Loading malware…
MarsSnake is a Windows backdoor associated with UnsolicitedBooker, a China-aligned threat activity cluster active since at least March 2023. It collects system metadata, executes arbitrary commands, reads and writes files, and exfiltrates data, enabling remote control and information collection on compromised systems. It has been deployed against an international organization in Saudi Arabia and telecommunications organizations in Kyrgyzstan and Tajikistan.
Observed delivery chains use phishing emails containing malicious Microsoft Office documents whose macros deploy MarsSnakeLoader, which installs the backdoor. An alternative infection chain uses a Windows shortcut disguised as a Word document to execute a batch script and then a Visual Basic script, launching MarsSnake without a separate loader. UnsolicitedBooker has used MarsSnake alongside the distinct LuciDoor backdoor.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
12 distinct techniques documented for this family, organized by ATT&CK tactic.
“In some instances, attackers have used compromised routers as command-and-control servers.”
“...in at least one case, we observed the attackers using a hacked router as a C2 server...”
“Attacks typically begin with phishing emails containing malicious Microsoft Office documents.”
“As recently as January 2026... leveraged phishing emails... the messages embedded links to the decoy documents as opposed to directly attaching them.”
“...triggers the execution of a batch script to launch a Visual Basic Script...”
“...launch a Visual Basic Script, which then launches MarsSnake...”
“...instructs recipients to ‘Enable Content’ so as to run a malicious macro.”
“The starting point is a Windows shortcut that masquerades as a Microsoft Word document (*.doc.lnk) that triggers the execution of a batch script to launch a Visual Basic Script...”
“LuciDoor and MarsSnake are capable of collecting system information…”
“Written in C++, LuciDoor establishes communication with a command-and-control (C2) server...”
“...macro stealthily drops a C++ malware loader called LuciLoad that, in turn, delivers LuciDoor... used... MarsSnakeLoader to deploy MarsSnake.”
“…and exfiltrating data.”
12 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.