Bitdefender Labs has detailed a China-nexus espionage campaign it calls SilkParasite, assessed at medium confidence, that spent months inside government bodies across Central Asia and Georgia. Researchers Marius Andrei Baciu, Gheorghe Adrian Schipor, and Victor Vrabie found the operation targeting officials who shape political and economic relationships in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, and Kazakhstan, delivered through malicious Microsoft Office documents packaged in archives to slip past email-gateway scanning.
The campaign matters beyond its regional targets because of what it reveals about how nation-state operators are actually using AI, as opposed to the more alarmist framing that circulates around the term. Bitdefender documented seven distinct remote access tool families, five of them never seen before, including one, DriveSilkRAT, that hides its command and control traffic inside Google Drive instead of a traditional server. Two of the strains, GoginRAT and NodeEdgeRAT, contain leftover test functions and placeholder strings, including a hardcoded field literally reading “change_this_key,” artifacts consistent with AI-assisted rather than AI-generated development.
That distinction is the original insight worth taking from this research: the tradecraft, evasion, and target selection remain professional, human-directed work, and AI shows up as a productivity aid inside that process rather than a replacement for it. As Bitdefender’s researchers put it, what SilkParasite’s toolset represents is “not a breakthrough in malware sophistication, but an optimization of the mediocre,” a useful corrective for defenders calibrating how much of their AI-threat budget belongs on fully autonomous attack tooling versus on catching operators who are simply moving faster. It is the same pattern this publication tracked in a Russia-linked campaign that skipped novel exploits entirely and in a fake Gemini installer that used AI branding as bait rather than as tradecraft: nation-state operators reaching for whatever shortens their timeline, AI included, without needing it to be sophisticated.
Source: Bitdefender
