OctLurk and SilkLurk: newly identified tailored backdoors in cyber-espionage campaign in Central Asia

This report analyzes two related memory‑focused backdoors (OctLurk and SilkLurk) and a proxy utility (LurkProxy) observed since January 2025 targeting government and critical‑sector organizations in Central Asia and Syria: it documents heavily obfuscated, victim‑specific loaders, network protocols and encryption schemes, a plugin architecture enabling command shells, file management, keylogging, credential harvesting and proxying, outlines post‑compromise activity (Impacket secretsdump, Pandora RC, Fscan, PlugX deployment), provides extensive IoCs (domains, IPs, hashes, file paths) and assesses the operator as a Chinese‑speaking, capable threat actor sharing infrastructure with other campaigns.