SilkParasite SpiceRAT C2 Cluster + skynox7 Proxyjacking Campaign: OTX Pulse Analysis — Edge Device & Central Asia Detection Pack

Two pulses published to AlienVault OTX on 2026-10-16 illuminate complementary halves of the modern intrusion economy: state-aligned espionage against Central Asian critical infrastructure, and criminally monetized compromise of the edge device layer that enterprises routinely ignore.

Pulse one documents SilkParasite, an adversary cluster operating SpiceRAT command-and-control infrastructure active from late 2025 through August 2026. Hunt.io's infrastructure analysis ties the C2 network together through shared TLS certificates, overlapping domain registrations, and a cloned RTX Corporation webpage used as a lure or operational cover. The infrastructure serves multiple RAT families — SpiceRAT, NodeEdgeRAT, NomadRAT, and BloodAlchemy — suggesting either a single operator maintaining a multi-family toolkit or a shared provisioning service (a "RAT-as-a-service" backend). Targeting is focused on Government, Energy, and Telecommunications sectors across Central Asia, with infrastructure impersonating Uzbek government entities (mfa-uz.com mimicking the Ministry of Foreign Affairs of Uzbekistan, uzrailway.devon-uz.com impersonating Uzbekistan Railways). The hpsupporter.com cluster — with api., help., and checkup. subdomains — masquerades as HP technical support infrastructure, a classic legitimacy-by-association technique.

Pulse two documents skynox7, a financially motivated actor running a proxyjacking campaign that compromised at least 143 network edge devices across 34 countries, forcibly enrolling them into residential proxy networks (with IPRoyal referenced in the tag set — the monetization layer where hijacked bandwidth is sold). Exploitation targeted D-Link ShareCenter NAS devices (CVE-2024-3272, CVE-2024-3273), SAP NetWeaver Visual Composer (CVE-2025-31324), Ubiquiti UniFi Video NVR systems, and Hikvision/Dahua DVR/NVR hardware, with Log4Shell (CVE-2021-44228) also in the exploit kit. The objective is bandwidth theft: compromised devices relay third-party traffic, generating revenue for the operator while the victim's IP reputation absorbs the abuse.

Collective read: both campaigns converge on the same defensive blind spot — network edge and perimeter-adjacent infrastructure that sits outside EDR coverage. SilkParasite uses government-themed spearphish infrastructure to land RATs on human endpoints; skynox7 skips humans entirely and exploits internet-facing appliances directly. Security teams must treat edge devices, NVR/DVR fleets, and NAS appliances as first-class assets in detection scope.

Threat Actor / Malware Profile

SilkParasite (APT Cluster)

• Distribution: Government and telecommunications-themed spearphishing using impersonated domains (Uzbek MFA, Uzbekistan Railways) and cloned legitimate corporate pages (RTX Corporation). Lure documents deliver first-stage loaders.
• Payload behavior: SpiceRAT provides remote shell access, file exfiltration, keylogging, and screenshot capture. NodeEdgeRAT and NomadRAT function as modular second-stage implants, while BloodAlchemy operates as a persistence/backdoor component with a small footprint designed to survive reboot cycles and loader replacement.
• C2 communication: HTTPS to attacker-controlled domains fronted as legitimate services (api.hpsupporter.com, checkup.hpsupporter.com, post.mfa-uz.com). Shared TLS certificates across the cluster indicate centralized certificate provisioning — a high-value pivot for defenders. Beaconing intervals with jitter over 443 blend with normal SaaS traffic.
• Persistence: Registry Run keys and scheduled tasks masquerading as vendor update mechanisms (HP-support-themed naming consistent with the hpsupporter.com infrastructure).
• Anti-analysis: Multi-stage delivery, domain fronting via legitimate-looking subdomains, TLS-encrypted C2, and infrastructure rotation across registrars while retaining certificate reuse (the operational mistake that enabled clustering).

skynox7 (Proxyjacking Operator)

• Distribution: Direct exploitation of internet-facing edge devices — no phishing required. Exploit kit spans CVE-2024-3272/CVE-2024-3273 (D-Link ShareCenter command injection/backdoor accounts), CVE-2025-31324 (SAP NetWeaver Visual Composer unauthenticated file upload), CVE-2021-44228 (Log4Shell), and known Hikvision/Dahua DVR/NVR flaws.
• Payload behavior: Drops a proxy client binary (the four SHA256 hashes in the pulse represent proxy agent variants) that enrolls the device into a residential proxy network. Outbound connections to proxy orchestration servers begin immediately.
• C2 communication: Persistent outbound TLS connections to bandwidth-monetization platforms; traffic volume scales with third-party proxy customer usage, creating anomalous egress patterns on devices that should be near-silent.
• Persistence: Cron entries, init scripts, or firmware-level modification depending on device class; survives reboots on most NAS/NVR platforms.
• Anti-analysis: Minimal — the operator relies on the absence of monitoring on edge devices rather than active evasion. That is precisely why the campaign succeeded across 34 countries.

IOC Analysis

The two pulses provide three distinct indicator classes, each with different operationalization paths:

For the SilkParasite domains: block at the DNS resolver and web proxy layers, but do not stop there. The shared-TLS-certificate finding means infrastructure not yet in the pulse likely shares certificate fingerprints. Query passive DNS and certificate transparency logs (crt.sh, Censys, Shodan) for certificates matching the known hosts, then resolve sibling domains. Tools: MISP for IOC ingestion and correlation, Censys/Shodan for cert-pivot hunting, dnstwist for monitoring lookalike registrations of your own brands (the RTX clone shows this actor clones legitimate pages).

For the proxyjacking hashes: deploy to EDR blocklists immediately, but recognize that edge devices rarely run EDR. Compensate with network-layer detection: alert on NAS/NVR/DVR devices initiating outbound connections to non-update-server destinations, and on sustained egress bandwidth from IoT VLANs.

For the CVEs: cross-reference against your external attack surface management output. CVE-2024-3272/3273 affect end-of-life D-Link NAS gear that will never be patched — replacement, not remediation, is the fix. CVE-2025-31324 (SAP NetWeaver) is being exploited in the wild broadly; treat any unpatched internet-exposed Visual Composer instance as compromised until proven otherwise.

Detection Engineering

---
title: SilkParasite SpiceRAT C2 Communication to Impersonation Infrastructure
id: 7a3f2c1e-9b4d-4e8f-a2c6-5d1e8f3b9a01
status: experimental
description: Detects outbound network connections to SilkParasite SpiceRAT/NodeEdgeRAT C2 domains impersonating Uzbek government entities and HP support infrastructure, as identified in OTX pulse reporting on Central Asia targeting.
author: Security Arsenal Threat Intelligence
references:
  - https://hunt.io/blog/silkparasite-spicerat-central-asia-infrastructure
date: 2026/10/17
logsource:
  category: dns
product: windows
selection:
  query|contains:
    - 'mfa-uz.com'
    - 'kginfocom.com'
    - 'natcommunzu.com'
    - 'wordcheck.info'
    - 'hpsupporter.com'
    - 'devon-uz.com'
condition: selection
falsepositives:
  - Legitimate HP support traffic (verify destination domain is exactly hpsupporter.com, not hp.com subdomains)
level: high
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.t1583.001
---
title: Edge Device Proxyjacking Agent Execution via Exploited NAS/NVR
id: 2b8e4d6a-1c3f-4a7b-9e5d-6c2a4f8b1d03
status: experimental
description: Detects execution of known skynox7 proxyjacking agent binaries by SHA256 hash, or suspicious shell execution chains consistent with D-Link ShareCenter (CVE-2024-3272/3273) and SAP NetWeaver Visual Composer (CVE-2025-31324) exploitation.
author: Security Arsenal Threat Intelligence
references:
  - https://www.greynoise.io/blog/proxyjacking-edge-devices-residential-proxies
date: 2026/10/17
logsource:
  category: process_creation
  product: windows
selection_hash:
  Hashes|contains:
    - 'SHA256=26abd52f207739556282023e82873424795abc5e527771205a40749f90c01f6e'
    - 'SHA256=2c12a3193b1528cd0a88d4fcfa0c060404de4c2bbe1fecb3fc3fa347f04e0165'
    - 'SHA256=4fd7fa22776dbfde7ddaf02a4f904564593e2ed69f87cbb7bbd6c206a874ecf7'
    - 'SHA256=71f2924a549a8f79a48ff332b071a12cd0b01e9ba643e9f8ed7b72b6d382325d'
selection_sap_exploit:
  ParentImage|endswith:
    - '\java.exe'
    - '\jstart.exe'
  Image|endswith:
    - '\cmd.exe'
    - '\powershell.exe'
    - '\certutil.exe'
    - '\curl.exe'
condition: selection_hash or selection_sap_exploit
falsepositives:
  - SAP administrative maintenance scripts spawning shells from NetWeaver processes (rare; validate with change records)
level: critical
tags:
  - attack.execution
  - attack.t1190
  - attack.t1059
---
title: Persistence via HP-Support-Themed Registry Run Key (SilkParasite TTP)
id: 4d9c1f7b-8e2a-4b6d-a3f5-1e7c9d2b5a06
status: experimental
description: Detects registry Run key persistence entries using HP-support-themed naming, matching the SilkParasite operational pattern of masquerading persistence as vendor update mechanisms alongside hpsupporter.com C2 infrastructure.
author: Security Arsenal Threat Intelligence
date: 2026/10/17
logsource:
  category: registry_set
  product: windows
selection_key:
  TargetObject|contains:
    - '\CurrentVersion\Run'
selection_value:
  Details|contains:
    - 'hpsupport'
    - 'hpupdate'
    - 'hpcheck'
    - 'hpsvc'
filter_legitimate:
  Image|startswith:
    - 'C:\Program Files\HP\'
    - 'C:\Program Files (x86)\HP\'
    - 'C:\Program Files\Hewlett-Packard\'
condition: selection_key and selection_value and not filter_legitimate
falsepositives:
  - Third-party HP driver utilities installed outside standard paths
level: high
tags:
  - attack.persistence
  - attack.t1547.001
  - attack.t1036

// SilkParasite C2 & skynox7 proxyjacking hunt — Microsoft Sentinel
// Part 1: Network connections to SilkParasite impersonation infrastructure
let silkParasiteDomains = dynamic(["mfa-uz.com", "kginfocom.com", "natcommunzu.com", "wordcheck.info", "hpsupporter.com", "devon-uz.com"]);
let c2Hits = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteUrl has_any (silkParasiteDomains)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort;
// Part 2: Proxyjacking agent hash sweep across endpoints
let proxyHashes = dynamic(["26abd52f207739556282023e82873424795abc5e527771205a40749f90c01f6e", "2c12a3193b1528cd0a88d4fcfa0c060404de4c2bbe1fecb3fc3fa347f04e0165", "4fd7fa22776dbfde7ddaf02a4f904564593e2ed69f87cbb7bbd6c206a874ecf7", "71f2924a549a8f79a48ff332b071a12cd0b01e9ba643e9f8ed7b72b6d382325d"]);
let hashHits = DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where SHA256 has_any (proxyHashes)
| project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, ProcessCommandLine, AccountName;
// Part 3: Anomalous egress from server/IoT-class devices (proxyjacking behavioral signal)
let egressAnomaly = DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("curl.exe", "wget.exe", "certutil.exe")
    or DeviceName has_any ("nas", "nvr", "dvr")
| summarize ConnectionCount = count(), UniqueRemoteIPs = dcount(RemoteIP), RemoteDestinations = make_set(RemoteUrl, 20) by DeviceName, bin(TimeGenerated, 1h)
| where ConnectionCount > 200 or UniqueRemoteIPs > 50;
union c2Hits, hashHits, egressAnomaly
| sort by TimeGenerated desc

# Security Arsenal — OTX Pulse IOC Hunt: SilkParasite + skynox7 proxyjacking
# Run elevated on endpoints; review output for follow-up triage

Write-Host "=== [1/4] SilkParasite C2 domain resolution history (DNS client cache) ===" -ForegroundColor Cyan
$c2Domains = @("mfa-uz.com","kginfocom.com","natcommunzu.com","wordcheck.info","hpsupporter.com","devon-uz.com")
Get-DnsClientCache | Where-Object { $n = $_.Name; $c2Domains | Where-Object { $n -like "*$_*" } } |
    Format-Table Name, Data, Type -AutoSize

Write-Host "=== [2/4] Active connections to SilkParasite infrastructure ===" -ForegroundColor Cyan
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | ForEach-Object {
    $r = try { (Resolve-DnsName $_.RemoteAddress -ErrorAction Stop).NameHost } catch { $null }
    if ($r -and ($c2Domains | Where-Object { $r -like "*$_*" })) {
        $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        [PSCustomObject]@{ Process=$proc.ProcessName; PID=$_.OwningProcess; RemoteIP=$_.RemoteAddress; Hostname=$r }
    }
} | Format-Table -AutoSize

Write-Host "=== [3/4] HP-support-themed persistence (Run keys & scheduled tasks) ===" -ForegroundColor Cyan
$runPaths = @("HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run","HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run")
foreach ($p in $runPaths) {
    Get-ItemProperty $p -ErrorAction SilentlyContinue | ForEach-Object {
        $_.PSObject.Properties | Where-Object { $_.Name -match 'hpsupport|hpupdate|hpcheck|hpsvc' -and $_.Value -notmatch 'Program Files' } |
            ForEach-Object { [PSCustomObject]@{ Key=$p; Name=$_.Name; Value=$_.Value } }
    }
} | Format-Table -AutoSize
Get-ScheduledTask | Where-Object { $_.TaskName -match 'hpsupport|hpupdate|hpsvc' } |
    Select-Object TaskName, TaskPath, State | Format-Table -AutoSize

Write-Host "=== [4/4] skynox7 proxyjacking agent hash sweep (common drop paths) ===" -ForegroundColor Cyan
$hashes = @("26abd52f207739556282023e82873424795abc5e527771205a40749f90c01f6e",
            "2c12a3193b1528cd0a88d4fcfa0c060404de4c2bbe1fecb3fc3fa347f04e0165",
            "4fd7fa22776dbfde7ddaf02a4f904564593e2ed69f87cbb7bbd6c206a874ecf7",
            "71f2924a549a8f79a48ff332b071a12cd0b01e9ba643e9f8ed7b72b6d382325d")
$paths = @("$env:TEMP","$env:ProgramData","C:\Windows\Temp","$env:PUBLIC\Downloads")
foreach ($dir in $paths) {
    Get-ChildItem $dir -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
        $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($hashes -contains $h.ToLower()) {
            Write-Host "[!] PROXYJACKING AGENT FOUND: $($_.FullName)  SHA256=$h" -ForegroundColor Red
        }
    }
}
Write-Host "=== Hunt complete. Escalate any hits to IR immediately. ===" -ForegroundColor Cyan

Response Priorities

Immediate (0–4 hours):

• Block all SilkParasite domains (mfa-uz.com, kginfocom.com, natcommunzu.com, wordcheck.info, hpsupporter.com, devon-uz.com and all subdomains) at DNS resolver, web proxy, and firewall egress layers. Sinkhole where possible to identify infected hosts.
• Push the four proxyjacking SHA256 hashes to EDR/AV blocklists and sweep file repositories.
• Inventory internet-facing D-Link NAS, Ubiquiti NVR, Hikvision/Dahua DVR, and SAP NetWeaver instances; take confirmed-vulnerable (CVE-2024-3272/3273, CVE-2025-31324) devices offline or behind ACLs pending triage.
• Pivot on the shared TLS certificate fingerprints from the SilkParasite cluster in Censys/Shodan to surface unlisted C2 domains; block preemptively.

24 hours:

• Run the KQL hunt and PowerShell script across the fleet; any host resolving SilkParasite domains is a confirmed SpiceRAT compromise — isolate and image it.
• Credential reset: SpiceRAT and NodeEdgeRAT include keylogging and credential harvesting. Force password resets and revoke active sessions/tokens for all users on any host with a C2 hit; assume Central Asia-facing government/energy/telecom accounts are priority targets. Verify MFA enrollment integrity on those accounts.
• Review egress bandwidth baselines for IoT/OT VLANs; sustained outbound throughput from DVR/NAS devices indicates active proxyjacking enrollment even if hashes don't match.

1 week:

• Architecture hardening: move all edge devices (NAS, NVR, DVR, IP cameras) into dedicated VLANs with deny-by-default egress — these devices need to reach vendor update servers and nothing else.
• Replace end-of-life D-Link ShareCenter hardware; CVE-2024-3272/3273 will never receive patches.
• Patch or isolate SAP NetWeaver Visual Composer (CVE-2025-31324) and validate no webshells were planted prior to patching — check for unexpected JSP files and child processes of NetWeaver Java services.
• Deploy TLS certificate transparency monitoring on your own brands and key partners (the RTX clone demonstrates this actor clones legitimate pages for lures).
• Extend logging coverage to edge device syslog; the skynox7 campaign succeeded because nobody was watching 143 devices across 34 countries.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub