Case bitdefender-silkparasite-ai-ratsState actor AI opsUZ
SilkParasite: China-nexus Central Asia espionage with AI-assisted lures and RAT code
Bitdefender tracked seven RAT families, five new, in about 65 infections at Central Asian governments; two lures appeared AI-generated and malware such as GoginRAT carried leftover test code suggesting AI assistance.
MediumAttack using AIStatus: OngoingVerified case file
Open in the interactive mapCite this case
- Reported
- Aug 19, 2026
- Location
- UZ
- Target
- Government bodies in Uzbekistan, Turkmenistan and Kazakhstan
- Severity
- Medium
- Triggered by
- SilkParasite (China-nexus cluster)
- Actor type
- State-sponsored
- Reported loss
- None reported
- CVE
- None
What happened
Bitdefender tracked seven RAT families, five new, in about 65 infections at Central Asian governments; two lures appeared AI-generated and malware such as GoginRAT carried leftover test code suggesting AI assistance.
Impact: About 65 infection instances (upper bound), mostly in Asia.
Who triggered it
Actor: SilkParasite (China-nexus cluster)
Attribution: Bitdefender assesses China-nexus with medium confidence via SpiceRAT links to SneakyChef, China Unicom IPs and victimology; no single group named.
Motive: Espionage on economic decision-making bodies
How it happened
Attack vector: Archived lure documents evading gateways, DriveSilkRAT using a shared Google Drive folder for C2, plus CookiETagRAT, NomadRAT, GoginRAT, NodeEdgeRAT, SpiceRAT and BloodAlchemy
Root cause: AI-assisted workflow let a human-engineered operation spawn redundant RAT families in multiple languages
Timeline
- Initial detection at a Central Asian economic government body
- Bitdefender publishes SilkParasite report
Response
Bitdefender published IOCs and notified affected parties.
Current status: Ongoing
Sources (open in a new tab)
- Bitdefender Labs bitdefender.com
- Dark Reading darkreading.com
- BankInfoSecurity bankinfosecurity.com
Cite this case
SilkParasite: China-nexus Central Asia espionage with AI-assisted lures and RAT code. AI Threat Watch, case bitdefender-silkparasite-ai-rats, Aug 19, 2026. https://aithreat.io/cases/bitdefender-silkparasite-ai-rats/
Permanent link: https://aithreat.io/cases/bitdefender-silkparasite-ai-rats/