UnsolicitedBooker

UnsolicitedBooker is a China-aligned threat activity cluster active since at least March 2023. The actor has targeted telecommunications organizations in Kyrgyzstan and Tajikistan and previously targeted entities in Saudi Arabia, with broader activity reported across Asia, Africa, and the Middle East. Reporting has also noted tactical overlaps with the Space Pirates cluster and similarities to tradecraft associated with Mustang Panda, but UnsolicitedBooker is tracked as a distinct cluster. The group commonly gains initial access through phishing emails delivering malicious Microsoft Office documents that prompt victims to enable macros. Those macros deploy loaders including LuciLoad and MarsSnakeLoader, which in turn install the LuciDoor or MarsSnake backdoors. Additional intrusion chains have used Windows shortcut-based lures and script execution to launch malware directly. UnsolicitedBooker’s malware supports system reconnaissance, command execution, file read and write operations, and data exfiltration. LuciDoor and MarsSnake have both been used as backdoors for post-compromise control of victim systems. The actor has also used rare Chinese-origin tooling and, in at least one case, compromised routers as command-and-control infrastructure. Some infrastructure and operational elements have been configured to mimic Russia, indicating an element of deception or false-flag tradecraft. Known malware associated with the cluster includes LuciDoor, MarsSnake, LuciLoad, and MarsSnakeLoader.