INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

SilkParasite Links SpiceRAT to Central Asian Energy and Government Targets

| 2026-09-16 17:20 CRITICAL HIGH MALWARE & BOTNETS
JSON
Executive Summary
AI-generated
A sophisticated cyberattack was launched in September 2026, targeting governments and critical sectors in Central Asia. The attack is linked to the SilkParasite campaign, which has been active since at least August 2022, according to a report by Hunt.io. The attackers used SpiceRAT malware, NodeEdgeRAT, and NomadRAT, three of seven RAT families documented in the SilkParasite report. The attack works by impersonating Uzbekistan's state railway authority with a certificate issued by TLC DV TLS CA, a Chinese state research institute under the Ministry of Industry and Information Technology. At least 13 servers were affected, including five active SpiceRAT servers hosted across multiple hosting providers and countries in mid-March 2026.
Technical Mitigations AI-generated
• User Training (ATT&CK mitigation for Impersonation): Train users to be aware of impersonation tricks and how to counter them, for example confirming incoming requests through an independent platform like a phone call or in- • Threat Intelligence Program (ATT&CK mitigation for Impersonation): Threat intelligence helps defenders and users be aware of and defend against common lures and active campaigns that have been used for impersonation.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 31 IoCs Create Free Account
az•••••.com
ap•••••.com
kg•••••.com
kg•••••.org
171.22.•••.•••
31.58.•••.•••
188.190.•••.•••
193.29.•••.•••
9297d5••••••••••••••••••••••••••••••••••
e9d0e8••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
27e072••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
IndigoZebraIndigoZebra
Target & Sectors
CENTRAL_ASIA CENTRAL_ASIA transportationtransportation governmentgovernment energyenergy
Incident Timeline
‎mid-2022
Passive DNS analysis reveals subdomain infrastructure dating to mid-2022, indicating at least four years of ongoing operations.
organisation DNS
Passive DNS analysis reveals subdomain infrastructure dating to mid-2022, indicating at least four years of ongoing operations.
‎late 2025
Threat actors used SpiceRAT to target energy and government sectors across Central Asia, with the servers tied to shared TLS certificates and domain registrations.
organisation TLS
Infrastructure analysis reveals a cluster of SpiceRAT command and control servers active from late 2025 through August 2026, linked through shared TLS certificates, domain registrations, and a cloned RTX Corporation webpage.
‎March 2026
Threat actors used SpiceRAT command-and-control servers hosted by different providers in various countries to target energy and government sectors across Central Asia.
‎mid-March 2026
Threat actors used SpiceRAT servers tied to multiple hosting providers across Central Asia, which were active together in mid-March 2026.
‎August 2026
Threat actors used a Chinese state-affiliated certificate authority to issue a TLS certificate impersonating Uzbekistan's railway authority, which was linked to a cluster of SpiceRAT command and control servers targeting multiple Central Asian government entities.
organisation TLS
Infrastructure analysis reveals a cluster of SpiceRAT command and control servers active from late 2025 through August 2026, linked through shared TLS certificates, domain registrations, and a cloned RTX Corporation webpage.
organisation TLC
A TLS certificate impersonating Uzbekistan's railway authority was issued by TLC, a Chinese state-affiliated certificate authority.
organisation Türkmengaz
Domains spoof Central Asian government entities including Türkmengaz, the Galkynysh gas field, Tojiktelecom, and Turkmenistan's Ministry of Foreign Affairs.
organisation Tojiktelecom
Domains spoof Central Asian government entities including Türkmengaz, the Galkynysh gas field, Tojiktelecom, and Turkmenistan's Ministry of Foreign Affairs.
organisation Ministry of Foreign Affairs
Domains spoof Central Asian government entities including Türkmengaz, the Galkynysh gas field, Tojiktelecom, and Turkmenistan's Ministry of Foreign Affairs.
organisation NomadRAT
The infrastructure connects to multiple threat families including SpiceRAT, NodeEdgeRAT, NomadRAT, and BloodAlchemy, suggesting either a single operator managing multiple toolsets or shared support infrastructure.
organisation BloodAlchemy
The infrastructure connects to multiple threat families including SpiceRAT, NodeEdgeRAT, NomadRAT, and BloodAlchemy, suggesting either a single operator managing multiple toolsets or shared support infrastructure.
‎2026/09/16
Threat actors linked to SilkParasite used SpiceRAT malware to target energy and government networks across Central Asia, with the infrastructure also mirroring previously documented China-nexus actors FamousSparrow and IndigoZebra.
organisation TLC
“The certificate imitating the Uzbekistan railway entity was issued by TLC, a certificate authority wholly funded by CAICT, a Chinese state research institute under the Ministry of Industry and Information Technology.”
organisation CAICT
“The certificate imitating the Uzbekistan railway entity was issued by TLC, a certificate authority wholly funded by CAICT, a Chinese state research institute under the Ministry of Industry and Information Technology.”
organisation azure.adm‑devon[.]com
Additional domains impersonate Turkmen energy (sanly.oilgas‑tm[.]com), Uzbek administration (azure.adm‑devon[.]com), and even the Kyrgyz president’s residence (data.yntymak‑ordo[.]com).
organisation Türkmengaz
Examples include help.galkynysh[.]net (Galkynysh gas field, Turkmenistan), tmgaz‑server[.]com (Türkmengaz), tm‑mfa[.]com (Turkmenistan’s Ministry of Foreign Affairs), and tojiktelecomtj[.]com (Tojiktelecom, Tajikistan).
organisation tmgaz‑server[.]com
Examples include help.galkynysh[.]net (Galkynysh gas field, Turkmenistan), tmgaz‑server[.]com (Türkmengaz), tm‑mfa[.]com (Turkmenistan’s Ministry of Foreign Affairs), and tojiktelecomtj[.]com (Tojiktelecom, Tajikistan).
organisation Turkmenistan’s Ministry of Foreign Affairs
Examples include help.galkynysh[.]net (Galkynysh gas field, Turkmenistan), tmgaz‑server[.]com (Türkmengaz), tm‑mfa[.]com (Turkmenistan’s Ministry of Foreign Affairs), and tojiktelecomtj[.]com (Tojiktelecom, Tajikistan).
organisation SilkParasite Infrastructure
SilkParasite Infrastructure: SpiceRAT Servers Tied to Energy and Government Targets Across Central Asia.
organisation NomadRAT
Hunt.io links SpiceRAT, NodeEdgeRAT and NomadRAT to a four-year SilkParasite campaign targeting governments and critical sectors in Central Asia.
organisation SilkParasite
Hunt.io links SpiceRAT, NodeEdgeRAT and NomadRAT to a four-year SilkParasite campaign targeting governments and critical sectors in Central Asia.
organisation DNS
Passive DNS and subdomain enumeration push the timeline back to mid‑2022, suggesting this isn’t a new campaign with a fresh brand—it’s a longer‑running operation now labeled SilkParasite.
infrastructure 3,000 servers
The issuer alone isn’t an indicator—nearly 3,000 servers host TLC certificates—but a domain‑validated cert spoofing a Central Asian state entity from a China‑based CA does suggest a deliberate procurement channel.
organisation Bitdefender attributed evo.hoster‑kg[.]com
For example, help.hoster‑kg[.]com (on 193.29.58[.]192) presented the same railway‑spoofing certificate, while Bitdefender attributed evo.hoster‑kg[.]com to NodeEdgeRAT; the two are linked through shared registration of hoster‑kg[.]com, not a shared server.
organisation hoster‑kg[.]com
For example, help.hoster‑kg[.]com (on 193.29.58[.]192) presented the same railway‑spoofing certificate, while Bitdefender attributed evo.hoster‑kg[.]com to NodeEdgeRAT; the two are linked through shared registration of hoster‑kg[.]com, not a shared server.
organisation kg.tdtu[.]org
Similarly, kg.tdtu[.]org shares a parent domain with mineconom.tdtu[.]org, a NomadRAT C2 indicator in the SilkParasite report.
organisation SilkParasite Infrastructure Links SpiceRAT
SilkParasite Infrastructure Links SpiceRAT to Central Asian Targets.
organisation Guy Yasur
Hunt.io and researcher Guy Yasur have traced a tight cluster of SpiceRAT command‑and‑control servers that predate and extend Bitdefender’s August 2026 SilkParasite report.
organisation Bitdefender’s August 2026
Hunt.io and researcher Guy Yasur have traced a tight cluster of SpiceRAT command‑and‑control servers that predate and extend Bitdefender’s August 2026 SilkParasite report.
organisation SilkParasite’s
The work doesn’t dissect malware samples; it maps the network side of the operation with enough precision to tie three of SilkParasite’s seven RAT families (SpiceRAT, NodeEdgeRAT, and NomadRAT) through shared certificates, domains, and hosting patterns.
organisation Bitdefender’s SpiceRAT
A HuntSQL query on the page’s SHA‑256 hash returned exactly 13 hosts; three were already in Bitdefender’s SpiceRAT list, two more matched Hunt.io’s SpiceRAT signature, and the remaining eight extended the footprint through shared nginx versions and the same static page.
infrastructure 13 hosts
A HuntSQL query on the page’s SHA‑256 hash returned exactly 13 hosts; three were already in Bitdefender’s SpiceRAT list, two more matched Hunt.io’s SpiceRAT signature, and the remaining eight extended the footprint through shared nginx versions and the same static page.
organisation Bitdefender’s
Bitdefender’s SilkParasite report treated several RAT families as distinct, but Hunt.io’s network view shows they share parent domains and certificates.
threat_actor IndigoZebra
The infrastructure also mirrors IndigoZebra (Speccom), documented by Check Point in 2021 as targeting Central Asian ministries with similar domain patterns (mail, service, help) and overlapping naming conventions.
organisation IoC
The original Hunt.io post includes the full IoC tables and HuntSQL queries; linking to it is essential for precise awareness and for teams that want to reproduce the pivots.
organisation SecurityAffairs
“Organizations in the affected sectors and regions can make use of the above indicators and observations to assess their own exposure.” Follow me on Twitter:  @securityaffairs  and  Facebook  and  Mastodon Pierluigi Paganini ( SecurityAffairs  – hacking, SilkParasite)
‎September 17, 2026
Threat actors linked SpiceRAT to energy and government targets across Central Asia through SilkParasite infrastructure.
industry Government
General Document Context
industry Energy
General Document Context
industry Transportation
General Document Context
Tactical Metrics
Metrics
infrastructure
3,000
Servers
The issuer alone isn’t an indicator—nearly 3,000 servers host TLC certificates—but a domain‑validated cert spoofing a Central Asian state entity from a China‑based CA does suggest a deliberate procurement channel.
Metrics
infrastructure
13
Hosts
A HuntSQL query on the page’s SHA‑256 hash returned exactly 13 hosts; three were already in Bitdefender’s SpiceRAT list, two more matched Hunt.io’s SpiceRAT signature, and the remaining eight extended the footprint through shared nginx versions and the same static page.
Intelligence Sources
Security Affairs 2026-09-17
AlienVault OTX 2026-09-16