China-Linked SilkParasite Uses AI-Assisted Malware in Central Asia

Bitdefender has linked a nearly year-long espionage campaign targeting government institutions in Central Asia to China-based threat actors. Known as SilkParasite, the operation used seven malware families—five previously undocumented—to infiltrate economic agencies in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, Georgia and Kazakhstan, with 65 infections attributed to the most widespread payload, DriveSilkRAT.

The attackers gained initial access through spearphishing emails containing malicious Microsoft Office documents, often bundled in archives to evade gateway scanners. Government-themed lures were tailored to regional ministries and economic bodies, while Bitdefender identified two emails apparently generated with AI. Researchers also found indicators suggesting AI assisted parts of the malware-development process, but emphasized that SilkParasite remained the work of skilled human operators rather than autonomous attack software.

DriveSilkRAT avoided the conventional dedicated command-and-control infrastructure used by most remote-access trojans. Instead, it communicated through a shared Google Drive folder, allowing malicious traffic to blend with routine cloud activity and attract less attention from corporate network monitoring. Bitdefender attributed the operation to China based on overlaps between one malware strain and a known China-linked espionage group, as well as infrastructure connections to Chinese telecommunications providers. Investigators can use a WHOIS lookup and a VPN/proxy detector when assessing infrastructure or anonymization links discovered during an investigation.

Organizations should treat suspicious Office files in password-protected or otherwise concealed archives as high-priority alerts and inspect unusual Google Drive sessions and transfers, particularly from government and economic agencies. Security teams can also use an email breach checker to determine whether a targeted address has appeared in known breach data, while logging, endpoint detection and threat hunting should focus on the archive-delivery chain, in-memory execution and cloud-based command channels characteristic of SilkParasite.