Security4 dSeptember 17, 2026, 21:16

SilkParasite infrastructure links SpiceRAT to Central Asian targets

Hunt.io and researcher Guy Yassur linked C2 servers for SpiceRAT, NodeEdgeRAT and NomadRAT through shared domains, TLS certificates and hosting. The SilkParasite campaign has targeted government and critical-sector organizations in Central Asia since 2022, including Uzbekistan Railways and Turkmenistan's Foreign Ministry.

Security Affairs Open source

SilkParasite infrastructure links SpiceRAT to Central Asian targets

Five SpiceRAT C2 servers active since March 2026 across providers
Certificate impersonates Uzbekistan Railways, issued by CA under China's MIIT
Clone of RTX Corporation page found on 13 hosts by SHA-256 hash
Passive DNS dates the infrastructure to mid-2022

#SpiceRAT#SilkParasite#Hunt.io#Bitdefender

Sekoia uncovers Exvicy, a new ClickFix MaaS built on ErrTraffic code

Security

Cyberattack hits University of Munich, student data at risk

Security

TASK#STOMP Windows backdoor steals documents, Wi-Fi passwords and screenshots

Security

SilkParasite infrastructure links SpiceRAT to Central Asian targets

Sekoia uncovers Exvicy, a new ClickFix MaaS built on ErrTraffic code

Cyberattack hits University of Munich, student data at risk

TASK#STOMP Windows backdoor steals documents, Wi-Fi passwords and screenshots

CVE-2026-81657 in IBM Guardium: deserialization flaw rated 9.8