We are seeing reports that UnsolicitedBooker threatens Central Asian telecoms, targeting companies in Kyrgyzstan and Tajikistan as of 2026-02-24.
Threat Details
According to [email protected] (The Hacker News) first, the threat activity cluster known as UnsolicitedBooker has been observed targeting telecoms in Central Asia. Initially, it marked a shift from prior attacks aimed at Saudi Arabian entities. Subsequently, attackers deploy two distinct backdoors codenamed LuciDoor and MarsSnake. Specifically, these backdoors allow remote code execution and persistent access to network infrastructure.
Technical Analysis
Most importantly, the CVSS score for this vulnerability is unknown, but independent confirmations from Positive Technologies confirm its presence. In particular, the technical mechanism involves malicious scripts that bypass authentication controls and inject code into critical systems.
Background and Threat Evolution
In fact, similar past vulnerabilities involved backdoor injection in telecom software. As a result, the threat actor evolution has focused on high-value targets such as national communication networks.
Impact Assessment
Currently, approximately dozens of vulnerable systems across Kyrgyzstan and Tajikistan are affected, with potential data at risk including customer information, network traffic logs, and operational controls. Once attackers gain access, they can disrupt service delivery and compromise security protocols. Meanwhile, the threat actor attribution is unclear but likely linked to a known group that previously targeted Saudi entities.
Recommended Mitigation Steps
Immediately, you should update all telecom software to the latest security patches provided by vendors. Specifically, apply the latest firmware updates and disable any known backdoor functions. Next, monitor system logs for unusual activity and conduct thorough network scans. However, if updates are not available, consider applying temporary isolation measures such as firewall rules and disabling vulnerable ports. Additionally, after implementing mitigation steps, verify compliance with security standards and audit systems regularly.
Source
[email protected] (The Hacker News): https://thehackernews.com/2026/02/unsolicitedbooker-targets-central-asian.html
Get Expert Help
If you need assistance, visit defendmybusiness.com. Our solutions cover a range of security services to help protect your telecom infrastructure.
Related security updates: Targets U.S. Education and Healthcare with Dohdoor Backdoor: Immediate Mitigation Needed | Cross-Site XSS Threat – Patch Now | UFP Technologies Warns: Critical Cyberattack Stolen Medical Data – Act Now
