China's SilkParasite Campaign Deploys AI-Assisted Malware Against Central Asian Governments

Bitdefender disclosed a year-long Chinese espionage campaign called SilkParasite that deployed seven malware families across Central Asian government agencies in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, Georgia, and Kazakhstan. The operation used AI to generate phishing lures and assist malware development, with command-and-control routed through shared Google Drive folders to evade network monitoring.

The campaign's focus on economic ministries rather than defense or intelligence agencies suggests China is mapping the financial and trade infrastructure of Central Asian governments—a prerequisite for sanctions evasion, investment leverage, or supply-chain disruption. If SilkParasite has been running for a year with 65 documented infections mostly in Asia, the undetected dwell time in at least one government institution could span months; that exposure window is wide enough for credential harvesting, policy document theft, or preparation for influence operations ahead of elections or trade negotiations.

WHY IT MATTERS

China is operationalizing AI-assisted malware development at scale against state targets in a region where it has been expanding economic and political influence as Russian power recedes.

The campaign's use of Google Drive as a C2 channel demonstrates a shift toward leveraging mainstream cloud services that corporate and government monitors treat as benign traffic—a technique that forces defenders to choose between blocking legitimate productivity tools or accepting blind spots in their networks. Watch whether Central Asian governments respond by restricting Google Workspace access or implementing AI-detection layers in their email gateways; either move signals that the threat is being taken as state-level rather than routine espionage.

WHAT THIS DOESN’T TELL US

Did Bitdefender identify which specific Central Asian government institution was the initial infection vector, and does it hold strategic economic or energy-sector significance?

Fault Lines

Strategic intelligence, synthesized daily — with a public track record. Every call graded against what actually happened.

Front page → Get the weekly brief →