Seven families, sixty-five machines

Bitdefender published its account of an espionage campaign it calls SilkParasite on 20 August. The operation ran for roughly a year and produced around 65 infections — a number worth pausing on, because it is small enough to be deliberate. Targets sat in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, Georgia and Kazakhstan. The researchers attribute the activity to China.

The tooling is the finding

Seven distinct malware families were identified, five of which had not been documented before. One, named DriveSilkRAT, used Google Drive for command and control — traffic to a service already present in almost every corporate environment, carrying instructions in among ordinary file synchronisation.

Five previously unseen families in a single campaign is a statement about resources rather than about sophistication. Building and maintaining that many toolsets across a year, for 65 machines, is an economics that only works when the targets are chosen rather than found.

Where the AI actually appears

Two of the phishing lures were assessed as machine-generated. That is the whole of it — the assistance is at the front door, in the text of the email, not in the malware or the movement afterwards. It is a useful corrective to the framing that tends to attach to these reports: generated prose removes the language tell that has historically given regional phishing away, and does nothing else.

What to look for

• Cloud storage endpoints used for control traffic, Google Drive included — volume and timing patterns rather than the destination itself.
• Long-dwell activity on a small number of hosts, which is what a 65-infection campaign over a year looks like from inside.
• Regional targeting as a scoping signal: organisations with operations or counterparties in Central Asia and the Caucasus are the relevant population here.
• Phishing triage that no longer leans on language quality, because that signal has now been priced out.