New Backdoors Let Hackers Keylog, Steal Passwords and Control Government Computers

In Central Asia, two custom-built backdoors called OctLurk and SilkLurk have compromised government networks This article explores silklurk compromised. .

Indicators of Compromise (IoCs): - Type Indicator Description - Domain dns.ssentialserv[. ]xyz LurkProxy command-and-control domain - IP address 154.196.162[. ]76 LurkProxy command-and-control server - Domain dns.multitoconference[.

]com OctLurk command-and-control domain - Domain gycudore.kozow[. ]com PlugX command-and-control domain - Domain ctyuhjerf.kozow[. ]com SilkLurk command-and-control domain - IP address 64.7.198[. ]130 PlugX command-and-control address - MD5 6ecf84fb18f6747ed08d7598364d853a OctLurk deployment batch script - MD5 082d49ef9f14e6811d68c7e0e82e5069 OctLurk loader DLL - MD5 b874123a80fc4f40e06872b9cb54ebc6 LurkProxy deployment batch script - MD5 45cf5916fab4272a1313c26e67aa9220 Victim-fingerprinting batch script - MD5 4e6d5c4770d5a822d7fcce6a74f7ad73 Victim-fingerprinting batch script - MD5 32a5985543433a4f60da2fafd873b927 Credential-dumping executable - MD5 2a571f6cee42a17d873f4c942649813f Keylogger executable - MD5 37dc84e4bcad92fa28f1e7778d088283 Browser password decryptor - MD5 5e26df131ff0a679a0a2699b723b46e3 Remote-control agent deployment script - MD5 cf903e4a1629aa0582fd0363b5786676 Fscan network-scanning tool - MD5 3c9a1ba8e0c7475706adc6376e9d7b7c PlugX dropper - MD5 62944e26b36b1dcace429ae26ba66164 PlugX sideloaded executable - MD5 ef59aad625eebda8650aec5820d6ce69 PlugX loader DLL - MD5 be4731c09734da2e8eb6814a9c82f266 SilkLurk loader DLL - MD5 7c2f64461bb519c6cbf1fc687675514c OctLurk loader DLL - MD5 f4578e869a735cfad691f927bae3e638 OctLurk loader DLL - MD5 2f18472866f38c1e1c2c5c14b9a6ab56 SilkLurk loader DLL - Filename oleasapi.dll OctLurk loader DLL - Filename msbasesysdc.dll LurkProxy loader DLL - Filename Adobe.exe Credential-dumping utility - Filename OneDrive.dat SilkLurk payload file - Filename nvml.dll SilkLurk loader DLL - Filename vulkan-1.dll SilkLurk loader DLL - Filename RtkSmbusLoc.dll SilkLurk loader DLL - Filename RtkNGUI64Loc.dll SilkLurk loader DLL - Filename C.dll PlugX loader DLL - Filename C.dll.res PlugX payload file - Filename GoogleUpDate Malicious scheduled task name - Filename AnyDesk Keylogger scheduled task name - Filename NgcCIntSvc OctLurk malicious service - Filename Cusrxsrv LurkProxy malicious service - Filename RmSs SilkLurk persistence service Securely integrate your cybersecurity efforts by utilizing advanced threat intelligence solutions like MISP, VirusTotal, or your Security Information and Event Management (SIEM) system.