Suspected Chinese‑Speaking Hackers Deploy OctLurk & SilkLurk Against Central Asian Governments
What Happened — A threat group speaking Mandarin is believed to be running a sustained campaign against government entities in Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and Syria. Since January 2025 the actors have leveraged the OctLurk and SilkLurk malware families to gain footholds, exfiltrate data, and maintain long‑term persistence.
Why It Matters for Compliance & Audit Readiness
- The activity exemplifies the type of credential‑theft and privileged‑access abuse that SOC 2 Access Controls (CC6.1, CC6.2) are designed to prevent and evidence.
- Continuous monitoring of privileged‑access logs and MFA enforcement provides the audit‑ready trail needed to demonstrate “least‑privilege” and “monitoring” principles.
- Verisq’s SOC2 Access Controls capability helps map these controls to evidence collection, making it easier to show compliance during an audit after a suspected breach.
Who Is Affected – Government ministries, public‑health agencies, research institutes, and other state‑run bodies in the listed Central Asian nations.
Recommended Actions
- Review and tighten privileged‑access policies: enforce MFA, limit admin rights, and rotate credentials regularly.
- Deploy continuous log‑aggregation and real‑time anomaly detection for privileged‑account activity.
- Conduct a SOC 2 access‑control readiness assessment and capture evidence (MFA logs, privileged‑access reviews) for audit purposes.
Technical Notes – OctLurk is a credential‑stealing backdoor that harvests browser passwords and SSH keys; SilkLurk adds a modular exfiltration component and can pivot laterally via stolen credentials. Both families are delivered through spear‑phishing attachments and compromised remote‑desktop services. Source: The Hacker News