Scworld

UnsolicitedBooker Targets Telecoms in Central Asia with New Backdoors

First seen 25 Feb 2026, 21:11 UTC • Rescana

•86% similarity •32.7

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

The China-aligned APT group UnsolicitedBooker has intensified cyber-espionage operations against telecommunications companies in Kyrgyzstan and Tajikistan. The group has deployed two sophisticated backdoors, LuciDoor and MarsSnake, utilizing tailored spear-phishing campaigns to compromise these organizations. This marks a shift from their previous focus on Saudi Arabian targets.

ThreatCluster AI How this analysis works

Timeline

2023-03-01

UnsolicitedBooker identified as active threat actor

Recent

UnsolicitedBooker targets telecoms in Kyrgyzstan and Tajikistan

Recent

Deployment of LuciDoor and MarsSnake backdoors reported

Attack Flow

19 entities, 42 inferred relationships (STIX 2.1).

Threat Actor (3)

Mustang Panda
Space Pirates
UnsolicitedBooker

Technique (8)

Malware
Phishing
T1041 - Exfiltration Over C2 Channel
T1059.003 - Windows Command Shell
T1059 - Command and Scripting Interpreter
T1071 - Application Layer Protocol
T1566.001 - Spearphishing Attachment
T1566.002 - Spearphishing Link

Campaign (1)

UnsolicitedBooker Campaign

Malware (4)

LuciDoor
LuciLoad
MarsSnake
MarsSnakeLoader

Affected Platform (2)

Microsoft Office
Windows

Tool (1)

FTPlnk_phishing

Relationships

Mustang Panda uses LuciDoor
Mustang Panda uses LuciLoad
Mustang Panda uses MarsSnake
Mustang Panda uses MarsSnakeLoader
Space Pirates uses LuciDoor
Space Pirates uses LuciLoad
Space Pirates uses MarsSnake
Space Pirates uses MarsSnakeLoader
UnsolicitedBooker uses LuciDoor
UnsolicitedBooker uses LuciLoad
UnsolicitedBooker uses MarsSnake
UnsolicitedBooker uses MarsSnakeLoader
Mustang Panda uses FTPlnk_phishing
Space Pirates uses FTPlnk_phishing
UnsolicitedBooker uses FTPlnk_phishing
Mustang Panda uses Malware
Mustang Panda uses Phishing
Mustang Panda uses T1041 - Exfiltration Over C2 Channel
Mustang Panda uses T1059.003 - Windows Command Shell
Mustang Panda uses T1059 - Command and Scripting Interpreter
Space Pirates uses Malware
Space Pirates uses Phishing
Space Pirates uses T1041 - Exfiltration Over C2 Channel
Space Pirates uses T1059.003 - Windows Command Shell
Space Pirates uses T1059 - Command and Scripting Interpreter
UnsolicitedBooker uses Malware
UnsolicitedBooker uses Phishing
UnsolicitedBooker uses T1041 - Exfiltration Over C2 Channel
UnsolicitedBooker uses T1059.003 - Windows Command Shell
UnsolicitedBooker uses T1059 - Command and Scripting Interpreter
UnsolicitedBooker Campaign attributed to Mustang Panda
UnsolicitedBooker Campaign attributed to Space Pirates
UnsolicitedBooker Campaign attributed to UnsolicitedBooker
UnsolicitedBooker Campaign uses LuciDoor
UnsolicitedBooker Campaign uses LuciLoad
UnsolicitedBooker Campaign uses MarsSnake
UnsolicitedBooker Campaign uses MarsSnakeLoader
Mustang Panda related to T1071 - Application Layer Protocol
Mustang Panda related to T1566.001 - Spearphishing Attachment
Mustang Panda related to T1566.002 - Spearphishing Link
Mustang Panda related to Microsoft Office
Mustang Panda related to Windows

Community

Browse all →

Tracked Entities in This Story

Mustang Panda Space Pirates UnsolicitedBooker LuciDoor LuciLoad MarsSnake MarsSnakeLoader UnsolicitedBooker Campaign Microsoft Office Windows Critical Infrastructure Government Telecommunications

UnsolicitedBooker Targets Telecoms in Central Asia with New Backdoors

Ask AI about this cluster

Article Content

Timeline

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading

Tracked Entities in This Story