Back www.group-ib.com

ShadowSilk (Group-IB)

www.group-ib.com • October 14, 2026

This blog describes attacks on victims in Central Asia and APAC. Research into the attack has identified a group also called YoroTrooper. We also identified profiles of attackers on hacker forums, their malicious web-panels, test infections of attackers' own machines, and screenshots of attackers' desktops.

ShadowSilk is a threat cluster tracked by Group-IB that has targeted government organizations in Central Asia and APAC since at least 2023, with the aim of exfiltrating data.

In the fall of 2024, Group-IB analysts discovered a series of attacks targeting government organizations in countries across Central Asia and the Asia-Pacific region. Group-IB’s initial assessment revealed that the attacks have been ongoing since 2023 and remain active as of July 2025, based on the activity in the threat actor-controlled infrastructure.

The toolset and infrastructure overlap with those used in campaigns carried out by a group publicly known as YoroTrooper . Part of this activity was discussed in January 2025 as “Silent Lynx,” which Group‑IB tracked and internally designated as ShadowSilk .

Subsequent research showed a more nuanced profile and a larger‑than‑expected campaign with many previously unknown victims, leading Group‑IB to attribute the expanded activity to a threat cluster codenamed ShadowSilk. After the January disclosure of its activities , ShadowSilk abandoned much of its infrastructure. However , in June 2025, Group‑IB observed renewed activity and new infrastructure, identified additional government victims in Central Asia, and collected new IOCs.

In a joint operation, analysts from Group‑IB and CERT‑KG obtained a key image of the attackers’ server. Analysis uncovered multiple large‑scale attacks, detailed the group’s tactics, techniques, and procedures (TTPs), and revealed new information its composition, working languages, country of origin, and objective in every observed case: data exfiltration .

Group-IB Threat Intelligence Portal: ShadowSilk

Group-IB customers can access our Threat Intelligence portal for more information ShadowSilk.

Figure 1. ShadowSilk’s campaign largely focuses on countries and critical industries within Asia.

Tracing the Attacks to YoroTrooper – And Why It Might Be Just the Beginning

During the course of Group-IB’s investigation into the attacks conducted by ShadowSilk, we identified PowerShell code (below) that downloads payloads from and

These same URLs were previously mentioned by Cisco researchers in their report YoroTrooper. Notably: tpp[.]tj is a compromised legitimate website of Tajikistan gov agency that has been compromised.

In addition, we discovered a file named /www/html/gramm.ps1 on the ShadowSilk group’s server, containing the following code — the same script referenced in the previously mentioned research on YoroTrooper.

Figure 2. The contents of the file /www/html/gramm.ps1. Source: Cisco Talos

The Russian Connection

Analysis of the attackers’ server image also showed that the attackers use the Russian keyboard layout and sometimes make typos when entering commands,such as entering a command using the Russian layout:

We also observed a lot of activity that indicated that the attackers were testing malware capabilities on their own devices. For example, the attackers launched a Cobalt Strike Beacon on one of their devices:

We analyzed the accounts of the attackers in Telegram groups, as well as darknet forums, and concluded that the operators of the YoroTrooper group are fluent in Russian and use it as their native language. Our assessment indicates that Russian-speaking YoroTrooper are engaged in the development of malware and conducting attacks to ensure initial access.

The important discovery was a set of screenshots that captured the attackers’ workstations, operators, and other revealing details. Let’s start with screenshots of the attackers’ workstations:

Figure 3. A screenshot of the attackers’ workstation with an opened article PrintNightmare (CVE-2021-34527).

Figure 4. A screenshot of the attackers’ workstation showing a repository of Python implementation for PrintNightmare, and a running Struts2VulsTools – a Chinese language vulnerability scanner.

Figure 5. A screenshot of the attackers’ workstation showing an open gov website of the Kyrgyz Republic

Based on the above screenshots, the environment – such as visited pages, the active keyboard layout, and automatic translation of websites into Chinese – indicates that the device likely belongs to a Chinese-speaking operator. This discovery introduces a new Chinese-language dimension into our investigation. The data from the screenshots also allowed us to identify additional tools, as well as a connection with YoroTrooper.

New Campaign Activity Linked to Chinese-Language Operators: Jan 2025 to Present

Similarly, in the recently discovered ShadowSilk’s campaign (January-June 2025), compromised machines that contained what appears to be mail server dumps from two government entities of different countries were configured with a Chinese locale:

The specific machine is believed to be used for data exfiltration by the threat actors.

As mentioned earlier, following the discovery and exposure of some of the group’s infrastructure in late January 2025, ShadowSilk abandoned a significant part of it. However, in June 2025, Group-IB discovered new Telegram bots attributed to ShadowSilk with high confidence. One of the bots was created on 30 January, one week after their bots were exposed. The newly discovered campaign bears procedural and operational similarities with the previously identified ShadowSilk’s campaign.

Usage of Telegram bots to communicate with infected machines;

PowerShell commands sent via Telegram bots;

Commands for bot-machine interaction have been slightly modified, but strong similarities remain.

The following is the PowerShell script from ShadowSilk’s earlier campaign that was previously discovered:

The following is the PowerShell script from ShadowSilk’s new, and ongoing, campaign:

One of the attackers’ IP addresses that remained unchanged over the two campaigns, enabling us to link them together.

The attacker’s IP address used for the new and ongoing campaign:

The attackers’ IP address that was used in the previously discovered campaign:

ShadowSilk also made slight modifications to executable file names:

Based on the creation dates of the newly discovered bots, the campaign began in late January 2025, and remains active at the time of writing.

Commonalities Between the Two Groups

Analysis of desktop screenshots revealed identical victims between the two subgroups. Group-IB researchers identified a network of infections in Uzbek organizations based on data from YoroTrooper’s malware. The same victims were also found in screenshots associated with a Chinese-speaking operator, but in the context of network penetration and internal reconnaissance.

Figure 6. A screenshot of ShadowSilk’s reconnaissance notes with Chinese characters.

Figure 7. A screenshot of the attacker’s machine, displaying the Godzilla Webshell.

The most attentive readers found the username “mai”. Here, we compiled a list of file paths that we found on the server that contain this username:

As you can see from the contents of the aforementioned files, the user “mai” uses utilities such as:

ShadowSilk’s Arsenal – Toolset and Exploits

ShadowSilk uses a wide range of tools and exploits, including:

Vulnerabilities : CVE-2018-7600, CVE-2018-7602, CVE-2024-27956

Web application attack tools : sqlmap, wpscan

Reconnaissance tools : FOFA, Shodan, fscan, gobuster, dirsearch

Intrusion and control tools : Metasploit, Cobalt Strike, custom applications and scripts for gaining access based on Telegram bots, proxy utilities such as resocks, proxifier , chisel, rsocx. Chinese utilities Antsword , Godzilla webshell , WeblogicTool , FinalShell and SNETCracker . HTTP-Reverse-Shell, Drupalgeddon2.

Control panels JRAT and MORF Project for infected devices purchased on darknet platforms.

While analyzing an image of the attackers’ server, Group-IB researchers discovered a directory called “rat”, which contained the following directories:

Having analyzed these directories, we found that they contain code for web panels for managing bots (infected devices).

Web-panel—shell – Panel JLIB \ Panel JLIB

This panel has the following login form:

Figure 8. A screenshot of the login form to the JRAT control panel.

After logging in with valid credentials, the web panel displays a list of bots from the internal database, regardless of their current activity status. The screenshot shows a single infection, which appears to be a test instance used by the attackers.

Figure 9. A screenshot of the admin panel of JRAT.

This panel allows the attackers to upload files to the infected devices, as well as to execute malicious code on them.

Web Panel: Morf Project

The directory “Web-panel” contains another panel, which is different in style, but also allows attackers to execute commands and upload malicious files to infected devices.

Figure 10. A screenshot of the “Morf Project” login panel, found within the “Web-panel” directory.

Figure 11. A screenshot of the “Morf Project” web interface.

This directory does not contain the web panel, but serves as an intermediate server between the web panel and the infected device. It enables operators to receive connections from bots and transmit the data to the attackers’ malware panel, thereby reducing the likelihood of this panel being detected by researchers.

Figure 12. A screenshot of the Morf_server application code.

It is noteworthy that none of the panels have the ability to create malicious files. In addition, Group-IB researchers discovered that these panels are not developed by the attackers themselves, but were instead purchased from other users on XSS underground forum.

Tactics, Techniques and Procedures

During the reconnaissance phase, the attackers used public tools like Shodan and FOFA to gather data on targets of interest:

The attackers created and used Telegram bots as a command-and-control (C2) center, leveraging them to issue commands, exfiltrate confidential data, update malware modules, and disguise traffic as legitimate messenger activity.

This is made possible because many of Telegram’s features—though entirely legitimate—are well suited for command-and-control and data exfiltration tasks. For example, the Open Bot API and access tokens allow anyone to create a bot within a minute and control it via HTTPS/MTProto. As far as external observers are concerned, the resulting traffic appears as a regular request to Telegram.

This approach allows attackers to bypass traditional monitoring tools, and speeds up the execution of attack operations. The attackers also created the domains that were used in the attacks.

For initial access, the attackers used phishing emails designed to lure their victims into opening a password-protected archive, and running the executable contained within.

Figure 13. A screenshot of a phishing email from ShadowSilk.

As soon as the victim launches the binary, their device will be infected with malware that uses Telegram as its command-and-control channel. This allows the attackers to remotely execute commands and receive their execution results in real-time.

After gaining access to infected hosts via Telegram malware, the attackers download and launch additional malicious programs using the same channel.

To maintain persistence, the attackers deploy additional malicious tools and modify the Windows registry to ensure their binaries would automatically execute at system startup.

The attackers use the utility available at hxxps://github[.]com/peass-ng/PEASS-ng to identify persistence mechanisms, saved passwords in configuration files, and explore other ways of increasing their existing privileges.

The attackers use a custom tool – allegedly bought on a dark web forum – that steals Chrome password storage files, along with the decryption key located at “AppData\Local\Google\Chrome\User Data\Local State” to decrypt these storages. In addition, the attackers use the directory listing on the victims’ devices to find files that are of interest to them. For example, the attackers downloaded .txt and .xlsx files containing passwords from web services of their victims.

For internal reconnaissance purposes, the attackers used the fscan utility.

In addition, having gained access to the victims’ devices through the Telegram malware, the attackers use the ability to execute commands such as: Dir, ipconfig, whoami, systeminfo . The attackers also used Meterpreter in their attacks and executed commands such as:

These commands interact with the Windows Registry, specifically modifying or querying the UseLogonCredential value in the WDigest authentication settings. One of the commands enables WDigest authentication, which can be a security risk since it allows credentials to be stored in memory in plaintext. Another command checks whether UseLogonCredential is set and returns its value: a value of 1 indicates WDigest is enabled, while 0 or absence of the key means it is disabled.

The threat actors also used several more features from Meterpreter session:

The attackers use the built-in features of Cobalt Strike and Metasploit to capture screenshots as well as webcam pictures and internal mic records:

It has also been observed that the attackers were using the built-in kiwi utility in a Meterpreter session as well as some other built-in features:

As previously mentioned, the attackers use Telegram-based malware alongside Cobalt Strike and Metasploit, employing these tools as C2 infrastructure.Furthermore, the attackers downloaded reverse proxy tools such as rsocx, chisel resocks onto the compromised devices:

The threat actors then launch obfuscated PS-code on a compromised device, which looks like the following after decoding:

Searches for files on all available drives except C:\Users\Public\Pictures\Test. Copies only files with extensions .zip, .doc, .docx, .xls, .xlsx, .pdf, .txt. Excludes files with ~ at the beginning of the name and ESET.txt. Takes files modified in the last $days days. Saves a copy in C:\Users\Public\Pictures\Test.

Creates a ZIP archive with a backup copy (Deletes the old archive, if it exists. Archives the folder with backup files. Deletes temporary files after creating the archive.)

Uploads the archive to hxxps://pweobmxdlboi[.]com/iufhtyhgyfugj.php .Deletes the archive after sending.

How did Group-IB link ShadowSilk to YoroTrooper?

Group-IB found reused infrastructure, matching PowerShell download logic, and Telegram-bot scripts that had already appeared in prior public reporting on YoroTrooper. The reuse of compromised Tajikistan infrastructure and shared bot-control logic helped establish continuity, even though later research showed ShadowSilk to be broader than previously understood.

Group-IB’s analysis of the threat actors’ past and ongoing campaigns revealed significant overlaps between ShadowSilk and the YoroTrooper collective. However, the discovery of a distinct toolset, previously unidentified infrastructure, and new insights into the group’s profile led to the attribution of this activity to a separate threat cluster.

Recent behavior indicates that the group remains highly active, with new victims identified as recently as July. ShadowSilk continues to focus on the government sector in Central Asia and the broader APAC region, underscoring the importance of monitoring its infrastructure to prevent long-term compromise and data exfiltration.

It’s important to use email protection measures to prevent initial compromise through spear-phishing emails.

Observe any use of commands and built-in tools commonly used to collect information the system and its files.

Combine strict application control, patching, and high-fidelity MXDR analytics keyed to known malware artefacts.

Ensure that your security measures enable proactive threat hunting to identify threats that cannot be detected automatically.

Keeping your organization secure requires ongoing vigilance. Using a proprietary solution like Group-IB’s Threat Intelligence can enhance your security posture by providing teams with advanced insights into emerging cyber threats, enabling you to identify potential risks earlier and implement defenses more proactively.

Regular monitoring of relevant sections of the dark web and data leaks will help keep your finger on the pulse and enable you to adequately assess the current state of the organization’s security.

Frequently Asked Questions

ShadowSilk is an advanced persistent threat (APT) group active since at least 2023. Initially linked to YoroTrooper, the group was later identified as a distinct threat cluster by Group-IB due to its expanded toolset, infrastructure, and diverse victim profile.

What is the main motivation of ShadowSilk?

ShadowSilk’s operations focus on data exfiltration, aiming to steal sensitive government and organizational data.

Is ShadowSilk connected to YoroTrooper?

There is strong evidence that supports this connection. ShadowSilk shares tools, infrastructure, and historical overlap with YoroTrooper. However, Group-IB attributed the activity to a new cluster after uncovering new infrastructure, operational nuances, and a broader range of targets.

What are ShadowSilk’s main targets?

The group primarily targets government organizations and critical infrastructure in Central Asia and the Asia-Pacific (APAC) region, including Kyrgyzstan, Uzbekistan, Tajikistan, Turkmenistan, Pakistan, and Myanmar.

What tactics and techniques does ShadowSilk use?

ShadowSilk employs a variety of TTPs including:

Spear-phishing with password-protected archives Telegram bots for command and control Cobalt Strike and Metasploit for post-exploitation Custom PowerShell scripts Dark web-acquired malware panels (JRAT, MORF)

Spear-phishing with password-protected archives

Telegram bots for command and control

Cobalt Strike and Metasploit for post-exploitation

Custom PowerShell scripts

Dark web-acquired malware panels (JRAT, MORF)

Reverse proxies like resocks, rsocx, and chisel

What are the tools and exploits used by ShadowSilk?

ShadowSilk’s toolkit and exploits include:

Exploits for CVE-2018-7600, CVE-2018-7602, CVE-2024-27956

Recon tools: FOFA, Shodan, fscan

Web attack tools: sqlmap, wpscan

Webshells: Godzilla, Behinder

RATs: JRAT, MORF Project

Proxy utilities: chisel, resocks, rsocx

Telegram-based C2 malware

What languages do the ShadowSilk operators use?

ShadowSilk consists of Chinese and Russian-speaking subgroups. Russian-speaking members appear to focus on malware development and initial access, while Chinese-speaking operators handle post-exploitation and data collection.

Has ShadowSilk sold stolen data?

Yes. At least some data from ShadowSilk’s campaigns was found for sale on underground forums—data that had not been previously leaked.

What should organizations do if they suspect ShadowSilk activity?

Organizations that suspect ShadowSilk activity should monitor their environments for the provided indicators of compromise, including suspicious IPs, domains, and file hashes. They should inspect systems for the presence of Telegram-based command-and-control channels, review registry keys for persistence mechanisms, and analyze the use of PowerShell scripts and reverse proxy tools such as resocks and chisel. Additionally, signs of unauthorized web panel usage (e.g., JRAT, MORF) should be investigated. Proactive threat hunting and collaboration with threat intelligence partners are essential to detect, contain, and respond to potential intrusions linked to ShadowSilk.

Indicators of Compromise

Panel JLIB \ Panel JLIB – web-panel—shell

Panel Morf Project – web-panel

471e1de3e1a7b0506f6492371a687cde4e278ed8

ca12e8975097d1591cda08d095d4af09b05da83f

f385da641f2e506766a42dde81bb0fab13f845ee

fbbf624503001a981095356d1bd26bbf206a0df2

bcb1fd11b6b2f5046d4e5e8f714a8968d8a5d91d

ded2a5d2a7ebf3af1dc392c1af1e4b31fdc7cabc

0135f8420c61babee43625dbba2a23ef9a12477d

0279a25ee68fc23e91a353fbcd28f71c21e691fc

16bd4dc2befb4f64aaecf74818a347cd1a02c30d