ShadowSilk Unmasked: The Hybrid Espionage Group Targeting Central Asian Governments

ShadowSilk, also tracked as a hybrid espionage campaign overlapping with YoroTrooper, has been active since at least 2023 and remains active as of July 2025, according to Group-IB. The operation has targeted government institutions across Central Asia and the Asia-Pacific region, with over 35 victims identified, primarily in Central Asian governments such as Uzbekistan, Kyrgyzstan and Tajikistan.

It consists of two sub-groups and has Chinese and Russian speaking operators, a multilingual makeup that Group-IB describes as a hybrid nature blending different tradecraft. ShadowSilk’s arsenal includes public exploits, penetration-testing tools and dark web–sourced panels, with exploited CVEs including CVE-2018-7600, CVE-2018-7602 and CVE-2024-27956. Notably, attackers used Telegram bots as a command-and-control centre to issue commands, exfiltrate data and disguise traffic as normal messenger activity.

After a pause following January disclosures, Group-IB observed renewed activity and new infrastructure in June 2025, with additional government victims identified in Central Asia.