OctLurk & SilkLurk: APT Activity Heating Up in Central Asia

Hey everyone,

Been digging into the latest reports regarding the suspected Chinese-speaking threat actor targeting Central Asian governments (Afghanistan, Kyrgyzstan, Tajikistan, etc.) since January. The malware families involved, OctLurk and SilkLurk, seem to be the primary payloads here.

From what I can gather, they are heavily targeting healthcare and research sectors. While the full technical write-up is still pending, initial indicators suggest the attackers are utilizing custom backdoors that beacon over HTTP/HTTPS to mimic legitimate traffic.

I've started drafting a YARA rule to catch the OctLurk dropper based on the specific string obfuscation patterns typically associated with this group:

yara rule OctLurk_Dropper_Gen { meta: description = "Detects OctLurk dropper based on unique mutex and API calls" author = "SecurityArsenal_User" date = "2026-08-20" strings: $mutex1 = "Global\OctLurkSession" nocase $c $api_calls = { "InternetOpenUrl" "InternetReadFile" } $s1 = "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)" wide condition: uint16(0) == 0x5A4D and 2 of ($mutex1, $config, $api_calls) and $s1 }

For detection on the endpoint, watching for suspicious parent-child process relationships is key. If you have EDR, look for mshta.exe or regsvr32.exe spawning PowerShell.

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} | 
Where-Object {$_.Message -match 'mshta.exe' -and $_.Message -match 'powershell.exe'} | 
Select-Object TimeCreated, Message

Has anyone in the community observed similar C2 infrastructure in their telemetry? I'm particularly interested if the TLS certificates are self-signed or if they are leveraging valid Let's Encrypt certs to blend in.