TL;DR: SilkParasite is a cyberespionage operation, assessed at medium confidence as China-nexus, that targeted government bodies across Central Asia. Bitdefender Labs found seven remote access tool (RAT) families in use, five of which were previously undocumented; we identified and named them: DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, and NodeEdgeRAT. The toolset is small, modular, and professionally engineered, and it carries traces of AI-assisted development.
This article summarizes an investigation by Bitdefender Labs researchers Marius Andrei BACIU, Gheorghe Adrian SCHIPOR, and Victor VRABIE, whose full technical analysis is published in the accompanying full SilkParasite research report.
The threat intelligence feeds right now are full of vibeware: AI-generated malware assembled with minimal engineering discipline. Most of the reporting around it treats volume and capability as the headline. How much the malware does, how many features it packs, sometimes even the raw line count, gets cited as if volume itself were the accomplishment.
Our own research into APT36’s AI-generated tooling, March 2026 put the reality plainly: what these tools represent is “not a breakthrough in malware sophistication, but an optimization of the mediocre.” High output, low quality, prone to collapsing under its own complexity the moment the logic gets hard.
SilkParasite is the opposite story - it's an example of professional espionage tooling optimized to limit volume: minimum footprint, dynamic in-memory execution, and code deliberately built not to resemble previous malware families. APT-grade malware like this remains firmly the work of human professionals.
What makes SilkParasite interesting is the traces of AI-assisted development running through otherwise expert code, which is a different thing from AI-generated malware. APT36’s vibeware was primarily generated: the machine does the building, and it comes out mediocre. SilkParasite is primarily assisted: capable humans do the engineering and lean on AI to move faster, leaving behind a few tells but none of the degradation.
We hold that assisted-development reading at medium confidence, because the code only hints at it. The clearest AI fingerprint did not come from the code. It came later in the investigation, while we were still debating whether an AI assessment was warranted at all: a phishing lure that was unmistakably AI-generated. It is also the one place SilkParasite looks sloppy, and we suspect that sloppiness was deliberate: a lure kept cheap on purpose so it blends into the low-quality AI-generated content the target organizations produce and receive every day.
There is a geopolitical logic to why seven custom RAT families and a year of operational maintenance are being invested into this particular region. Russia’s declining influence in Central Asia and the South Caucasus since the 2022 invasion of Ukraine has opened a vacuum that China has been filling economically. As economic engagement deepens, the officials who shape those political and economic relationships become natural intelligence targets. Government bodies dealing with economic policy are not incidental victims in that framing, but rather the precise target category.
SilkParasite is the third data point in a Bitdefender arc on this pattern. In February 2025, our UAC-0063 investigation documented TAG-110, a campaign targeting government and diplomatic entities across Central Asia and Europe, and framed Russia’s receding regional influence as fertile ground for cyberespionage as Chinese economic expansion accelerated. In May 2026, our FamousSparrow investigation documented the first energy-sector targeting we had seen in the South Caucasus, against Azerbaijani oil and gas infrastructure, extending the contested territory from Central Asia into the Caucasus.
SilkParasite connects directly to that FamousSparrow work. BloodAlchemy, one of the families in this campaign, sits in the ShadowPad and Deed RAT malware lineage (Deed RAT was FamousSparrow’s primary backdoor). This kind of overlap is characteristic of China-nexus espionage in particular. Rather than a single group guarding a private toolkit, the China-nexus ecosystem is well documented as one where tooling, techniques, and infrastructure circulate across otherwise distinct groups. DLL sideloading is the textbook case: a technique that spread so quickly and so widely across China-nexus actors that it now reads almost as a signature of the ecosystem, and it happens to be the delivery method this campaign leans on most.
That's why this matters even if Central Asia sits far outside your threat model. When tooling and whole malware lineages circulate across otherwise distinct actors the way BloodAlchemy just illustrated, an intrusion in one place previews what comes next: another region, another kind of target, same tradecraft.
Subscribe to Ctrl-Alt-DECODE, our newsletter for security practitioners and anyone interested in learning about the latest developments in the field.
In late 2025, around October, Bitdefender researchers detected a single suspicious infection at a Central Asian government body involved in economic decision-making. The initial foothold involved two families, SpiceRAT and DriveSilkRAT. That one detection triggered months of forensic investigation and active threat hunting, which uncovered the seven distinct RAT families, a maintained build-and-packaging infrastructure, and an operation that had been running for the better part of a year.
Regarding attribution, several elements point to a China-nexus group. Cisco Talos has publicly linked SpiceRAT to SneakyChef, a China-based espionage group active since at least August 2023. Infrastructure analysis identified several IP addresses tied to China Unicom’s backbone network. The victim profile fits a China-nexus intelligence interest in the region, as do the techniques and tooling deployed.
Fig. 1: Operator command activity by hour, in the operator's inferred local time (UTC+8). Derived from server-side Google Drive timestamps on operator-issued commands (n = 37).
We don’t believe the evidence supports pinning this campaign to a single named group. Shared tooling ecosystems are not the same as a single controlling actor, and IP-level infrastructure analysis is circumstantial. We designate the activity cluster as SilkParasite and hold the China-nexus affiliation at medium confidence.
Initial access ran through malicious Microsoft Office documents, most likely delivered by spear-phishing email. In several cases the lure documents were packaged inside password-protected RAR archives, with the password supplied in the email body, a low-effort but effective way to slip past email-gateway scanning and automated sandbox inspection. Once opened, the document ran a macro that dropped a signed-application sideloading chain to disk and launched the first-stage payload.
The lures were regionally tailored. Recovered documents were crafted to look relevant to government entities in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, and Kazakhstan, several impersonating specific ministries. A further document, recovered from a public malware-sharing platform, was addressed to a Georgian government entity.
The delivery macro was also security-software aware: before executing, it checked whether Kaspersky’s avp.exe process was running and adapted its behavior accordingly. Knowing which antivirus is common across government targets in this region, and building that knowledge into the delivery logic, is not something a generic toolkit does.
Fig. 2: Phishing lure impersonating the Ministry of Internal Affairs of the Republic of Uzbekistan, one of several recovered in this campaign. Shared here as found publicly posted on VirusTotal; additional samples appear in the full research report.
Two of the recovered lures were themselves AI-generated: a fake regional energy-cooperation platform and a fake advertisement for GPU cloud-computing capacity. Both look cheap, which sits oddly against the discipline everywhere else in this operation. The cheapness may be deliberate, blending into the AI-generated content these organizations now handle daily, or it may be the one corner the operators cut.
Fig. 3: An obviously AI-generated lure: a fake Central Asian energy-cooperation platform. The low production quality appears deliberate.
Note: The documents shown above are AI-generated cyber-fraud specimens. Bitdefender reproduces it solely for cybersecurity research and awareness purposes.
Before examining the families individually, it is worth establishing what makes this toolset notable as a collection rather than as a list of implants.
Nearly every family in SilkParasite is built around plugin architecture: the implant loads additional capabilities on demand from its command-and-control (C2) server rather than shipping them all at once. This is a design choice common to APT-grade malware.
It keeps the initial footprint small, limits what is exposed on any single victim, lets capabilities be updated without replacing the whole implant, and means a defender who catches one component has not necessarily caught everything the operator can do. That approach holds across seven families written in four different languages (.NET, C++, Go, and JavaScript), which is itself a tell: this looks like a functioning software organization, not one developer.
DLL sideloading is the primary delivery mechanism, used here in its passive form. The operators do not hijack a running application: they bring their own copy of a legitimately signed program, deploy it as a standalone file, and place a malicious library beside it under a name the program already looks for. When the signed program runs, it loads that library from its own folder exactly as designed, and the malicious code executes inside a trusted, signed process (we cover the technique in our DLL sideloading explainer).
The operators rotated the signed host across families, each loading a differently named malicious DLL: Calibre’s ebook-edit.exe loading calibre-launcher.dll for SpiceRAT, ABBYY’s FineReader.exe loading dsp_ippv2_x64.dll for BloodAlchemy, Quick Heal’s emlproui.exe loading scansts.dll for NomadRAT, Windows Defender’s MpDefenderCoreService.exe loading mpclient.dll for the C++ DriveSilkRAT variant, and Mp3tag’s Mp3tag.exe loading tak_deco_lib.dll for CookiETagRAT, and a still-unidentified host loading mscorsvc.dll for GoginRAT. Detections tuned to one host process do not catch the others.
Operator discipline shows up in the housekeeping. Encryption keys, C2 addresses, payload names, and persistence artifact names all change between builds. A recurring debugging-symbol path in DriveSilkRAT samples, a dedicated Encoder utility, and the use of ConfuserEx (a .NET code-protection tool) point to a maintained packaging pipeline rather than ad-hoc assembly. This is an organization shipping software on a schedule.
The AI-assisted development traces live at this level too, and they belong here rather than in a headline. Two families carry the clearest tells. GoginRAT ships with Go test functions left inside the deployed binary (testing scaffolding normally stripped before release) and a hardcoded AES key set to 0123456789abcdef, a string so sequential it reads as a placeholder someone meant to replace. NodeEdgeRAT carries a configuration field for an encryption key set to the literal change_this_key. On top of that, NomadRAT (C++) and GoginRAT (Go) share an architecture close enough to suggest one high-level design implemented twice in two languages, which is the kind of thing an AI-assisted workflow makes easy. None of this is individually conclusive, and we assess AI-assisted development at medium confidence.
What makes these findings interesting is that they show up even in code that is otherwise carefully engineered. Leftover test functions in a release build, and placeholder keys nobody swapped out, are exactly the residue an AI-assisted workflow leaves behind, and finding them here, in disciplined malware that gets everything else right, shows how normal AI-assisted coding has become.
The seven families at a glance, before the individual write-ups:
| Family | Language | Status | C2 / Delivery Channel |
Plugin Model |
| DriveSilkRAT | .NET, C++ | New, named by us | Google Drive (LOTS) | In-memory .NET plugins fetched via Google Drive (12 recovered) |
| SpiceRAT | C/C++ | Known (Cisco Talos) | HTTP, M247 hosting | DLL plugins fetched from C2 and reflectively loaded |
| CookiETagRAT | C++ | New, named by us | HTTP Cookie / ETag headers | PE plugins pulled from C2, mapped in memory; reuse the implant’s own C2 channel |
| BloodAlchemy | C/C++ | Known (ShadowPad / Deed RAT) | TCP, HTTP/S, DNS, SMB | Three plugins embedded, more available on demand from C2 |
| NomadRAT | C++ | New, named by us | HTTPS | PE plugins fetched by module ID and loaded in memory; bundled local fallback |
| GoginRAT | Go | New, named by us | HTTP | Filesystem and shell plugins lazy-loaded from bundled encrypted modules |
| NodeEdgeRAT | JavaScript (Node.js) | New, named by us | HTTPS | None; all capabilities built into a single script |
DriveSilkRAT, one of the five families we identified and named, is the backbone of the operation. It's the family with the most tracked infection instances and the channel through which the other six were incrementally deployed. Its defining characteristic is where it takes its orders. Instead of talking to a dedicated C2 server (which can be blocked, sinkholed, or flagged on reputation), DriveSilkRAT operators drop command files into a shared Google Drive folder. The infected host polls that folder, downloads its tasking, runs it through an in-memory .NET plugin system, and uploads results back to the same folder. To a network monitor, it is ordinary Google Drive traffic, and many corporate environments allowlist Google services and give them less scrutiny. This is the technique we described in our APT36 research as living off trusted services (LOTS): routing command and control through a legitimate cloud platform the target already trusts, so the malicious traffic hides inside traffic no one questions.
We also expect this technique to spread. Large language models are trained on exactly the kind of well-documented, publicly available SDKs that trusted platforms like Google Drive, Slack, and Discord publish, which makes command-and-control code built on those services some of the easiest code an AI assistant can produce. As AI-assisted development becomes routine, the effort required to stand up this kind of channel keeps falling.
The family exists in both .NET and C++ builds and carries twelve custom .NET plugins covering routine remote administration (process listing, system and network enumeration, file management, command execution). Even small choices show care: the command-execution plugin runs processes through Windows Management Instrumentation rather than spawning cmd.exe directly, breaking the parent-child process chain that endpoint tools watch for.
DriveSilkRAT is also where the campaign’s scale becomes visible, through the identifiers registered in that shared folder. At the time of writing, we have observed roughly 65 infection instances, most in the Asia region. That figure is an upper bound, not a confirmed machine count: DriveSilkRAT derives each victim identifier from hardware fingerprinting, and that logic can produce more than one identifier for the same physical host.
The instinct to read a small infection count as a small or amateur operation is the same instinct that reads lean malware as unsophisticated, and it is wrong for the same reason. A targeted actor measures success by whether the objective was met with minimal exposure, so a modest victim count is often the point, not a limitation.
Fig. 4: DriveSilkRAT: Tasked through a shared Google Drive folder that delivers plugins as in-memory .NET assemblies; the C++ build is sideloaded through a signed Windows Defender service.
SpiceRAT is the family that was previously documented by Cisco Talos, June 2024 in reporting on SneakyChef. The samples in SilkParasite have moved well beyond that earlier reporting, showing meaningful evolution on nearly every axis Talos described.
The delivery is new. Where earlier reporting documented other vectors, the samples here arrive through standalone malicious Office documents and the regionally tailored lures described above, a real shift in how the operators seed the infection. Delivery runs through the DLL sideloading chain: Calibre’s legitimate ebook-edit.exe loads a malicious calibre-launcher.dll (which we track as HelpLoader), and that decrypts and launches the SpiceRAT payload from a file carrying a cosmetic .hlp extension, chosen to resemble a harmless legacy Windows Help file. This is the family whose delivery macro carried the Kaspersky check described earlier.
The payload is better protected than the public samples, too. Its newer variants resolve the Windows APIs they need dynamically by hash rather than through ordinary imports, stripping the suspicious static imports an analyst would otherwise key on. Persistence also changed: the implant copies itself into C:\ProgramData\USOShared\Logs\ and installs a scheduled task that relaunches it every two minutes. And the command-and-control infrastructure, while refreshed, still leans on the M247 network that has repeatedly turned up in APT operations. Taken together, these are the marks of an actively maintained development branch rather than a reused build.
Fig. 5: SpiceRAT: Delivered by the HelpLoader sideloading chain (signed Calibre binary sideloads a malicious DLL); the resident RAT extends itself only with plugins downloaded from its C2.
CookiETagRAT, another family we identified and named, stands out for its protocol design. Most C2 traffic travels in the body of HTTP requests. CookiETagRAT hides its tasking in the headers instead. Commands arrive inside HTTP Cookie and ETag response headers, with results returned in the body. ETag is the ordinary mechanism a web server uses to tell a browser whether cached content has changed, so to a monitor not looking for it, the traffic reads as routine cache validation.
Each host derives its own ChaCha20 key and nonce from a unique system identifier plus a fixed suffix, then hashes it. Traffic captured from one victim will not decrypt another’s, even with full session recordings from both. That is a deliberate architectural decision that caps the intelligence yield of any single capture.
Like most of the toolset, CookiETagRAT initiates by DLL sideloading (the legitimate Mp3tag.exe loading a malicious tak_deco_lib.dll). Rather than waiting for the host application to call one of its exported functions, it runs its malicious logic straight from DllMain, the function Windows invokes automatically whenever a library loads. In a sideloading scenario, that is the more reliable trigger: the loader always fires DllMain when the signed host pulls in the malicious DLL, whether or not the host ever calls the export the code would otherwise depend on.
Execution is immediate, before the legitimate application logic even starts. There is a trade-off, though, and it cuts the other way. Because the code runs the instant the library loads, it also runs the instant a sandbox loads it, which makes CookiETagRAT easier to trip in automated analysis than malware that waits. That is a surprising regression from the more careful two-stage sideloading trigger we documented in our FamousSparrow research, which gated execution through the host application’s own control flow and was correspondingly harder for a sandbox to surface.
Fig. 6: CookiETagRAT: Sideloaded through legitimate Mp3tag and run straight from DllMain; in-memory plugins reuse CookiETagRAT's own encrypted C2 channel.
BloodAlchemy is the second of the two already-known families, and it connects this campaign to a longer history. It sits in the ShadowPad and Deed RAT lineage, a China-nexus development family with years of history behind it, and its loader was previously documented by ITOCHU, May 2024. As covered earlier, Deed RAT is FamousSparrow’s primary backdoor, which is the thread tying SilkParasite back to that Azerbaijani energy campaign.
The evasion in BloodAlchemy’s loader reflects real defensive awareness. Rather than calling sensitive Windows functions through their normal addresses, which security products routinely monitor, the loader uses HalosGate (a syscall-evasion technique) together with hardware breakpoints and vectored exception handlers to invoke system calls without passing through the monitored function entry points, sidestepping the userland hooks that endpoint tools rely on. The payload then executes through EnumTimeFormatsEx, a legitimate Windows function that accepts a callback, which is far quieter than spawning a thread the way most shellcode does.
The most useful analytical prize was three embedded plugins recovered from the sample: impapi (user-session impersonation and process execution under another user’s context), a cliplogger (clipboard logger), and a keylogger. Two were not publicly documented at the time.
Fig. 7: BloodAlchemy: Sideloaded through signed FineReader; the files sit on disk while the backdoor and its plugins run in memory, from a local embedded set plus C2-pushed additions.
NomadRAT, previously undocumented and now named by us, is a C++ modular RAT built around three separated parts: a main orchestrator, a dedicated transmitter library that handles all C2 traffic, and plugins fetched from the server by numeric identifier only when the operator needs them.
The protocol is deliberately layered. Registration data is serialized in MessagePack (a compact binary format, roughly a squeezed JSON) and then base64-encoded; commands arrive as nested base64-encoded JSON, an outer object for the orchestrator wrapping an inner one for the plugin.
NomadRAT also contains a local plugin-loading path that the observed C2 interaction never triggered, referencing on-disk modules named for command execution, file management, and PowerShell. We could not recover the plugins themselves, but the hardcoded names show the framework was designed with a fallback deployment mode for when the C2 is unreachable. Its overall shape (orchestrator, dedicated transmitter as a C2 middle layer, plugins initialized with a communication callback) is the same shape that shows up next, in a completely different language.
Fig. 8: NomadRAT: Sideloaded through a renamed signed antivirus binary; a separate transmitter handles C2, and numbered plugins are fetched on demand.
GoginRAT is the Go family, also identified and named by us, and it implements what looks like the same architectural concept as NomadRAT: a separate transmitter for C2, filesystem and shell capabilities as independent plugins, and plugin results routed through a shared callback rather than each plugin opening its own connection.
GoginRAT reaches the host through DriveSilkRAT and executes by DLL sideloading: a malicious loader DLL (mscorsvc.dll) decrypts and launches the Go orchestrator. The signed executable that loads it was not recovered, though the loader name is consistent with a .NET utility such as mscorsvw.exe.
The design is operator-oriented. A filesystem session and a shell session run independently in separate goroutines (Go’s lightweight threads), so two operators could work a single victim at once, one browsing files while another runs shell commands, without blocking each other. The orchestrator routes sessions rather than sequencing them. The Go itself is idiomatic and functional, using channels, mutexes, context cancellation, and manual memory management across the Go/C boundary in ways that reflect real familiarity with the language, or capable assistance producing it.
GoginRAT carries the campaign’s clearest AI-assisted-development tells, discussed above: the leftover Go test functions and the sequential 0123456789abcdef placeholder key. Neither is conclusive alone, and together they are consistent with a workflow that included AI code assistance and did not fully scrub the evidence before shipping.
Fig. 9: GoginRAT: A Go backdoor whose loader runs an in-memory orchestrator; unlike its siblings it downloads no plugins, lazy-loading bundled local modules instead.
NodeEdgeRAT, the last of the five we identified and named, is the outlier of the set. It is an obfuscated JavaScript implant run through a bundled legitimate Node.js runtime, and unlike every other family here, it has no plugin system: its full capability set (command execution, file management, file transfer) ships in one script.
NodeEdgeRAT’s C2 domain points most directly at the region the campaign targets. evo[.]hoster-kg[.]com impersonates the real Kyrgyz hosting provider hoster.kg.
Persistence runs through a scheduled task named SysEdgeUpdateTaskMachineCore, described to Windows as a Microsoft Edge update job.
Fig. 10: NodeEdgeRAT: The odd one out: no DLL and no plugins. A legitimate Node.js runtime runs an obfuscated script with every capability built in.
Most of the anxiety about AI and malware is really anxiety about volume: machine speed, thousands of automated operations, implants produced faster than any team can triage them. That is a real problem, but it is a commodity-actor problem, a way to win by overwhelming. We have made that broader case elsewhere: AI does not need to be innovative to be dangerous, because its leverage is scale against soft targets rather than sophistication against hard ones.
An APT wins the other way. Espionage like this is built on reaching the objective in as few steps as possible and leaving as little trace as possible, and a thousand noisy implants are the last thing an operation this careful wants. What a group like this can actually use from AI is not generation but assistance: engineers helped along, not replaced. That is the trace SilkParasite left, and it is why we expect the most capable actors to adopt AI slowly and selectively, folding it into professional workflows where it helps and keeping it away from the places where machine-made mediocrity would give the operation away.
This tradecraft profile points to specific things worth hunting, and they hold whether or not you run Bitdefender GravityZone.
The most consistent detection surface across the campaign is DLL sideloading, and the reliable signal is the pairing, not the DLL name alone: a legitimately signed application loading a library placed beside it while running from an unusual location. The confirmed host/DLL pairs named earlier are the best starting point, but the more durable heuristic is broader. Legitimate binaries known to be abused this way have no reason to run from a temp or staging directory. One of them executing from an unexpected location, with an unfamiliar DLL alongside, warrants a look even when it is not always malicious.
Outbound Google Drive traffic without corresponding user-initiated activity is the clearest DriveSilkRAT signal, since the campaign’s delivery backbone ran through that channel for most of its operational life. Scheduled-task review should cover SysEdgeUpdateTaskMachineCore (NodeEdgeRAT) and BloodAlchemy’s fl_bridge persistence entry, both named to blend into routine maintenance jobs.
More broadly, low-footprint plugin-based implants operating through legitimate cloud services are poorly served by volume-based detection. Catching them reliably takes behavioral baselines that flag unusual relationships between processes and network services, rather than signatures for any single artifact.
And the lure-camouflage hypothesis, if it holds, retires a rule defenders spent years teaching. “Sloppy probably means scam” held when attackers could not do better; then AI-generated phishing got convincing enough that polish stopped being reassuring; and now operators can make a lure look cheap on purpose, so it blends into the mediocre AI-generated content already filling every inbox. Whether a message looks slick or sloppy no longer tells a user much about whether to trust it.
The full indicator set for this research is available from our GitHub IOC repository to support other researchers and the wider defender community. The same indicators are also delivered through Bitdefender IntelliZone, our threat intelligence platform, alongside the broader context around this activity.
The complete technical analysis, including protocol documentation and the full MITRE ATT&CK mapping, is in the accompanying full research report.
This research is part of Ctrl-Alt-DECODE, Bitdefender’s threat intelligence initiative.
Directly related research:
Related reading: