Loading malware…
MarsSnakeLoader is a malware loader used by the China-aligned threat activity cluster UnsolicitedBooker to deploy the MarsSnake backdoor. It has been observed in phishing-led intrusion chains targeting telecommunications organizations in Kyrgyzstan and Tajikistan, with related activity linked to earlier targeting in Saudi Arabia. Delivery commonly begins with phishing emails containing malicious Microsoft Office documents; when opened, the documents prompt users to enable content, triggering macros that install MarsSnakeLoader, which then deploys MarsSnake. Reporting also notes a late November 2025 campaign using MarsSnakeLoader for MarsSnake delivery. The resulting MarsSnake backdoor is described as capable of system reconnaissance, harvesting system metadata, arbitrary command execution, reading and writing files on disk, and data exfiltration. The broader activity has shown tactical overlaps with Space Pirates, use of rare Chinese-origin tools, and in at least one case use of a compromised router as command-and-control infrastructure. No standalone indicators of compromise specific to MarsSnakeLoader are provided in the content.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
When opened, these documents trigger macros that deploy malware loaders like LuciLoad or MarsSnakeLoader, which then deliver the respective backdoors.
5 distinct techniques documented for this family, organized by ATT&CK tactic.
“Attacks typically begin with phishing emails containing malicious Microsoft Office documents.”
“…trigger macros that deploy malware loaders like LuciLoad or MarsSnakeLoader…”
“...instructs recipients to ‘Enable Content’ so as to run a malicious macro.”
“When opened, these documents trigger macros…”
“...macro stealthily drops a C++ malware loader called LuciLoad that, in turn, delivers LuciDoor... used... MarsSnakeLoader to deploy MarsSnake.”
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.