The China-aligned threat actor UnsolicitedBooker has shifted to targeting telecommunications companies in Kyrgyzstan and Tajikistan using phishing emails that deploy the LuciDoor and MarsSnake backdoors. The group, active since at least 2023, uses rare tools of Chinese origin and has shown tactical overlaps with other clusters. Researchers note the group has alternated between using the LuciDoor and MarsSnake backdoors and has employed hacked routers as command-and-control servers.