kyber.today

daily cyber × ai intelligence

← threat actors

threat actor · CN

SilkParasite

also tracked as china nexus 1, silk parasite 1, famoussparrow 1

2 stories · 1 in the wild · August 20, 2026 – August 24, 2026

evidence: 1 observed

how they got in

  • phishing email 1 · Aug 20

sectors

  • government 2 · Aug 24

geography

  • georgia 1 · Aug 24
  • kazakhstan 1 · Aug 24
  • kyrgyzstan 1 · Aug 24
  • tajikistan 1 · Aug 24
  • turkmenistan 1 · Aug 24
  • uzbekistan 1 · Aug 24
  • central asia 1 · Aug 20
  • china 1 · Aug 20

malware and tools

  • cookie etag rat 1 · Aug 24
  • drive silk rat 1 · Aug 24
  • gogin rat 1 · Aug 24
  • node edge rat 1 · Aug 24
  • nomadat 1 · Aug 24
  • rat 1 · Aug 20

techniques

  • dll sideloading 1 · Aug 24
  • spearphishing 1 · Aug 20

attack phases seen

  • Execution 1 · Aug 24
  • Persistence 1 · Aug 24
  • Initial access 1 · Aug 20

what we reported, newest first, grouped by story

Aug 20 – August 24, 2026 · 2 reports

  • SilkParasite's toolset is larger than first reported — the China-nexus operation against Central Asian governments is now tied to seven RAT families (DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, NodeEdgeRAT among them), with DLL sideloading as core tradecraft and targeting across Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan and Georgia. Bitdefender assesses the China nexus at medium confidence (@DailyDarkWeb) (earlier coverage). · Aug 24 · none · as silk parasite, china nexus · Nation-State & Critical Infrastructure
  • SilkParasite is hitting Central Asian government targets with five new RATs, a China-nexus spear-phishing operation with links to FamousSparrow (The Hacker News, Dark Reading). · Aug 20 · observed · via phishing email · as famoussparrow · Threat Intelligence