SilkParasite Hid Its Spyware in a Google Drive Folder

Most espionage campaigns are caught by their infrastructure. Analysts find the command and control server, map the domains registered alongside it, and unravel the operation from there. SilkParasite was built to remove that thread. Its primary implant, DriveSilkRAT, used a shared Google Drive folder as its dead drop, which meant the traffic leaving a compromised government computer looked exactly like an employee syncing documents to a cloud account the organization already used every day.

Key Takeaways

• Bitdefender published its report on Operation SilkParasite in August 2026, attributing it to China based operators on the strength of overlaps with other Chinese espionage groups and IP addresses tied to Chinese telecommunications companies.
• The campaign hit government economic bodies in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, Georgia, and Kazakhstan, with 65 infections tracked in total.
• Researchers identified seven malware families in the operation, five of which had never been documented before.
• The main implant, DriveSilkRAT, used a shared Google Drive folder in place of a dedicated command and control server, blending its traffic into ordinary cloud usage.
• Initial access came from spearphishing email carrying malicious Microsoft Office documents packaged inside archives to slip past email gateway scanning, and two of the email lures were AI generated.

What Is Operation SilkParasite?

SilkParasite is the name Bitdefender gave to a cyber espionage operation that ran for close to a year before it was discovered, targeting government economic bodies across Central Asia and the Caucasus. The researchers reported 65 infections, concentrated in the Asia region, across Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, Georgia, and Kazakhstan.

The targeting is not random. Economic ministries in this belt of countries sit on trade negotiation positions, infrastructure financing terms, resource contracts, and the internal assessments that precede them. All six states sit along routes central to China's overland trade and energy interests, which makes their economic planning documents valuable well before any deal becomes public.

Bitdefender attributed the campaign to operators based in China, citing links to other China based espionage groups and IP addresses tied to Chinese telecommunications companies. Attribution of this kind is inferential rather than absolute, and the researchers presented it as an assessment built on overlapping tooling and infrastructure rather than a claim of certainty.

Why Does Using Google Drive as a Command Server Matter?

Because it removes the single most reliable way defenders find these campaigns. A conventional remote access trojan calls home to a server the attacker controls. That server has an IP address, a hosting provider, a registration record, and usually siblings — other domains registered by the same person, on the same day, with the same pattern. Finding one gives an analyst a thread to pull, and pulling it tends to expose the whole operation.

DriveSilkRAT has no such thread. It reads its instructions from, and writes stolen data to, a shared Google Drive folder. From a network monitoring perspective the compromised machine is talking to Google — the same destination it contacts for search, mail, and legitimate document sync. There is no suspicious domain to blocklist, no unusual hosting provider, and no certificate anomaly. Blocking the destination would mean blocking Google.

This technique, generally called living off trusted services, has been spreading across state aligned operations for several years, but seeing it as the backbone of an entire campaign's primary implant rather than a fallback channel is notable. It also shifts the detection burden. Defenders cannot rely on where the traffic goes; they have to look at which process is generating it, how often, and whether the account involved has any business relationship with the organization at all.

The wider set of tooling was substantial. Bitdefender documented seven distinct malware families across the operation, five of which had not previously been described publicly. That volume of bespoke, undocumented code is characteristic of a well resourced program rather than opportunistic crime, and it is consistent with what researchers have found in other long running state operations such as APT28's MacroMaze campaign across Europe.

How Did the Attackers Get In?

Through email, as is still the case in the overwhelming majority of state sponsored intrusions. The operators sent spearphishing messages carrying malicious Microsoft Office documents, with the lure documents impersonating government ministries so that a recipient inside an economic body would recognize the apparent sender and the subject matter.

One detail in the delivery is worth dwelling on: the malicious documents were packaged inside archives specifically to bypass email gateway scanning. Many gateways inspect attachments directly but handle nested archives inconsistently, particularly when they are password protected or use less common compression formats. Wrapping the payload is a decades old trick that continues to work because the inspection gap is structural rather than a bug any single vendor can patch.

Email remains the entry point for these operations even when the subsequent tradecraft is sophisticated. The same pattern appeared in Jewelbug's theft of 2,300 emails from a government webmail system and in the Zimbra zero click campaign that read 90 days of government mail. The inbox is where the perimeter actually is.

What Role Did AI Play?

A real one, but a narrower one than the framing usually suggests. Bitdefender found that two of the email lures were AI generated, and that AI had also assisted in parts of the malware development. That is a meaningful change in the economics of a campaign like this — fluent, contextually appropriate phishing text in Uzbek, Georgian, or Russian used to require either a native speaker on the team or a noticeably clumsy translation.

The researchers were careful not to overstate it. Bitdefender's own assessment was that "APT-grade malware like this remains firmly the work of human professionals." AI lowered the cost of the lure and helped with code, but the seven family toolkit, the trusted service architecture, and the year of quiet persistence are the product of a skilled team, not a prompt.

That distinction matters for anyone assessing their own threat model. The old heuristics for spotting a phishing email — broken grammar, odd phrasing, a translation that reads like a machine produced it — are now unreliable, because a machine produces better prose than most human attackers did. What has not changed is the structure of the attack: an unexpected document, an archive attachment, a sender whose address does not quite match the organization they claim.

Who Should Be Paying Attention?

Journalists, researchers, and NGO staff working on Central Asian trade, energy, and infrastructure policy are the obvious secondary population. Operations that penetrate economic ministries routinely sweep up the correspondence those ministries hold — including exchanges with reporters, consultants, and international organizations who never appear on the target list themselves but whose messages sit in a compromised mailbox all the same.

The practical guidance for that group has not changed much. Treat unexpected archive attachments as hostile regardless of who appears to have sent them. Verify document requests through a second channel. Assume that any message sent to a government address in a targeted region may be read by someone other than the recipient, and write accordingly. Individuals at elevated risk should also enrol in the platform level protections that exist for exactly this population — Apple's threat notifications reached targets in 110 countries this year, and Google runs a comparable program.

For defenders more broadly, SilkParasite is a clean argument for behavioral detection over destination blocklists. When the exfiltration path is a mainstream cloud service, the question stops being where the data went and becomes which process sent it, on whose authority, and why a workstation in an economic ministry is syncing to a Drive account nobody in the organization administers. The commercial spyware market that NCSC found operating in over 100 countries is pushing the same capability down to buyers with far smaller budgets.

Sources: The Record: China's SilkParasite espionage operation targeting Central Asia; Bitdefender Labs research on Operation SilkParasite, August 2026.