SilkParasite Espionage Campaign: Detecting and Defending Against Five New RAT Families Targeting Government Networks

A previously unreported cyber espionage operation, dubbed SilkParasite, has been observed conducting intrusions against government bodies in Central Asia. First identified in late 2025, the campaign stands out for one reason that should immediately concern any SOC: the intrusion set leverages seven distinct remote access tool (RAT) families — five of which have never been publicly documented: DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, and NodeEdgeRAT.

When an actor invests in five bespoke implants rather than reusing commodity tooling, two things are true: they are resourced and patient, and signature-based detection alone will not save you. Bespoke RATs exist precisely to evade AV and EDR static detection. If your defensive posture relies on IOC matching, you are already behind.

While the confirmed targeting is Central Asian government entities, the tradecraft — custom multi-RAT arsenals, long-dwell espionage, government sector focus — maps directly to intrusion patterns we've seen expand laterally into allied diplomatic organizations, NGOs, contractors, and any organization in the geopolitical orbit of the target set. If you support government, defense, diplomatic, energy, or regional critical infrastructure clients, treat this as actionable intelligence today, not background noise.

Technical Analysis

What We Know About the Intrusion Set

Actor/Campaign: SilkParasite — first observed late 2025, assessed as a cyber espionage operation.

Targeting: Government bodies in Central Asia. Espionage-focused: intelligence collection, persistent access, and long-term dwell rather than destructive or financially motivated activity.

Tooling: Seven RAT families in total. The five newly documented families are:

Two additional RAT families (previously known tooling) round out the arsenal. The multi-RAT approach is a deliberate resilience strategy: if one implant is detected and burned, the actor maintains access through the others. This also complicates remediation — cleaning a single RAT does not evict the actor.

No CVE identifiers are associated with this campaign in current reporting. That is consistent with modern espionage tradecraft: initial access in these operations typically comes through spearphishing, credential theft, or abuse of legitimate administrative functionality rather than a single patchable vulnerability. Do not wait for a CVE to act — there is no patch for a bespoke implant.

Defender's Perspective on the Attack Chain

Based on the observed tradecraft of multi-RAT espionage operations of this class, defenders should expect the following chain and instrument detection at each stage:

1. Initial Access — Spearphishing with malicious attachments or links targeting government personnel, or exploitation of internet-facing services. Watch for Office processes spawning scripting interpreters or unexpected child processes.
2. Execution & Staging — RAT droppers frequently arrive as signed-looking binaries, DLLs loaded via legitimate processes (DLL sideloading), or — notably given the NodeEdgeRAT name — abuse of legitimate runtimes such as Node.js, where a malicious script executes under a trusted interpreter. NodeEdgeRAT's naming strongly suggests a Node.js-based implant, which means node.exe executing from unusual paths with unusual script arguments is a high-value detection surface.
3. Persistence — Scheduled tasks, registry Run keys, and services masquerading as legitimate system or vendor components (e.g., names mimicking "Drive", "Cookie", "Edge" updaters — the RAT naming conventions themselves hint at masquerading themes).
4. Command & Control — Low-and-slow beaconing over HTTPS, frequently to cloud-hosted infrastructure or compromised legitimate sites. Cookie-based session management (suggested by CookiETagRAT's name) implies C2 traffic that looks like ordinary web browsing at a glance.
5. Collection & Exfiltration — Staging of documents, keystrokes, and credentials followed by exfiltration over the C2 channel or legitimate cloud storage.

Exploitation status: Confirmed active in-the-wild intrusions against real government networks. This is not theoretical. There is no public PoC or CISA KEV entry because no CVE is involved — the implants themselves are the payload.

Detection & Response

The detections below are built around behaviors inherent to a multi-RAT espionage operation, not brittle IOCs: script-runtime abuse (Node.js), masqueraded persistence, and beaconing behavior. Tune thresholds to your environment before production deployment.

Sigma Rules

---
title: Suspicious Node.js Execution from Non-Standard Path
description: Detects node.exe executing scripts from user-writable or temp directories, consistent with NodeEdgeRAT-style implants abusing the Node.js runtime for payload execution.
references:
  - https://attack.mitre.org/techniques/T1059/007/
  - https://thehackernews.com/2026/08/silkparasite-espionage-campaign-targets.html
author: Security Arsenal
date: 2026/08/11
status: experimental
id: 3f8a1c42-7d2e-4b91-a5c6-9e0f2b7d4a11
tags:
  - attack.execution
  - attack.t1059.007
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith: '\node.exe'
  selection_path:
    CommandLine|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\ProgramData\'
      - '\Users\Public\'
  filter_legit_dev:
    CommandLine|contains:
      - '\npm\'
      - '\node_modules\'
      - 'Visual Studio Code'
  condition: selection_image and selection_path and not filter_legit_dev
falsepositives:
  - Developer workstations running Node.js scripts from profile directories
  - Legitimate Electron-based applications updating in AppData
level: high
---
title: Suspicious Scheduled Task or Service Masquerading as Update Component
description: Detects creation of scheduled tasks or services with names imitating browser/drive update components, a common persistence technique for espionage RATs such as DriveSilkRAT and CookiETagRAT.
references:
  - https://attack.mitre.org/techniques/T1053/005/
  - https://attack.mitre.org/techniques/T1036/005/
  - https://thehackernews.com/2026/08/silkparasite-espionage-campaign-targets.html
author: Security Arsenal
date: 2026/08/11
status: experimental
id: 8b2e6d15-4c3a-4f78-b912-6a1d5e9c0b22
tags:
  - attack.persistence
  - attack.t1053.005
  - attack.t1036.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_schtasks:
    Image|endswith: '\schtasks.exe'
    CommandLine|contains:
      - '/create'
      - '/Create'
  selection_names:
    CommandLine|contains:
      - 'EdgeUpdate'
      - 'DriveSync'
      - 'CookieService'
      - 'OneDriveStandalone'
      - 'BrowserComponent'
      - 'SystemTelemetry'
  condition: all of selection_*
falsepositives:
  - Software deployment tooling creating update tasks (whitelist known deployment accounts)
level: medium
---
title: Unsigned Binary Execution from ProgramData or User Profile with Outbound Network Activity
description: Detects execution of binaries from user-writable directories by accounts not typically associated with such paths, a common staging pattern for bespoke RAT implants during espionage intrusions.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://thehackernews.com/2026/08/silkparasite-espionage-campaign-targets.html
author: Security Arsenal
date: 2026/08/11
status: experimental
id: c5d1a937-2e8f-4b46-9d71-3f6a8c0e5d33
tags:
  - attack.execution
  - attack.defense_evasion
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains:
      - '\AppData\Local\'
      - '\AppData\Roaming\'
      - '\ProgramData\'
    Image|endswith: '.exe'
  filter_known:
    Image|contains:
      - '\Microsoft\Teams\'
      - '\slack\'
      - '\Discord\'
      - '\zoom\'
      - '\Google\Chrome\'
      - '\Microsoft\Edge\'
  condition: selection and not filter_known
falsepositives:
  - Electron-based legitimate applications (extend the filter list for your environment)
  - Portable software run from user directories
level: medium

KQL Hunt Query (Microsoft Sentinel / Defender)

This query hunts for two behaviors in one pass: (1) script-runtime or unsigned-binary execution from user-writable paths, and (2) those same processes establishing outbound network connections — the execution-to-C2 correlation that distinguishes an implant from a benign utility.

let lookback = 14d;
let suspiciousPaths = dynamic([@"\AppData\Local\Temp\", @"\AppData\Roaming\", @"\ProgramData\", @"\Users\Public\"]);
let runtimeNames = dynamic(["node.exe",