UnsolicitedBooker-Linked Campaigns Target Telecoms in Kyrgyzstan and Tajikistan
Summary
Researchers detail 2025–2026 campaigns targeting telecom companies in Kyrgyzstan and Tajikistan with phishing documents and LuciDoor or MarsSnake backdoors, and identify related activity in China and a compromised MikroTik router used as C2.
Key points
- The campaigns targeted telecommunications organizations in Kyrgyzstan in 2025 and Tajikistan in January 2026, using telecom-themed lures delivered by email attachments or links.
- Malicious documents prompted victims to enable macros, which deployed loaders and backdoors while disguising malware as legitimate Microsoft software.
- The attackers used LuciDoor and MarsSnake, which support remote command execution and file transfer; LuciDoor also attempts multiple routes to reach its C2 server.
- Researchers linked the activity’s tactics and tools to the UnsolicitedBooker group, while noting uncertainty about the group’s activity targeting China.
- At least one compromised MikroTik router was used as a command-and-control server.
- The investigation found MarsSnake samples associated with China and evidence that both UnsolicitedBooker and Mustang Panda used the FTPlnk_phishing tool.
Article Details
- Attack Vectors
- Spear-phishing emails targeted telecommunications organizations with malicious document attachments that prompted recipients to enable macros.
- A later campaign delivered a malicious document through a link in the email body.
- A China-related sample was delivered in an archive containing a shortcut file and hidden subdirectories; the shortcut launched a script that staged and executed the payload.
- A malicious PDH.DLL was used for DLL sideloading alongside a legitimate Microsoft file.
- Defensive Notes
- Treat unexpected email attachments and links, especially documents requesting that macros or content be enabled, as suspicious.
- Monitor for suspicious macro-driven file creation and execution in C:\ProgramData and user AppData locations, as well as DLL sideloading involving PDH.DLL.
- Monitor for unauthorized scheduled tasks, including a task named OneDrive Launcher, and unexpected executables named OneDriveLauncher.exe or explorer.exe.
- Investigate unusual outbound C2 connections, including proxy-mediated connections and traffic using HTTP POST.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | button[.]gdakdbysw[.]xyz | LuciDoor C2 domain used in the September Kyrgyzstan campaign. |
| IPV4 | 5[.]181[.]1[.]153 | IP associated with a sample and with the LuciDoor C2 domain used in the September campaign. |
| IPV4 | 81[.]70[.]28[.]71 | C2 server used by a MarsSnake sample identified in the China-related activity. |
| IPV4 | 93[.]157[.]106[.]75 | LuciDoor C2 server used in the January campaign. |
| SHA256 | 3c9e76eee8c813e2de16640504118550b18b21e4f951df47ef8914bb5b7a031b | SHA-256 of an archive containing the malicious PDH.DLL sample. |
| SHA256 | a3f223350e03fb7ae6ac4ddf170a94d40da0a525375b764d361a033af5ea15e8 | SHA-256 of a malicious PDH.DLL sample containing MarsSnake. |
| SHA256 | e6a28b3833384018bad60043c82bb4cfcce86a3418ece86ea0d71c7aac9ca22b | SHA-256 of a malicious document attachment used in the Kyrgyzstan campaign. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelLuciDoor and MarsSnake support sending files from the victim system to their C2 server.T1053.005 · Scheduled TaskLuciDoor can create a scheduled task named OneDrive Launcher to run LuciLoad at user logon.T1059.003 · Windows Command ShellBoth backdoors support command execution through cmd.exe, including command-shell sessions or reverse-shell functionality.T1204.002 · Malicious FileRecipients were prompted to enable macros in malicious documents, which then executed the attack chain.T1566.001 · Spearphishing AttachmentAttackers sent malicious document attachments in phishing emails to organizations in Kyrgyzstan.T1566.002 · Spearphishing LinkAttackers placed a malicious document-delivery link in the email body during the Tajikistan campaign.T1574.002 · DLL Side-LoadingThe November campaign used a malicious PDH.DLL alongside a legitimate Microsoft executable for DLL sideloading.T1620 · Reflective Code LoadingLuciLoad reflectively loads a PE module; MarsSnakeLoader also places its payload in executable memory and transfers execution to it.
People
Threat Actors
Mustang PandaThe article describes this group using the FTPlnk_phishing tool and reports a Thai police-targeting attack using a related LNK file.Space PiratesESET reported overlap between this group and UnsolicitedBooker.UnsolicitedBookerESET attributed MarsSnake-related activity to this group; the article assesses that the campaigns targeting CIS telecommunications organizations are similar to its activity.Vicious PandaA 2023 malicious document using a similar image was attributed to this group; the article reports no other observed overlap with UnsolicitedBooker.
Malware
Chinoxynot new. It also appeared in a 2023 malicious document attributed to the Vicious Panda group, where the Chinoxy backdoor was used. Even so, we did not observe any other overlaps between UnsolicitedBooker and ViciousLuciDoorThe campaigns used two different backdoors: LuciDoor and MarsSnake.LuciLoadPerfrom.exe is a loader that we named LuciLoad, based on its link to the next stage, the LuciDoor backdoor. When it runs, LuciLoad performs the following actions:MarsSnakeThe campaigns used two different backdoors: LuciDoor and MarsSnake.MarsSnakeLoaderAs with LuciLoad and LuciDoor, MarsSnake is delivered as a final payload by a dedicated loader, which we named MarsSnakeLoader.
Vendors
Products
Microsoft OfficeThe author likely used a Chinese-language installation of Microsoft Office, or they used a Chinese document template and did not clear the themeFontLang setting.Microsoft OneDriveThe executable uses a OneDrive icon.Microsoft Windowsserver over a direct TCP connection. If that fails, it reads the proxy address from Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer and tries to connect through the proxy using HTTP CONNECT,MikroTik RouterOSPolarSSL was renamed and continued as Mbed TLS in 2015. On MikroTik RouterOS, enabling www-ssl causes the system to generate a certificate that is signed by the built-in test CA from the Mbed TLS library, previously
Tools
Countries
ChinaWe also found MarsSnake samples linked to an attack targeting China. We cover that activity below.Hong KongWe pivoted on the same creation timestamp and Machine ID and identified about 40 additional malicious files. Most were in Chinese, and many were linked to targets in Hong Kong, mainland China, Taiwan, and South Korea.KyrgyzstanWe identified attacks targeting telecommunications companies in Kyrgyzstan and Tajikistan.Saudi ArabiaESET attributed MarsSnake-related activity to a threat group it named UnsolicitedBooker. ESET also reported overlap between this group and Space Pirates, and observed related activity targeting Saudi Arabia.South KoreaWe pivoted on the same creation timestamp and Machine ID and identified about 40 additional malicious files. Most were in Chinese, and many were linked to targets in Hong Kong, mainland China, Taiwan, and South Korea.TaiwanWe pivoted on the same creation timestamp and Machine ID and identified about 40 additional malicious files. Most were in Chinese, and many were linked to targets in Hong Kong, mainland China, Taiwan, and South Korea.TajikistanWe identified attacks targeting telecommunications companies in Kyrgyzstan and Tajikistan.Thailand