DEV Community

Anoymask
Anoymask

Posted on

SilkParasite: Cloud C2 and Multi-Language RATs Targeting Central Asia

#security #threatintel

1. Basic Information

2. Executive Summary

A China-nexus espionage campaign targeting government and economic policy organizations using password-protected documents, DLL side-loading, and multiple RATs that leverage Google Drive and HTTP headers for C2.

Reason for Severity: The campaign targets government and economic policy organizations over long periods, combining seven different RATs, legitimate cloud C2, in-memory plugins, and AI-assisted development.

3. Attack Flow

From Spearphishing to Multi-RAT Deployment

  1. Attackers send password-protected RAR archives containing malicious Office documents to government and economic policy organizations in Central Asia.
  2. Document macros drop a legitimate executable and a malicious DLL, executing a loader via DLL side-loading.
  3. The infection launches RATs like DriveSilkRAT, and adds other RATs or plugins based on the target environment and objectives.
  4. DriveSilkRAT uses Google Drive as its C2, runs in-memory .NET plugins, and uploads the results.
  5. CookiETagRAT embeds C2 data into HTTP Cookie/ETag headers to look like normal traffic.

Execution Separation and AI-Assisted Development

  1. Some plugins run commands via WMI to break the direct parent-child relationship from the RAT to cmd.exe.
  2. Similar structures, test functions, and placeholder keys found across different languages led to a medium-confidence assessment of AI-assisted development.
  3. Decoy documents likely created by AI were also used, though not all code is confirmed as AI-generated.

4. Attacker Location and Execution Location

  • External attackers manage emails and C2.
  • Document macros, side-loaded DLLs, and multiple RATs execute on compromised Windows endpoints.
  • Google Drive and HTTP traffic are used as C2 channels.

5. Visibility for Victims and Administrators

Victims and Users

  • Infection occurs when a user opens a password-protected archive and enables macros/content in the document.
  • It is hard to notice because traffic blends in with legitimate cloud services.

Administrators and SOCs

  • Key indicators include: Office spawning a signed app that loads an adjacent DLL, WMI usage, in-memory .NET activity, Google Drive API calls, and abnormal use of Cookie/ETag headers.
  • It is important not to treat multiple RATs found at the same time as separate incidents.

6. Success and Failure Conditions

Success Conditions

  • The target opens the archive and runs the malicious document's macros.
  • A legitimate executable and a writable path allow DLL side-loading.
  • Google Drive/HTTP C2 is allowed, and EDR does not block in-memory execution.

Failure Conditions

  • Controlling password-protected archives and Office macros.
  • Detecting or blocking legitimate applications running unknown DLLs from user-writable locations.
  • Monitoring cloud API usage per app, device, and user.
  • Visualizing WMI child processes and in-memory .NET activity.

7. What Happens Upon Success

  • Long-term remote control, system/file discovery, and command execution.
  • Collection and theft of government and economic policy information.
  • Detection evasion and redundancy through multiple RATs and legitimate cloud C2.

8. Observable Logs

Email

  • Password-protected RAR files, Office documents themed around government/policy, external senders, and decompression passwords in the email body.

Proxy / SWG / DNS

  • Periodic communication to the Google Drive API from processes outside of normal business operations.
  • HTTP traffic with unusually long or high-entropy Cookie/ETag headers.

Endpoint / EDR

  • Office macros, unknown DLLs in the same directory as legitimate executables, and DLL side-loading.
  • WMI commands, in-memory .NET assemblies, and multiple RATs.

Identity / IdP

  • Tokens and accounts used for Google Drive C2. Compromise of the victim organization's IdP is not confirmed in public reports.

SaaS / Cloud

  • Google Drive API file creation, updates, downloads, and abnormal apps/tokens.

Network

  • C2 traffic for DriveSilkRAT, CookiETagRAT, etc., and HTTP header-based beacons.

9. Attack Success Determination

  • Attack Attempt Observed (Success Unconfirmed): Only decoy emails received. Attachment opening and macro execution not confirmed.
  • User Action Confirmed: RAR extraction, document opening, and macro/content enablement confirmed.
  • Initial Execution Confirmed: Macros, DLL side-loading, and loader execution confirmed.
  • Malware Execution or Authentication Success Confirmed: RAT startup, C2 registration, command reception, and plugin execution confirmed.
  • Information Theft or Session Compromise Confirmed: Upload of collected files or execution results to Google Drive/C2 confirmed.
  • Subsequent Compromise Confirmed: Additional RATs, lateral movement to other devices, and long-term persistence confirmed.

"Attack Attempt Observed (Success Unconfirmed)" means suspicious requests or deliverables were found, but does not mean code execution or data theft succeeded. Raise the stage based on subsequent evidence.

10. Investigation Playbook

Trigger

  • Password-protected RAR + Office document.
  • Legitimate app loading an unknown adjacent DLL.
  • Periodic communication to the Google Drive API from a non-standard process.

Initial Verification

  • Identify email, attachment, password, opener, and macro execution time.
  • Verify the source directory, digital signature, and hash of legitimate EXEs and DLLs.

Endpoint

  • Investigate Office, loaders, WMI, in-memory .NET, RAT configurations, persistence, and collected files.

Authentication & Cloud

  • Check Google Drive OAuth tokens, app IDs, and targeted files.
  • Check for victim credential theft and IdP logs.

Subsequent Activity

  • Search all endpoints for IOCs of the 7 RATs and common C2/deployment methods.
  • Check for access to and exfiltration of government and policy-related documents.

Containment

  • Isolate devices, block C2/OAuth, revoke tokens, and quarantine emails.
  • Update compromised credentials and rebuild from a trusted image.

Judgment Categories

  • Email received only
  • User action confirmed
  • Loader executed
  • RAT/C2 confirmed
  • Information theft / subsequent compromise confirmed

11. Defense and Detection Ideas

Single Event

  • Office places a legitimate executable in a user-writable area and loads an adjacent DLL.
  • Suspicious commands via WMI.
  • Google Drive API calls from non-browser / non-standard asynchronous clients.

Timeline Correlation

  • Email -> RAR extraction -> Office macro -> DLL side-load -> WMI/in-memory plugin -> Cloud C2.

Threat Hunting Perspective

  • Unsigned DLLs created at the same time as a legitimate signed EXE.
  • Abnormal length or entropy in Cookie/ETag headers.
  • Multiple RATs appearing consecutively on the same device or organization.

Log Gaps

  • Process attribution for attachment opening, Office macros, DLL loading, WMI, memory scans, and cloud APIs.

Priority Countermeasures

  • Control Office macros and password-protected archives.
  • Detect DLL side-loading.
  • Conduct behavioral analysis of legitimate cloud C2.
  • Provide targeted attack awareness training for government and policy departments.

12. Facts / Inference / Hypothesis

Facts

  • SilkParasite has targeted government and economic policy organizations in Central Asia for a long period.
  • Five new RATs (DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, NodeEdgeRAT) were described, bringing the total to seven including known RATs.
  • DriveSilkRAT uses Google Drive C2 and in-memory .NET plugins.
  • CookiETagRAT uses HTTP Cookie/ETag headers for C2.
  • The assessment of AI-assisted development is held with medium confidence, not as fully AI-generated.

Inference

  • Combining legitimate clouds with multiple RATs weakens detections that rely on a single domain or malware name.
  • Organizations dealing with international relations, trade, or resources may also fall into the scope of interest.

Hypothesis

  • In the medium to long term, the same multi-language RAT infrastructure may be reused against government and economic targets in other regions.

13. MITRE ATT&CK Mapping

  • T1566.001 – Phishing: Spearphishing Attachment (Medium Confidence): Initial delivery is strongly suggested but not confirmed in all cases.
  • T1204.002 – User Execution: Malicious File (High Confidence)
  • T1055.012 – Process Injection: Process Hollowing (Low Confidence): In-memory execution is confirmed, but the exact method may not be identical across all RATs.
  • T1574.002 – Hijack Execution Flow: DLL Side-Loading (High Confidence)
  • T1047 – Windows Management Instrumentation (High Confidence)
  • T1102.002 – Web Service: Bidirectional Communication (High Confidence)
  • T1071.001 – Application Layer Protocol: Web Protocols (High Confidence)

14. Unknowns and Additional Investigation

  • All delivery vectors where initial compromise was confirmed.
  • Number of compromised organizations, stolen data, and scope of lateral movement.
  • Specific ties between the threat actor and the Chinese government.
  • Exact scope of AI-assisted components.

15. Impact on SOCs and Organizations

Organizations handling international relations, resources, and infrastructure projects may become targets of interest. Legitimate Google Drive traffic should not be universally allowed; instead, administrators must evaluate processes, tokens, API operations, and email origins in chronological order.

16. Summary by Target Audience

For SOCs

Correlate emails, DLL side-loads, WMI, multiple RATs, and cloud C2 as a single incident.

For Administrators

Control and monitor macros, user-space DLLs, and legitimate cloud APIs.

For Users

Report password-protected attachments and requests to enable macros as suspicious.

Top comments (0)