SecurityNot yet confirmed elsewhere1 publisher2 min readPublished Updated
Shared certificates and parent domains merge three SilkParasite RAT families into one cluster
Hunt.io mapped five SpiceRAT command-and-control servers active in mid-March 2026 and found a certificate spoofing Uzbekistan's state railway, issued by a Chinese state-funded CA, on hosts Bitdefender had filed under two other malware families.
The Watch · Security desk
What happened
- Hunt.io and researcher Guy Yasur found five SpiceRAT command-and-control servers active together in mid-March 2026 at different hosting providers in different countries, sharing hostnames, certificates and one cloned default web page.
- Shared parent domains and an identical TLS certificate connect those hosts to servers Bitdefender attributed to SpiceRAT, NodeEdgeRAT and NomadRAT, three of the seven families in its SilkParasite report.
- One certificate in the cluster impersonates Uzbekistan's state railway authority, presented as a domain-validated certificate on azure.uzrailwaystax[.]com.
- A HuntSQL search on the SHA-256 hash of a cloned RTX Corporation homepage served by one of the five servers returned exactly 13 hosts carrying the identical page.
- Domains in the cluster spoof named state bodies including Turkmenistan's Ministry of Foreign Affairs, Turkmengaz, the Galkynysh gas field and Tojiktelecom in Tajikistan.
Why it matters
- capability Hunt teams get pivots that outlive any build of the malware: a certificate, a domain registration record and a static page hash keep resolving after the RAT is recompiled and the samples change.
- constraint Blocking at the issuer is not usable here, because the CA's certificate population is far larger than the campaign, so detection has to key on the individual spoofing certificate.
- contradiction Bitdefender's seven separate families and Hunt.io's shared infrastructure cannot both drive the same tracking logic; the network view merges what sample analysis kept apart, and Hunt.io still declines to name one operator.
- decision Anyone running the SilkParasite indicator list as a blocklist now chooses between adopting the page hash and parent-domain pivots or working from a view that covers a minority of the known cluster.
The page that links the cluster is benign. Requests to ns2.asiainfo.it[.]com on 188.190.29[.]126 returned a full copy of RTX Corporation's homepage, navigation, subsidiary links and stock ticker included, and it contained no malicious code [10]. It was not unique to that server [10]. Hunt.io describes the clone as byte-for-byte identical wherever it lands, and its reuse across the cluster made it a fingerprint [12].
Of the 13 hosts the hash returned, three were already on Bitdefender's SpiceRAT list and two more matched Hunt.io's own SpiceRAT signature [11]. The remaining eight came in through shared nginx versions and the same static page [11]. Five were known, so one page hash returned 2.6 times as many hosts as sample-based attribution had [17].
Hunt.io gives two readings of the RTX clone: the page rendered cleanly and was grabbed as a convenient template, or it is a default deployment asset inside shared tooling [12].
Hunt.io traced the spoofing certificate to its issuer. "The certificate imitating the Uzbekistan railway entity was issued by TLC, a certificate authority wholly funded by CAICT, a Chinese state research institute under the Ministry of Industry and Information Technology," the report said [5]. Nearly 3,000 servers host TLC certificates, so the issuer narrows nothing by itself; Hunt.io's reading is that a domain-validated certificate spoofing a Central Asian state entity, bought from a China-based CA, points to a deliberate procurement channel [9].
The links between families are uneven in strength. help.hoster-kg[.]com, on 193.29.58[.]192, presented the same railway-spoofing certificate, and Bitdefender had attributed evo.hoster-kg[.]com to NodeEdgeRAT; the two are joined by shared registration of hoster-kg[.]com, not by a shared server [13]. kg.tdtu[.]org shares a parent domain with mineconom.tdtu[.]org, listed in the SilkParasite report as a NomadRAT C2 indicator [14]. Bitdefender treated the families as distinct [4]. Hunt.io stops short of naming one operator and says the pattern shows a support function or toolset shared across the campaign [15].
Bitdefender published the SilkParasite report in August 2026 [1]. The five servers Hunt.io logged together were active in mid-March, roughly five months earlier [7][18].
What to watch
- Whether Bitdefender revises the seven-family split now that three of them share certificates and parent domains.
- Whether TLC revokes the railway-spoofing certificate, and which CA the cluster buys from next.
- Whether the RTX homepage clone disappears from cluster hosts now that the page hash is published.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap+15
- Incentives40
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Hunt.io and researcher Guy Yasur traced a cluster of SpiceRAT command-and-control servers that predate and extend Bitdefender's August 2026 SilkParasite report.
ReportedSupportedSource: securityaffairs.com, summarising Hunt.io2 sources— create a free account to open themView cited source - [2]
The work does not dissect malware samples; it maps the network side of the operation, tying three of SilkParasite's seven RAT families (SpiceRAT, NodeEdgeRAT and NomadRAT) through shared certificates, domains and hosting patterns.
- [3]
Hunt.io report: "Shared parent domains and an identical TLS certificate connect this infrastructure to hosts Bitdefender attributed to SpiceRAT, NodeEdgeRAT, and NomadRAT, three of the seven malware families documented in the SilkParasite report."
ReportedSupportedSource: Hunt.io report, quoted by securityaffairs.com2 sources— create a free account to open themView cited source - [4]
Bitdefender's SilkParasite report treated several RAT families as distinct, but Hunt.io's network view shows they share parent domains and certificates.
- [5]
Hunt.io report: "The certificate imitating the Uzbekistan railway entity was issued by TLC, a certificate authority wholly funded by CAICT, a Chinese state research institute under the Ministry of Industry and Information Technology."
- [6]
In March 2026 Hunt.io identified five SpiceRAT command-and-control servers hosted by different providers and in different countries, linked through common elements including the same hostnames, TLS certificates and a cloned webpage used as the default page.
- [7]
The five SpiceRAT servers were 46.30.191[.]230, 188.190.29[.]126, 193.29.59[.]159, 31.58.220[.]250 and 171.22.16[.]187, active together in mid-March 2026 across multiple hosting providers and countries.
- [8]
One certificate impersonates Uzbekistan's state railway authority (azure.uzrailwaystax[.]com) and was issued by TLC DV TLS CA, a certificate authority wholly funded by CAICT.
- [9]
Nearly 3,000 servers host TLC certificates, so the issuer alone is not an indicator, but Hunt.io says a domain-validated certificate spoofing a Central Asian state entity from a China-based CA suggests a deliberate procurement channel.
- [10]
Requests to ns2.asiainfo.it[.]com on 188.190.29[.]126 returned a full copy of RTX Corporation's homepage, complete with navigation, subsidiary links and a stock ticker; the page contained no malicious code and was not unique to that server, but its reuse across the cluster made it a powerful fingerprint.
- [11]
A HuntSQL query on the page's SHA-256 hash returned exactly 13 hosts; three were already in Bitdefender's SpiceRAT list, two more matched Hunt.io's SpiceRAT signature, and the remaining eight extended the footprint through shared nginx versions and the same static page.
- [12]
Hunt.io offers two explanations for the RTX page: it rendered cleanly and was grabbed as a convenient template, or it reflects shared tooling where the clone functions as a default deployment asset; either way the report calls it a low-noise, high-precision signature, byte-for-byte identical wherever it lands.
- [13]
help.hoster-kg[.]com, on 193.29.58[.]192, presented the same railway-spoofing certificate, while Bitdefender attributed evo.hoster-kg[.]com to NodeEdgeRAT; the two are linked through shared registration of hoster-kg[.]com, not a shared server.
- [14]
kg.tdtu[.]org shares a parent domain with mineconom.tdtu[.]org, a NomadRAT C2 indicator in the SilkParasite report.
- [15]
Hunt.io says the findings do not prove a single operator but do show a support function or toolset shared across the campaign, and that pivoting on domains, certificates and hosting profiles can surface nodes sample-based analysis would miss.
- [16]
Cluster domains spoof specific ministries and state enterprises, including help.galkynysh[.]net (Galkynysh gas field, Turkmenistan), tmgaz-server[.]com (Turkmengaz), tm-mfa[.]com (Turkmenistan's Ministry of Foreign Affairs), tojiktelecomtj[.]com (Tojiktelecom, Tajikistan) and sanly.oilgas-tm[.]com (Turkmen energy).
- [17]
Five of the 13 hosts returned by the page hash were already attributed to SpiceRAT, leaving eight new ones, so the hash returned 2.6 times as many hosts as prior attribution had.
- [18]
The mid-March 2026 five-server cluster was active roughly five months before Bitdefender published the SilkParasite report in August 2026.
Sources
1 independent publisher whose own reporting we read for this story.
- securityaffairs.comSilkParasite Infrastructure Links SpiceRAT to Central Asian Targets
1 article · September 17, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.