UnsolicitedBooker Targets Central Asian Telecoms With LuciDoor and MarsSnake Backdoors

The report describes China‑aligned APT "UnsolicitedBooker" shifting to target telecom providers in Kyrgyzstan and Tajikistan using phishing (malicious Word macros and LNK-based shortcuts) to deploy C++ loaders and backdoors (LuciDoor and MarsSnake) for reconnaissance and data exfiltration; it also documents related imitation campaigns (PseudoSticky) and other phishing attacks (Cloud Atlas) that exploit CVE-2018-0802 and deploy RATs like DarkTrack and Remcos.