Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
4 IOCs
SpiceRAT C2 Infrastructure Linked to SilkParasite Attacks on Central Asian Government and Energy Sectors
Excerpt
Researchers have uncovered a wider command-and-control (C2) infrastructure cluster linked to SpiceRAT activity targeting government, energy, and telecommunications organizations across Central Asia. The investigation, conducted jointly with researcher Guy Yasur, tracked servers active from late 2025 through August 2026. The infrastructure overlaps with indicators published in Bitdefender’s August 2026 SilkParasite report, which documented suspected China-nexus activity in the…
Read the original report →Diamond Model
Adversary
Infrastructure(4)
Capability
Victim
Indicators of Compromise
Open the mindmap →4 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 46.30.191.230 | High | Score 58/100 | First seen |
| Domain | ns2.asiainfo.it.com | High | Score 58/100 | First seen |
| Domain | azure.uzrailwaystax.com | High | Score 58/100 | First seen |
| IP | 188.190.29.126 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…