater uses a GUID-suffixed MicrosoftEdgeUpdateTaskMachine{...} naming convention, not this string.

// HUNT: NodeEdgeRAT persistence -- SysEdgeUpdateTaskMachineCore scheduled task
// MITRE: T1053.005, T1036.005
// CONF: high  FP: low  COST: low
// REQUIRES: ScheduledTaskRegistered
// FALSE POSITIVES: none expected -- this task name is not a genuine Microsoft Edge update mechanism
#event_simpleName=ScheduledTaskRegistered
| TaskName=/^SysEdgeUpdateTaskMachineCore$/i
| table([@timestamp, ComputerName, UserName, TaskName, TaskExecutable, CommandLine])
| sort(@timestamp, order=desc)

Q6 · BloodAlchemy persistence — fl_bridge scheduled task

CONF HIGHFP LOWCOST LOW

Looks for: the exact task name BloodAlchemy registers for persistence. FP: none expected in the vast majority of environments.

// HUNT: BloodAlchemy persistence -- fl_bridge scheduled task
// MITRE: T1053.005
// CONF: high  FP: low  COST: low
// REQUIRES: ScheduledTaskRegistered
// FALSE POSITIVES: none expected -- confirm task executable is not a documented, IT-approved integration if one happens to share this name
#event_simpleName=ScheduledTaskRegistered
| TaskName=/^fl_bridge$/i
| table([@timestamp, ComputerName, UserName, TaskName, TaskExecutable, CommandLine])
| sort(@timestamp, order=desc)

Q7 · SpiceRAT persistence — relaunch from ProgramData\USOShared\Logs

CONF HIGHFP LOWCOST LOW

Looks for: any process executing from SpiceRAT's copy-and-relaunch directory. FP: none expected — USOShared\Logs is a real Windows Update Orchestrator folder but not a legitimate execution path for arbitrary EXEs.

// HUNT: SpiceRAT persistence -- relaunch from C:\ProgramData\USOShared\Logs every 2 minutes
// MITRE: T1053.005, T1036.005
// CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2, ScheduledTaskRegistered
// FALSE POSITIVES: none expected -- this folder is not a legitimate execution path for arbitrary EXEs
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ImageFileName=/\\ProgramData\\USOShared\\Logs\\/i
| table([@timestamp, ComputerName, UserName, ImageFileName, FileName, CommandLine, ParentBaseFileName])
| sort(@timestamp, order=desc)

Q8 · DNS resolution of known SilkParasite C2 domains (11 domains, all families)

CONF HIGHFP LOWCOST LOW

Looks for: any DNS query for the eleven confirmed C2 domains spanning six of the seven RAT families. FP: none expected — exact-match domain list.

// HUNT: DNS resolution of known SilkParasite C2 domains
// MITRE: T1071.001, T1102.002
// CONF: high  FP: low  COST: low
// REQUIRES: DnsRequest
// FALSE POSITIVES: none expected -- exact-match domain list from the vendor IOC set
#event_simpleName=DnsRequest
| in(DomainName, values=["evo.hoster-kg.com","uzrailway.devon-uz.com","it.hpsupporter.com","mineconom.tdtu.org","info.ktnet.org","manager.skycom.support","infrastructure.minings.blog","contact.onenote-service.com","www.mubrn.com","www.tmtransport.org","kg.cwisuz.com"])
| table([@timestamp, ComputerName, UserName, DomainName])
| sort(@timestamp, order=desc)

Q9 · Direct connection to known SilkParasite C2 IP infrastructure

CONF HIGHFP MEDIUMCOST LOW

Looks for: direct network connections to any of the seventeen enumerated C2/actor-associated IPs. FP: shared-hosting IP reuse — treat IP-only hits as review-tier and reserve auto-block for the domain matches in Q8.

// HUNT: Direct network connection to known SilkParasite C2 IP infrastructure
// MITRE: T1071.001
// CONF: high  FP: medium  COST: low
// REQUIRES: NetworkConnectIP4
// FALSE POSITIVES: shared hosting-provider IPs can be reassigned to unrelated tenants over time
#event_simpleName=NetworkConnectIP4
| in(RemoteAddressIP4, values=["193.29.56.216","193.29.56.205","195.88.191.234","2.58.15.14","2.58.15.164","45.153.125.200","45.153.125.20","45.153.125.117","45.153.127.226","188.214.39.243","194.14.217.146","91.132.94.58","91.132.94.36","194.68.44.133","185.26.236.16","217.9.250.86","193.29.59.242"])
| table([@timestamp, ComputerName, UserName, RemoteAddressIP4, RemotePort, ContextBaseFileName])
| sort(@timestamp, order=desc)
// TUNING: cross-check any hit's RemoteAddressIP4 against current WHOIS/passive-DNS before high-severity action -- shared hosting IPs churn tenants; treat IP-only hits as review-tier and reserve auto-block for the Q8 domain matches

Q10 · Office application spawns a script/shell interpreter (macro-drop pattern)

CONF MEDIUMFP MEDIUMCOST LOW

Looks for: the initial-access moment — an Office app spawning a scripting or living-off-the-land binary after the password-protected-archive lure is opened. FP: legitimate mail-merge, VBA-driven automation, or approved Office add-ins that shell out — common in finance/reporting teams.

// HUNT: Office application spawning a script/shell interpreter (macro-drop pattern)
// MITRE: T1204.002, T1059.005
// CONF: medium  FP: medium  COST: low
// REQUIRES: ProcessRollup2
// FALSE POSITIVES: legitimate mail-merge, VBA-driven automation, or approved Office add-ins that shell out
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^(WINWORD|EXCEL|POWERPNT)\.exe$/i
| FileName=/^(cmd|powershell|wscript|cscript|mshta|regsvr32|rundll32)\.exe$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc)
// TUNING: exclude signed, IT-approved Office add-ins/macros by CommandLine hash or a documented allowlist of automation scripts

CrowdStrike Custom IOA Recommendations

IOA Name	Pattern Basis	Exclusions	Deployment Path
IOA-SilkParasite-Sideload-DLL	Q1 — confirmed DLL basenames written beside a signed carrier binary	Legit reinstall/update of the same vendor app producing an identically named DLL from that vendor's own signed installer	Detect for 2 weeks fleet-wide, promote to Block after zero benign hits
IOA-SilkParasite-NodeEdge-Task	Q5 — SysEdgeUpdateTaskMachineCore	None identified	Block immediately (high confidence, exact-match task name)
IOA-SilkParasite-BloodAlchemy-Task	Q6 — fl_bridge	A documented internal "fl_bridge" integration, if one exists in your environment	Detect first, promote to Block after one review cycle
IOA-SilkParasite-SpiceRAT-Persist-Dir	Q7 — execution from ProgramData\USOShared\Logs	None identified — folder is not a legitimate execution path	Block immediately
IOA-SilkParasite-C2-Domains	Q8 — DNS to the 11-domain C2 set	None — exact match	Block immediately; also push to DNS sinkhole / secure web gateway blocklist
IOA-SilkParasite-C2-IPs	Q9 — direct connection to the 17-IP C2 set	Revalidate periodically for hosting-provider IP reuse	Detect, review before promoting to Block due to shared-hosting churn risk

Alerting & triage — top three promotion candidates

Alert: DETECT — SilkParasite Sideload DLL Written (Q1). Subject: [HIGH] Detection: SilkParasite — sideload payload DLL written to disk. Triage: (1) confirm ContextBaseFileName is one of the six carrier binaries; (2) pull SHA256HashData and check against Section 4/10; (3) check the carrier binary's own install path — Program Files is expected, anywhere else is suspicious; (4) pivot to ProcessRollup2 for the same host in the following 5 minutes to see whether the carrier binary executed; (5) if it did, isolate the host and begin the containment runbook (Section 14); (6) check for any of the Q5/Q6/Q7 scheduled-task artifacts on the same host; (7) check DNS/network logs for the Q8/Q9 C2 set; (8) escalate to IR lead if this is a government/ministry-tagged asset.

Alert: DETECT — SilkParasite NodeEdgeRAT Persistence (Q5). Subject: [HIGH] Detection: SilkParasite — SysEdgeUpdateTaskMachineCore scheduled task registered. Triage: (1) pull the task's TaskExecutable and command line; (2) confirm the executing binary is the bundled Node.js runtime, not the real MicrosoftEdgeUpdate.exe; (3) check for the persistence script at %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extensions\SysEdgeUpdate.vbs; (4) pivot to network logs for evo.hoster-kg.com / 193.29.56.216; (5) isolate and begin containment if confirmed.

Alert: DETECT — SilkParasite C2 Domain Resolution (Q8). Subject: [HIGH] Detection: SilkParasite — DNS resolution of known C2 domain. Triage: (1) identify which of the 11 domains resolved and cross-reference the family in Section 4; (2) pivot to NetworkConnectIP4 for the resolved IP; (3) identify the initiating process (ContextBaseFileName) and check it against the sideload carrier list; (4) if a carrier binary is the initiator, escalate directly to full-host triage — this is the C2 channel activating, not reconnaissance.

Machine-Readable IOC Appendix

Full atomic IOC set (241 rows) is published at the Bitdefender malware-ioc GitHub repo. The blocks below are practical, one-click imports covering the highest-confidence subset.

Falcon IOC Management CSVbulk import

type,value,action,severity,expiration,description,tags
domain,evo[.]hoster-kg[.]com,detect,high,2027-02-26,NodeEdgeRAT C2 domain (impersonates hoster.kg),campaign:SilkParasite
ipv4,193[.]29[.]56[.]216,detect,high,2027-02-26,NodeEdgeRAT C2 IP,campaign:SilkParasite
domain,uzrailway[.]devon-uz[.]com,detect,high,2027-02-26,BloodAlchemy C2 domain (port 443),campaign:SilkParasite
domain,it[.]hpsupporter[.]com,detect,high,2027-02-26,NomadRAT C2 domain,campaign:SilkParasite
ipv4,195[.]88[.]191[.]234,detect,high,2027-02-26,NomadRAT C2 IP,campaign:SilkParasite
domain,mineconom[.]tdtu[.]org,detect,high,2027-02-26,NomadRAT C2 domain,campaign:SilkParasite
ipv4,2[.]58[.]15[.]14,detect,high,2027-02-26,NomadRAT C2 IP,campaign:SilkParasite
domain,info[.]ktnet[.]org,detect,high,2027-02-26,GoginRAT C2 domain,campaign:SilkParasite
ipv4,193[.]29[.]56[.]205,detect,high,2027-02-26,GoginRAT C2 IP,campaign:SilkParasite
domain,manager[.]skycom[.]support,detect,medium,2027-02-26,SpiceRAT C2 domain,campaign:SilkParasite
domain,infrastructure[.]minings[.]blog,detect,medium,2027-02-26,SpiceRAT C2 domain,campaign:SilkParasite
domain,contact[.]onenote-service[.]com,detect,medium,2027-02-26,SpiceRAT C2 domain,campaign:SilkParasite
domain,www[.]mubrn[.]com,detect,medium,2027-02-26,SpiceRAT C2 domain,campaign:SilkParasite
domain,www[.]tmtransport[.]org,detect,medium,2027-02-26,SpiceRAT C2 domain,campaign:SilkParasite
domain,kg[.]cwisuz[.]com,detect,medium,2027-02-26,SpiceRAT C2 domain,campaign:SilkParasite
ipv4,2[.]58[.]15[.]164,detect,medium,2027-02-26,SpiceRAT C2 IP,campaign:SilkParasite
ipv4,45[.]153[.]125[.]200,detect,medium,2027-02-26,SpiceRAT C2 IP,campaign:SilkParasite
ipv4,45[.]153[.]125[.]20,detect,medium,2027-02-26,SpiceRAT C2 IP,campaign:SilkParasite
ipv4,45[.]153[.]127[.]226,detect,medium,2027-02-26,SpiceRAT C2 IP,campaign:SilkParasite
ipv4,188[.]214[.]39[.]243,detect,medium,2027-02-26,SpiceRAT C2 IP,campaign:SilkParasite
ipv4,194[.]14[.]217[.]146,detect,medium,2027-02-26,SpiceRAT C2 IP,campaign:SilkParasite
ipv4,91[.]132[.]94[.]58,detect,medium,2027-02-26,SpiceRAT C2 IP,campaign:SilkParasite
ipv4,91[.]132[.]94[.]36,detect,medium,2027-02-26,SpiceRAT C2 IP,campaign:SilkParasite
ipv4,194[.]68[.]44[.]133,detect,medium,2027-02-26,SpiceRAT C2 IP,campaign:SilkParasite
ipv4,193[.]29[.]59[.]242,detect,medium,2027-02-26,SpiceRAT C2 IP,campaign:SilkParasite
ipv4,45[.]153[.]125[.]117,enrich,low,2026-09-26,IP associated with the threat actor (unattributed),campaign:SilkParasite
ipv4,185[.]26[.]236[.]16,enrich,low,2026-09-26,IP associated with the threat actor (unattributed),campaign:SilkParasite
ipv4,217[.]9[.]250[.]86,enrich,low,2026-09-26,IP associated with the threat actor (unattributed),campaign:SilkParasite
sha256,47bb9e8f110f364d1c09d43f4df980c5d2ca87ca2b6e1c8f98abdf8cb3e69e0e,detect,critical,2027-02-26,DriveSilkRAT GoogleDriveClient.exe loader,campaign:SilkParasite
sha256,f2848e1f8d44b2d29d49f57721a9ffbdc128e882158a6c84ba4cf1c524824df6,detect,critical,2027-02-26,DriveSilkRAT GoogleDriveClient.exe loader,campaign:SilkParasite
sha256,7906f921049423de61def95798b7f556bd1f8a47326522788aebd271243a342d,detect,critical,2027-02-26,DriveSilkRAT GoogleDriveClient.exe loader,campaign:SilkParasite
sha256,16317e41f35cea5089ffe6af9153199dc4951dd9c1e2d333443b3b931ce99a9e,detect,critical,2027-02-26,DriveSilkRAT GoogleDriveClient.exe loader,campaign:SilkParasite
sha256,9cdab6c300f7fc6044d78836dbafa13b48b5d746dcbf2e99d2aa8244847a9242,detect,critical,2027-02-26,CookiETagRAT tak_deco_lib.dll sideload payload,campaign:SilkParasite
sha256,db4c75da33810493a14d9fdc7807367d9fa70f8a815951335771f32016254d46,detect,critical,2027-02-26,NomadRAT scansts.dll sideload payload,campaign:SilkParasite
sha256,6c440a5fc99eb09b1dc0b8c79f2a7448f8407e1d8b78a949a333511f0bb13b25,detect,critical,2027-02-26,GoginRAT mscorsvc.dll sideload payload,campaign:SilkParasite
sha256,aab828ceb2db599e5fd2f9a742645dcf17eeac3b3e322d71fe068ea74dfc7fba,detect,critical,2027-02-26,BloodAlchemy dsp_ippv2_x64.dll sideload payload,campaign:SilkParasite
sha256,a1784169dd84cf886ed75219a32ffde24e93bca7650dafd6a51a9062f52f7f35,detect,critical,2027-02-26,HelpLoader calibre-launcher.dll (SpiceRAT sideload payload),campaign:SilkParasite
sha256,d16507495078941d106e4de52606bf573548e2b2125ee35d21b4b639b1001219,detect,critical,2027-02-26,NodeEdgeRAT update.js,campaign:SilkParasite
sha256,ff22419b8ec3994542f23c78dc21a7c5abcb634008d99b7fa1fff1bb23102a00,detect,high,2027-02-26,SpiceRAT phishing Office document,campaign:SilkParasite

Behavioral Signaturesnot blockable atomic IOCs

# Persistence -- scheduled tasks
SysEdgeUpdateTaskMachineCore              (NodeEdgeRAT, masquerades as a Microsoft Edge update job)
fl_bridge                                 (BloodAlchemy)
Kovid Goyal EBook Task-S-1-5-21-*         (SpiceRAT, several SID-suffixed variants observed)
MicrosoftEdgeUpdateTaskMachineUA{73444F9E-3124-440E-972P-9239645R6BB2}   (SpiceRAT, mimics the real Edge updater task name)

# Persistence -- dropped script / relaunch paths
%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extensions\SysEdgeUpdate.vbs   (NodeEdgeRAT)
C:\ProgramData\USOShared\Logs\            (SpiceRAT relaunch directory, re-executed every 2 minutes)

# Mutexes (single-instance locks -- hunt as raw EDR sensor artifacts, not blockable)
Global\TB_CS                              (DriveSilkRAT)
Global\GoogleDrive_ONE                    (DriveSilkRAT)
253ADCF7-18D4-4E25-9185-B33E4B57DED3      (NodeEdgeRAT)
DFYNBEDKJHGAFSTIJECYUKFDEUBYZPZ           (BloodAlchemy)
{543B7558-C23C-4EBF-8E96-456B138AE0C3}    (NomadRAT single-instance lock)
Global\9D8B18B8-6508-8A18-837B-34368C225CE5   (GoginRAT)

# Attacker infrastructure identifiers
acc-427@serveracc.iam.gserviceaccount.com   (DriveSilkRAT-linked Google service account)

Named Malware / Tooling7 RAT families

DriveSilkRAT   -- .NET/C++, campaign backbone, Google Drive C2 (LOTS), ~65 observed infections
SpiceRAT       -- C/C++, known family (Cisco Talos / SneakyChef), HelpLoader sideload chain
CookiETagRAT   -- C++, tasking hidden in HTTP Cookie/ETag headers
BloodAlchemy   -- C/C++, ShadowPad / Deed RAT lineage, HalosGate syscall evasion
NomadRAT       -- C++, orchestrator + dedicated C2 transmitter + numbered plugins
GoginRAT       -- Go, multi-operator filesystem/shell sessions via goroutines
NodeEdgeRAT    -- Node.js/JavaScript, single obfuscated script, no plugin system

# Confirmed DLL sideload host/DLL pairs (the durable, cross-family heuristic)
ebook-edit.exe             -> calibre-launcher.dll      (SpiceRAT / HelpLoader)
FineReader.exe              -> dsp_ippv2_x64.dll         (BloodAlchemy)
emlproui.exe                 -> scansts.dll               (NomadRAT)
MpDefenderCoreService.exe    -> mpclient.dll              (DriveSilkRAT, C++ variant)
Mp3tag.exe                   -> tak_deco_lib.dll          (CookiETagRAT)
(unidentified signed host)   -> mscorsvc.dll              (GoginRAT)

Patch / ASR / CA Auditverify posture

# Verify Attack Surface Reduction rules relevant to this campaign are set to Block (1)
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Actions

# Confirm WDAC (Windows Defender Application Control) policy is in Enforced mode
Get-CimInstance -Namespace root\Microsoft\Windows\DeviceGuard -ClassName Win32_DeviceGuard | Select-Object -ExpandProperty CodeIntegrityPolicyEnforcementStatus

# Confirm scheduled-task creation auditing (Event ID 4698) is enabled
auditpol /get /subcategory:"Other Object Access Events"

Detection Validation Gates

Gate	Requirement	Status Check
1 · Telemetry ready	PeFileWritten, ProcessRollup2/SyntheticProcessRollup2, ScheduledTaskRegistered, DnsRequest, NetworkConnectIP4 all flowing for the target host population	Run each query with a 24h window on a known-clean host group; confirm non-empty baseline coverage (any process activity at all), not necessarily hits
2 · Benign baseline	Run Q2, Q3, Q10 (medium-FP queries) fleet-wide for 7 days before promotion	Record every hit; confirm each traces to an explained benign cause (RMM tooling, approved macro, portable app) before writing the TUNING exclusion into the shipped query
3 · Positive tests	Confirm each query actually fires on its target artifact	For Q1/Q5/Q6/Q7, stand up an isolated test host, place a file/process/task with the exact matched name (never live malware), and confirm the query returns it within one polling interval
4 · Promotion	Zero unexplained hits across gate 2's window for high-conf/low-FP queries (Q1, Q4, Q5, Q6, Q7, Q8)	Promote to Custom IOA / Block per Section 9's deployment path; re-run gate 2 for 7 days post-promotion to catch anything the initial window missed

Hardening — Tiered & Deployable

Controls are scoped to the platforms this campaign actually touches: Windows endpoint (the sideload/execution surface), Microsoft 365 / email gateway (the delivery surface), and Google Workspace (DriveSilkRAT's LOTS C2 surface).

Immediate — deploy this week

Enable ASR rules for macro-borne execution and email delivery. MITRE M1038 (Execution Prevention) / M1049 (Antivirus). Enable, in Block mode: "Block all Office applications from creating child processes" (GUID D4F940AB-401B-4EFC-AADC-AD5F3C50688A) and "Block executable content from email client and webmail" (GUID BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550). Authority: Microsoft's Attack Surface Reduction rules reference; CIS Microsoft 365 Foundations Benchmark §1.3 (attack surface reduction / macro settings). Verify: Get-MpPreference | Select AttackSurfaceReductionRules_Ids,AttackSurfaceReductionRules_Actions.

Block macros in Office files that originate from the internet (Mark-of-the-Web). M1042 (Disable or Remove Feature or Program). Every recovered lure in this campaign arrived as an email attachment inside an archive — MOTW propagation from the archive to the extracted document is what triggers Office's "Protected View" and blocked-macro behavior by default; confirm this policy is not overridden by a legacy GPO. Authority: CIS Microsoft 365 Benchmark §1.3; Microsoft macro security documentation. Verify: reg query HKCU\Software\Microsoft\Office\16.0\Word\Security /v blockcontentexecutionfrominternet.

Near term — 1 to 4 weeks

WDAC/AppLocker deny rule for the six confirmed sideload DLL basenames. M1038 (Execution Prevention), M1045 (Code Signing). Deny-list calibre-launcher.dll, dsp_ippv2_x64.dll, scansts.dll, mpclient.dll, tak_deco_lib.dll, and mscorsvc.dll from loading anywhere outside each vendor's genuine install directory. Authority: CIS Microsoft Windows 11 Benchmark §18.x (Application Control); NIST SP 800-53 CM-7 (Least Functionality). Pilot in Audit mode for one week before Enforced. See Playbook 2 (Section 13).

Enable scheduled-task creation auditing and PowerShell Script Block Logging. M1047 (Audit). Event ID 4698 catches every named persona in Section 10's behavioral-signatures block at creation time, independent of Falcon coverage. Authority: CIS Microsoft Windows 11 Benchmark §17.x (Audit Policy); MS Security Baseline. See Playbook 3.

Email gateway rule to quarantine password-protected archive attachments from external senders to government/ministry-tagged mailboxes. M1031 (Network Intrusion Prevention). This is the campaign's own chosen weak point — every recovered lure used this exact evasion. Authority: vendor-specific (see Playbook 4 for an Exchange Online transport-rule illustration); best-practice, no formal CIS benchmark line item covers this control specifically. ⚠ best-practice, no formal benchmark.

Strategic — 1 to 3 months

Application allowlisting rollout to Enforced mode fleet-wide (not just the six sideload targets). M1038. Broadens the near-term WDAC pilot into standing coverage against the next unknown sideload pair — DLL sideloading is described by Bitdefender as characteristic of the wider China-nexus ecosystem, not unique to this campaign, so a name-specific deny-list alone has a shelf life. Authority: CIS Windows 11 Benchmark §18; NIST SP 800-53 CM-7.

Google Workspace CASB/DLP monitoring for anomalous Drive API and service-account activity. M1031, M1037 (Filter Network Traffic). Baseline expected service-account behavior and alert on sustained file list/read/create activity with no corresponding human sign-in — this is the only reliable way to see DriveSilkRAT's LOTS channel as itself, rather than only its endpoint symptoms. Authority: CIS Google Workspace Foundations Benchmark; Google Workspace security center context-aware access documentation. ⚠ best-practice, no formal CIS line item names this exact detection pattern.

Quarterly threat-intel-informed blocklist refresh for confirmed SilkParasite infrastructure. M1031. Shared-hosting IPs (Section 4/9) churn tenants; domains are far more durable indicators. Re-validate the IP list against current WHOIS/passive DNS each quarter and retire stale entries rather than leaving them silently blocking reassigned infrastructure indefinitely.

Deployable Playbooks

Playbook 1 — Attack Surface Reduction rules (Windows / Intune, PowerShell)

Prerequisites: Microsoft Defender Antivirus active (not necessarily as primary AV — ASR rules function in passive mode alongside a third-party AV when Defender is in passive/EDR-block mode); Windows 10 1709+ / Windows 11; admin rights on target or Intune deployment channel.
Reboot required: No.
Rollback: Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A,BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550 -AttackSurfaceReductionRules_Actions Disabled,Disabled

1. Pilot in Audit mode first:
   Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions AuditMode

2. Review Windows Event Log Microsoft-Windows-Windows Defender/Operational,
   Event ID 1121 (audit hits) for 5-7 days. Confirm no expected business
   workflow (VBA-driven mail-merge, reporting macros) would be blocked.

3. Promote to Block for the two campaign-relevant rules:
   Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A,BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550 -AttackSurfaceReductionRules_Actions Enabled,Enabled

4. Verify:
   Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Actions

Rollback: rerun step 3 substituting "Disabled,Disabled" for "Enabled,Enabled".

Playbook 2 — WDAC deny policy for confirmed sideload DLLs (Windows, PowerShell)

Prerequisites: An existing WDAC base policy (or willingness to author a minimal one); Windows 10 1903+ / Windows 11 for multiple-policy support; test the policy in Audit mode on a pilot ring before Enforced.
Reboot required: Yes, on first deployment of a new WDAC policy (policy refresh applies at next boot unless using the newer dynamic policy-refresh cmdlets); no reboot needed for subsequent policy updates to an already-deployed policy on supported builds.
Rollback: Remove the deployed policy binary from %WINDIR%\System32\CodeIntegrity\CiPolicies\Active\ and reboot, or use Set-RuleOption to flip the policy back to Audit mode without removing it.

1. Author a minimal deny policy targeting the six basenames (illustrative --
   generate against your actual signed reference set with New-CIPolicy):
   Deny rule filename conditions:
     calibre-launcher.dll, dsp_ippv2_x64.dll, scansts.dll,
     mpclient.dll, tak_deco_lib.dll, mscorsvc.dll

2. Convert to binary and stage in Audit mode:
   ConvertFrom-CIPolicy -XmlFilePath SilkParasiteDeny.xml -BinaryFilePath SilkParasiteDeny.bin
   Copy-Item SilkParasiteDeny.bin "$env:WINDIR\System32\CodeIntegrity\CiPolicies\Active\"

3. Reboot pilot ring; review CodeIntegrity operational log (Event ID 3076,
   audit-mode block-would-have-occurred) for 5-7 days.

4. Promote to Enforced: flip the policy's Audit Mode rule-option element
   (RuleOption Enabled:Audit Mode) off in the policy XML, reconvert,
   redeploy, reboot.

Rollback: delete the .bin from CiPolicies\Active\ and reboot, or redeploy
the policy XML with Audit Mode re-enabled.

Playbook 3 — Scheduled-task auditing and Script Block Logging (Windows, GPO + auditpol)

Prerequisites: Domain or local GPO edit rights; Windows Event Forwarding or a SIEM/EDR pipeline configured to ingest Security-Auditing and PowerShell/Operational logs.
Reboot required: No — audit policy and GPO changes for these settings apply on next gpupdate/policy refresh, no restart needed.
Rollback: auditpol /set /subcategory:"Other Object Access Events" /success:disable; revert the PowerShell logging GPO to Not Configured.

1. Enable scheduled-task creation auditing:
   auditpol /set /subcategory:"Other Object Access Events" /success:enable /failure:enable

2. Enable PowerShell Script Block Logging via GPO:
   Computer Configuration > Administrative Templates > Windows Components
   > Windows PowerShell > Turn on Script Block Logging = Enabled

3. Confirm collection: gpupdate /force, then generate a test scheduled
   task and confirm Event ID 4698 lands in the Security log.

4. Route both log sources to Falcon / your SIEM for the Section 7 native
   audit-log hunts.

Rollback:
   auditpol /set /subcategory:"Other Object Access Events" /success:disable /failure:disable
   Set the Script Block Logging GPO setting back to Not Configured, gpupdate /force.

Playbook 4 — Quarantine password-protected archives from external senders (Exchange Online transport rule, PowerShell)

Prerequisites: Exchange Online admin role (or equivalent mail-gateway admin access for a non-M365 environment); a defined list of government/ministry-tagged distribution groups or mailbox naming pattern to scope the rule.
Reboot required: No.
Rollback: Remove-TransportRule -Identity "Quarantine-PW-Protected-Archive-External".

1. Create the transport rule (illustrative -- adjust AttachmentExtensionMatchesWords
   and recipient scoping to your environment):
   New-TransportRule -Name "Quarantine-PW-Protected-Archive-External" `
     -FromScope NotInOrganization `
     -AttachmentExtensionMatchesWords "rar","zip","7z" `
     -MessageContainsDataClassifications @{Name="Password"} `
     -Quarantine $true `
     -QuarantineTag "SilkParasiteReview"

2. Pilot in Notify-only mode for one week; review false-positive rate
   against legitimate encrypted-archive workflows (legal, HR).

3. Promote to full Quarantine once FP rate is acceptable.

4. Verify: Get-TransportRule -Identity "Quarantine-PW-Protected-Archive-External" | Select State,Mode

Rollback: Remove-TransportRule -Identity "Quarantine-PW-Protected-Archive-External"

Containment Runbook

Phase	Actions	Owner	Evidence to Preserve
Isolate	Network-isolate the host via Falcon RTR (containment mode) the moment any Q1, Q4, Q5, Q6, or Q7 hit is confirmed. Do not simply kill the process first — the operator's minimal-footprint design means a killed process with no network isolation gives them a window to re-task before you finish triage.	IR on-call	Full process tree (RTR `ps`), loaded-module list, active network connections (RTR `netstat`) — capture before isolation changes state
Isolate	Rotate credentials for any Google Workspace service account showing the `acc-###@serveracc.iam.gserviceaccount.com` pattern or any anomalous Drive API activity identified in Section 7's native hunt.	Identity/Cloud admin	Workspace Admin audit log export for the affected service account, 30-day lookback
Eradicate	Remove the sideload DLL, the carrier binary copy (if placed outside its real install directory), the scheduled task, and the persistence script path. Do not simply delete the carrier binary if it is the victim's genuine, correctly-installed copy — remove only the attacker-placed sibling DLL and any attacker-placed copy of the carrier binary.	IR / Endpoint team	Hashes of every removed artifact, full file paths, removal timestamps
Eradicate	Revoke and reissue any credentials the compromised user could reach (BloodAlchemy's keylogger/cliplogger plugins mean any typed or copied secret on that host is presumptively exposed).	Identity admin	List of credentials rotated and rotation timestamps
Eradicate	Hunt laterally: re-run Q1, Q5, Q6, Q7, Q8, Q9 fleet-wide with the confirmed host's first-seen timestamp as the new floor of the search window.	Hunt team	Full result set from the fleet-wide re-run, retained for the incident record
Recover	Re-image any host where the C++ DriveSilkRAT variant (sideloaded via a modified Windows Defender service host) was confirmed — that persistence mechanism runs at a trust level that makes selective remediation unreliable.	Endpoint team	Pre-wipe forensic image
Recover	Restore from a known-clean backup predating the first confirmed indicator; validate against Q1-Q10 before returning the host to production.	Endpoint team	Post-restore validation query results (all clean)
Recover	Notify legal/CERT counterpart given the nation-state espionage assessment and government-sector targeting; coordinate any regulatory or diplomatic notification obligations specific to the affected jurisdiction.	IR lead / Legal	Notification log, timestamps, recipient confirmations

Detection Coverage Map

Technique	Behavior	CQL	IOA	Coverage
T1566.001 / T1027	Spear-phishing, password-protected archive delivery	Q10 (indirect)	—	Partial
T1574.002	Confirmed DLL sideload pairs, six carrier binaries	Q1, Q2	IOA-SilkParasite-Sideload-DLL	Good
T1102.002	DriveSilkRAT Google Drive C2 (LOTS)	Q4	—	Good
T1047	WMI-based command execution	Q3	—	Partial
T1053.005 (NodeEdgeRAT)	SysEdgeUpdateTaskMachineCore	Q5	IOA-SilkParasite-NodeEdge-Task	Good
T1053.005 (BloodAlchemy)	fl_bridge scheduled task	Q6	IOA-SilkParasite-BloodAlchemy-Task	Good
T1053.005 / T1036.005 (SpiceRAT)	USOShared\Logs relaunch persistence	Q7	IOA-SilkParasite-SpiceRAT-Persist-Dir	Good
T1071.001 / T1102.002	C2 domain resolution, all families	Q8	IOA-SilkParasite-C2-Domains	Good
T1071.001	C2 IP connections	Q9	IOA-SilkParasite-C2-IPs	Partial (IP-reuse caveat)
T1204.002 / T1059.005	Macro-spawned interpreter	Q10	—	Partial
T1620	In-memory reflective plugin loading	—	—	GAP
T1115 / T1056.001 / T1134	BloodAlchemy clipboard/keylog/impersonation plugins (in-memory, no distinct file artifact)	—	—	GAP
T1518.001	avp.exe process-check inside the delivery macro	—	—	GAP

The three GAP rows share a root cause: each is an in-process behavior (reflective loading, plugin execution, macro-internal API calls) with no reliable file-write or process-tree artifact that Falcon's standard event model captures independently of the C2/sideload signals already covered above. Closing them requires memory-scanning or ML-based behavioral detection rather than a CQL query, and is flagged here rather than silently omitted. Before promoting any Investigate-tier query above to a blocking IOA, confirm it has cleared all four Detection Validation Gates in Section 11 for the target host population.

Hunt Summary Ticket

TITLE:      Hunt for SilkParasite (China-nexus APT) -- Central Asia government targeting
SEVERITY:   High (nation-state espionage, active campaign, government-sector victims)
SCOPE:      Windows endpoints with document-handling exposure; email gateway; Google
            Workspace tenants used by government/ministry-adjacent organizations
HYPOTHESIS: SilkParasite delivers via spear-phished, password-protected archived Office
            documents; establishes footholds through six confirmed DLL-sideload pairs;
            persists via four named scheduled-task/path patterns; and communicates over
            eleven C2 domains, seventeen C2 IPs, and DriveSilkRAT's Google Drive channel.
QUERIES:    Q1-Q10 (Section 8); 6 promoted to Custom IOA candidates (Section 9)
DO FIRST:   Run Q1 (sideload DLL write) and Q5/Q6/Q7 (named scheduled tasks) fleet-wide,
            24h window, before anything else -- highest confidence, lowest FP, covers
            four of seven families in one pass.
FINDINGS:   [populate post-hunt -- host count, confirmed family, first-seen timestamp]
GAPS:       In-memory reflective plugin loading (T1620); BloodAlchemy clipboard/keylog/
            impersonation plugins; avp.exe security-software-discovery check inside the
            delivery macro -- all three lack a native Falcon artifact independent of the
            sideload/C2 signals already covered (see Section 15).
ACTIONS:    Promote Q1, Q5, Q6, Q7, Q8 to blocking IOAs after Gate 4 (Section 11) clears.
            Deploy Playbook 1 (ASR rules) immediately; Playbooks 2-4 within 30 days.
OWNER:      HuntPack
VERSION:    v0.1 (Draft) -- 2026-08-26

Changelog

v0.12026-08-26Initial pack built from Bitdefender Labs' SilkParasite research (published 2026-08-19) plus corroborating reporting from The Record. Ten CQL hunt queries, six Custom IOA promotion candidates, four deployable hardening playbooks, and a full containment runbook. Dark Reading source could not be retrieved as text (Cloudflare bot-check); retained in References as access-restricted only.

References

Tier	Source	Used For	Access Date
1	Bitdefender Business Insights — SilkParasite: Tracking a China-Nexus APT Across Central Asia	Primary technical source — all seven RAT family write-ups, sideload pairs, attribution, hunt guidance	2026-08-26
1	Bitdefender corporate blog — same report, mirrored	Cross-check / mirror of the primary source	2026-08-26
1	Bitdefender malware-ioc GitHub repository — SilkParasite IOC CSV	Atomic IOC provenance source for every hash, domain, IP, and email in this pack	2026-08-26
2	The Record (Recorded Future News) — Jonathan Greig, "China's 'SilkParasite' espionage operation targeting Central Asia with AI-assisted malware," Aug 20 2026	Independent narrative corroboration; Georgia-lure detail	2026-08-26
3	Dark Reading — "SilkParasite Threatens Central Asian Orgs With Flurry of RATs"	Consulted, access-restricted (Cloudflare bot-check / HTTP 403 on both fetch attempts) — not used for any specific claim in this pack	2026-08-26