Loading malware…
LuciLoad is a C++ malware loader used by the China-aligned threat activity cluster UnsolicitedBooker. It has been observed in phishing-led intrusion chains targeting telecommunications companies in Kyrgyzstan and Tajikistan, and is associated with broader UnsolicitedBooker activity affecting organizations in Asia, Africa, and the Middle East, including prior targeting in Saudi Arabia. In observed campaigns, victims received phishing emails containing malicious Microsoft Office documents or links to decoy documents; when opened and macros were enabled, the documents dropped LuciLoad, which then delivered the LuciDoor backdoor. Decoy content included telecom-related tariff plan documents. The loader’s primary documented role is staging and deploying LuciDoor. LuciDoor, the payload delivered by LuciLoad, is described as communicating with a command-and-control server, collecting basic system information, exfiltrating it in encrypted form, executing commands via cmd.exe, writing files to the system, and uploading files. Related reporting also notes UnsolicitedBooker’s use of rare Chinese-origin tools, tactical overlaps with the Space Pirates cluster, and in at least one case the use of a compromised router as command-and-control infrastructure.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
When opened, these documents trigger macros that deploy malware loaders like LuciLoad or MarsSnakeLoader, which then deliver the respective backdoors.
5 distinct techniques documented for this family, organized by ATT&CK tactic.
“...target Kyrgyz organizations in late September 2025 with phishing emails containing a Microsoft Office document, which, when opened, instructs recipients to ‘Enable Content’ so as to run a malicious macro.”
“…trigger macros that deploy malware loaders like LuciLoad or MarsSnakeLoader…”
“...instructs recipients to ‘Enable Content’ so as to run a malicious macro.”
“When opened, these documents trigger macros…”
“...macro stealthily drops a C++ malware loader called LuciLoad that, in turn, delivers LuciDoor... used... MarsSnakeLoader to deploy MarsSnake.”
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.