SilkParasite espionage targets Central Asian governments with new RATs

Intelligence Summary

A cyber espionage operation called SilkParasite has been observed targeting government bodies in Central Asia. The campaign was first discovered in late 2025. It uses seven remote access tool (RAT) families. Five RATs—DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, and NodeEdgeRAT—are reported as previously undocumented. The intrusion’s use of multiple RAT families indicates a sustained remote-access risk for targeted organizations. Organizations involved in Central Asia government networks should review and hunt for SilkParasite and related RAT activity.

Recommended Action

Confirm whether the affected technology is in use in your environment before deciding on remediation. Until then, watch authentication and outbound traffic logs for the indicators described in the source. This signal rests on a single report, so corroborate it before acting on anything irreversible.

Topics