ShadowSilk Hits 36 Government Targets in Central Asia and APAC Using Telegram Bots

ShadowSilk has been attributed to a fresh campaign targeting government entities in Central Asia and the Asia-Pacific region, with Group-IB noting nearly three dozen victims and a focus on data exfiltration. The operation is run by a bilingual crew, with Russian-speaking developers tied to legacy YoroTrooper code and Chinese-speaking operators spearheading intrusions, creating a nimble, multi-regional threat profile, according to researchers quoted by Group-IB.

Victims span Uzbekistan, Kyrgyzstan, Myanmar, Tajikistan, Pakistan, and Turkmenistan, mostly government organisations, though some targets are in energy, manufacturing, retail and transportation.

ShadowSilk employs spear-phishing to drop password-protected archives that deliver a custom loader concealing C2 traffic behind Telegram bots, and persistence is achieved by modifying the Windows Registry. The group uses public exploits for Drupal (CVE-2018-7600 and CVE-2018-76020) and the WP-Automatic WordPress plugin (CVE-2024-27956), alongside tools such as FOFA, Fscan, Gobuster, Dirsearch, Metasploit and Cobalt Strike.

Their arsenal includes JRAT, Morf Project web panels, and a tool for stealing Chrome password storage, with payloads hosted on compromised websites, and post-exploitation tools like ANTSWORD, Behinder, Godzilla, and FinalShell. ShadowSilk has been observed paving the way for a Python-based RAT delivering data via a Telegram bot, while screenshots and webcam grabs are enabled by Cobalt Strike and Metasploit modules. According to Group-IB, ShadowSilk remains active and focused on government targets in Central Asia and APAC.