SilkParasite Infrastructure: SpiceRAT Servers Tied to Energy and Government Targets Across Central Asia

This research documents a cluster of SpiceRAT C2 servers active from late 2025 through August 2026 that share TLS certificates, cloned web content, and registration-level links to hosts Bitdefender attributed to NodeEdgeRAT and NomadRAT; the infrastructure impersonates Central Asian government and energy entities (including an Uzbekistan railway spoof via a certificate issued by TLC, a China-affiliated CA) and includes 13+ IoCs, hosting/reseller mappings, and passive DNS history enabling defensive follow-up.