SilkParasite Deploys Five Novel Malware Families via Google Drive C2 Against Central Asian Economic Ministries

The campaign began with spear-phishing emails containing archived malicious Office documents impersonating regional ministries. Forensic analysis showed five previously unseen strains plus two known families, all executed in memory with minimal disk footprint. IP infrastructure mapped to Chinese telecommunications providers and at least one code overlap linked the toolkit to an established China-based espionage cluster.

Technical artifacts, including placeholder strings and code patterns, indicate selective AI assistance during development while core logic remained human-written. This matches patterns in two prior China-linked operations Bitdefender tracked against Europe and the South Caucasus over the same period. Russia’s reduced regional footprint appears to have accelerated Chinese collection against economic planning bodies.

The NSA’s concurrent advisory on AI-generated exploits for industrial control systems suggests state actors are integrating language models into both reconnaissance and weaponization pipelines. Expect continued low-volume, high-precision tooling that blends commercial cloud services with custom implants to stay below network monitoring thresholds.