Critical

OctLurk and SilkLurk: newly identified tailored backdoors in cyber-espionage campaign in Central Asia

Securelist

July 30, 2026 at 11:00 AM

Actively Exploited

Overview

Researchers have identified two new backdoors, named OctLurk and SilkLurk, that are primarily operating in memory and targeting systems in Central Asia. These malicious tools are capable of injecting plugins to perform various harmful actions, including launching shells, scanning networks, dumping credentials, and logging keystrokes. The discovery raises concerns about the potential for espionage and data theft in the region. Organizations that operate within Central Asia should be aware of these threats and take precautions to protect their systems. Given the nature of these backdoors, they could pose significant risks to sensitive information and operational security.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: OctLurk and SilkLurk backdoors targeting systems in Central Asia
Action Required: Organizations should implement strong network security measures, regularly update their systems, and monitor for unusual activity to mitigate the risks associated with these backdoors.
Timeline: Newly disclosed

Original Article Summary

Our experts discovered OctLurk and SilkLurk, backdoors operating primarily in memory, targeting Central Asia. They inject plugins to launch shells, scan networks, dump credentials, and keylogging.

Impact

OctLurk and SilkLurk backdoors targeting systems in Central Asia

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Organizations should implement strong network security measures, regularly update their systems, and monitor for unusual activity to mitigate the risks associated with these backdoors.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Read Original Article

Related Coverage

CISA issues recommendations to federal agencies on open-source software security

CyberScoop

The Cybersecurity and Infrastructure Security Agency (CISA) has released new recommendations aimed at improving the security of open-source software used by federal agencies. This guidance includes best practices for managing vulnerabilities, particularly in open-weight AI models and the importance of timely patching. Experts in the field have expressed approval of these recommendations, noting that they address significant security concerns surrounding open-source software. The move is particularly relevant as more agencies adopt open-source solutions, which can be both beneficial and risky if not properly secured. By following CISA's advice, federal agencies can better protect their systems and data from potential threats.

Jul 30, 2026

DPRK-Linked macOS Malvertising Uses Fake Updates to Deliver Crypto-Stealing Malware

The Hacker News

Researchers have linked a new macOS malvertising campaign to North Korean actors, who are using deceptive tactics to deliver malware. The attackers redirect users to fake web pages that mimic legitimate macOS update screens, tricking them into thinking they need to install an update. Once users interact with these screens, malware is installed on their devices, specifically designed to steal cryptocurrency. This campaign is a continuation of the ongoing Contagious Interview campaign, raising concerns about the security of macOS users who may fall victim to these tactics. It serves as a reminder for users to be cautious of unexpected update prompts and to verify the legitimacy of software updates before proceeding.

Jul 30, 2026

What the FCC ban on foreign-made robot vacuums means for your Roomba

Read This Before You Buy That TV Streaming Stick

Krebs on Security

Security experts have raised significant concerns about generic TV streaming devices that offer unlimited content for a one-time fee. These devices not only risk your internet connection being rented out to strangers but are also involved in more sophisticated scams. A recent analysis reveals that these devices often impersonate mobile phones to click on ads on AI-generated websites, which is part of a larger scheme to defraud online merchants and advertising networks. This poses a risk not only to users' personal data but also affects the integrity of online advertising systems, potentially leading to financial losses for companies and advertisers. Users should be cautious about using such devices and consider the broader implications for their online security.

Jul 30, 2026

OpenAI's rogue agent didn't stop at Hugging Face - here's what we know

After the Break-In: What Attackers Do Once They're Already Inside

BleepingComputer

Attackers often continue their malicious activities after they gain access to a network, rather than halting their operations. A recent analysis by Huntress examined a real-world intrusion, revealing how these threat actors establish long-term control within compromised systems, disable security measures, and manipulate the environment to their advantage. The findings emphasize that cybersecurity defenders need to focus on identifying and addressing the original entry points of attacks instead of merely removing malware. This approach is crucial because understanding how attackers infiltrate systems can help prevent future breaches and improve overall security posture. Organizations must prioritize thorough investigations and proactive measures to safeguard their networks against these persistent threats.

Jul 30, 2026