The China-aligned threat actor known as UnsolicitedBooker has shifted its focus to target telecommunications companies in Kyrgyzstan and Tajikistan. Active since at least March 2023, the group has been observed using sophisticated phishing campaigns to deploy two distinct backdoors.

In late September 2025, attacks on Kyrgyz organizations began with phishing emails containing malicious Microsoft Office documents. When victims enabled macros, a loader called LuciLoad deployed the LuciDoor backdoor. Written in C++, LuciDoor can establish connections with command-and-control servers, collect system information, execute commands, and exfiltrate data. A second wave in November 2025 used a similar approach but deployed the MarsSnake backdoor via a different loader.

By January 2026, the campaign expanded to Tajikistan, using emails with malicious links rather than attachments. The attackers reverted to using LuciDoor, though with updated configurations. Researchers noted the use of rare tools of Chinese origin and observed that in at least one instance, the attackers used a compromised router as a command-and-control server. The malicious documents contained Russian text but had language settings indicating Chinese, Arabic, and English configurations.