ShadowSilk hit 36 government targets using Telegram

ShadowSilk targeted 36 government entities in Central Asia and APAC in July, exfiltrating data using Telegram bots. The group, linked to YoroTrooper, SturgeonPhisher, and Silent Lynx, uses spear-phishing and exploits to gain access, employing Telegram bots to hide command-and-control traffic. Victims include organizations in Uzbekistan, Kyrgyzstan, Myanmar, Tajikistan, Pakistan, and Turkmenistan, with the operation potentially involving both Russian and Chinese-speaking actors.