Emerging APT Threats in Central Asia: Advanced Malware Techniques and Targeted Operations

Introduction

In early 2026, advanced persistent threat (APT) groups have intensified operations in Central Asia, deploying sophisticated malware techniques that challenge traditional defense mechanisms. This briefing examines recent activities, focusing on novel malware families, reverse engineering findings, polymorphic ransomware, rootkits, fileless malware, and command-and-control (C2) infrastructure analysis.

UnsolicitedBooker APT's Targeted Attacks

The UnsolicitedBooker APT has been active in Central Asia, particularly targeting telecommunications providers in Kyrgyzstan and Tajikistan. Their exploitation methods include spear-phishing with telecom-themed lures, Office macros, and LNK-based payloads. Notably, they deploy custom-developed malware such as LuciDoor and MarsSnake backdoors, utilizing compromised routers for C2 communications, demonstrating advanced operational security and persistence. (rescana.com)

Speccom's Spear-Phishing Campaigns

In July 2025, the Chinese-speaking APT group Speccom targeted the energy sector in Central Asia through spear-phishing emails containing malicious macros. These emails, appearing to originate from a compromised government organization, led to the deployment of backdoors, facilitating unauthorized access and data exfiltration. (ics-cert.kaspersky.com)

Advanced Malware Techniques

• Polymorphic Ransomware: APT groups are increasingly utilizing polymorphic ransomware, which changes its code to evade detection by traditional signature-based defenses. This adaptability allows malware to persist longer within networks, increasing the potential impact of attacks.

• Rootkits: The deployment of rootkits enables attackers to maintain privileged access to compromised systems, often remaining undetected by conventional security measures. These tools facilitate continuous surveillance and data exfiltration.

• Fileless Malware: Fileless malware operates in memory, leaving minimal traces on disk and making detection more challenging. APT groups employ this technique to execute malicious payloads without relying on traditional files, thereby evading many security solutions.

C2 Infrastructure Analysis

APT groups are leveraging legitimate platforms and cloud services for C2 communications and data exfiltration, including GitHub, Dropbox, Google Drive, Telegram, and Outlook. This strategy enhances operational security and complicates detection efforts. Additionally, the use of compromised routers for C2 communications has been observed, underscoring the importance of securing network infrastructure. (rescana.com)

Conclusion

The evolving tactics of APT groups in Central Asia, characterized by sophisticated malware techniques and strategic C2 infrastructure, pose a medium-level threat to regional cybersecurity. Organizations must adopt comprehensive security measures, including advanced threat detection systems and proactive monitoring, to mitigate these risks effectively.

Highlights:

• UnsolicitedBooker APT Targets Kyrgyzstan and Tajikistan Telecoms With LuciDoor and MarsSnake Backdoors
• APT and financial attacks, Published on Sunday, March 08