Reported by 2 outlets

Timeline

1. update from gbhackers.com

   SilkParasite Uses Google Drive as C2 to Hide RAT Traffic Inside Trusted Cloud Services

   gbhackers.com · 53d ago · August 21st, 2026

   SilkParasite, a long-running cyberespionage operation targeting government bodies across Central Asia through a compact but highly mature arsenal of remote access trojans. Assessed with medium confidence as China-nexus activity, the campaign stands out for using Google Drive as a command-and-control channel, allowing malware traffic to blend into cloud activity that many enterprises inherently trust. The […] The post SilkParasite Uses Google Drive as C2 to Hide RAT Traffic Inside Trusted Cloud Services appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

2. update from cyberpress.org

   China-Nexus SilkParasite APT Deploys Five New RATs Against Central Asian Governments

   cyberpress.org · 53d ago · August 21st, 2026

   Researchers assess the activity as China-nexus with medium confidence, citing victim selection, shared malware tooling, infrastructure links, and tradecraft commonly associated with Chinese espionage activity. The campaign used seven remote access trojan (RAT) families. Five were previously undocumented and named DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, and NodeEdgeRAT. The other two families were SpiceRAT and BloodAlchemy, which is linked to the ShadowPad and Deed RAT lineage. The operation was discovered after a suspicious infection at a Central Asian government organization involved in economic decisions in late 2025. Months of investigation revealed a maintained campaign that had likely operated for nearly a year. SilkParasite Targets Central Asia SilkParasite targeted entities in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, Kazakhstan, and Georgia. Attackers used phishing emails containing malicious Microsoft Office documents, often hidden inside password-protected RAR archives. The documents launched macros that deployed malware through DLL sideloading. DLL sideloading lets attackers abuse trusted, signed applications to load a malicious DLL file stored in the same folder. Operator command activity by hour, in the operator’s inferred local time (UTC+8). Derived from server-side Google Drive timestamps on operator-issued commands (n = 37) (Source: bitdefender) SilkParasite used legitimate software from Calibre, ABBYY, Quick Heal, Windows Defender, and Mp3tag