Ptechhub
  • News
  • Industries
    • Enterprise IT
    • AI & ML
    • Cybersecurity
    • Finance
    • Telco
  • Brand Hub
    • Lifesight
  • Blogs
No Result
View All Result
  • News
  • Industries
    • Enterprise IT
    • AI & ML
    • Cybersecurity
    • Finance
    • Telco
  • Brand Hub
    • Lifesight
  • Blogs
No Result
View All Result
PtechHub
No Result
View All Result

Chinese Hackers Deploy MarsSnake Backdoor in Multi-Year Attack on Saudi Organization

The Hacker News by The Hacker News
May 20, 2025
Home Cybersecurity
Share on FacebookShare on Twitter


May 20, 2025Ravie LakshmananMalware / Cyber Espionage

Threat hunters have exposed the tactics of a China-aligned threat actor called UnsolicitedBooker that targeted an unnamed international organization in Saudi Arabia with a previously undocumented backdoor dubbed MarsSnake.

ESET, which first discovered the hacking group’s intrusions targeting the entity in March 2023 and again a year later, said the activity leverages spear-phishing emails using flight tickets as lures to infiltrate targets of interest.

“UnsolicitedBooker sends spear-phishing emails, generally with a flight ticket as the decoy, and its targets include governmental organizations in Asia, Africa, and the Middle East,” the company said in its latest APT Activity Report for the period ranging from October 2024 to March 2025.

Cybersecurity

Attacks mounted by the threat actor are characterized by the use of backdoors like Chinoxy, DeedRAT, Poison Ivy, and BeRAT, which are widely used by Chinese hacking crews.

UnsolicitedBooker is assessed to share overlaps with a cluster tracked as Space Pirates and an unattributed threat activity cluster that was found deploying a backdoor codenamed Zardoor against an Islamic non-profit organization in Saudi Arabia.

The latest campaign, spotted by the Slovak cybersecurity company in January 2025, involved sending a phishing email claiming to be from Saudia Airlines to the same Saudi Arabian organization about a flight booking.

“A Microsoft Word document is attached to the email, and the decoy content […] is a flight ticket that was modified but is based on a PDF that was available online on the Academia website, a platform for sharing academic research that allows uploading PDF files,” ESET said.

The Word document, once launched, triggers the execution of a VBA macro that decodes and writes to the file system an executable (“smssdrvhost.exe”) that, in turn, acts as a loader for MarsSnake, a backdoor that establishes communications with a remote server (“contact.decenttoy[.]top”).

“The multiple attempts at compromising this organization in 2023, 2024, and 2025 indicate a strong interest by UnsolicitedBooker in this specific target,” ESET said.

The disclosure comes as another Chinese threat actor tracked as PerplexedGoblin (aka APT31) targeted a Central European government entity in December 2024 to deploy an espionage backdoor referred to as NanoSlate.

Cybersecurity

ESET said it also identified DigitalRecyclers continued attacks on European Union governmental entities, making use of the KMA VPN operational relay box (ORB) network to conceal its network traffic and deploying the RClient, HydroRShell, and GiftBox backdoors.

DigitalRecyclers was first detected by the company in 2021, although it’s believed to be active since at least 2018.

“Likely linked to Ke3chang and BackdoorDiplomacy, DigitalRecyclers operates within the APT15 galaxy,” ESET said. “They deploy the RClient implant, a variant of the Project KMA stealer. In September 2023, the group introduced a new backdoor, HydroRShell, which uses Google’s Protobuf and Mbed TLS for C&C communications.”

Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.





Source link

Tags: computer securitycyber attackscyber newscyber security newscyber security news todaycyber security updatescyber updatesdata breachhacker newshacking newshow to hackinformation securitynetwork securityransomware malwaresoftware vulnerabilitythe hacker news
The Hacker News

The Hacker News

Next Post
Ireland sets out chip plan | Computer Weekly

Ireland sets out chip plan | Computer Weekly

Recommended.

2025 Channel Chiefs: The 50 Most Influential

2025 Channel Chiefs: The 50 Most Influential

February 4, 2025
Chinese robot vacuum cleaner company reveals model with an AI-powered arm

Chinese robot vacuum cleaner company reveals model with an AI-powered arm

January 5, 2025

Trending.

⚡ Weekly Recap: Oracle 0-Day, BitLocker Bypass, VMScape, WhatsApp Worm & More

⚡ Weekly Recap: Oracle 0-Day, BitLocker Bypass, VMScape, WhatsApp Worm & More

October 6, 2025
Cloud Computing on the Rise: Market Projected to Reach .6 Trillion by 2030

Cloud Computing on the Rise: Market Projected to Reach $1.6 Trillion by 2030

August 1, 2025
Stocks making the biggest moves midday: Autodesk, PayPal, Rivian, Nebius, Waters and more

Stocks making the biggest moves midday: Autodesk, PayPal, Rivian, Nebius, Waters and more

July 14, 2025
The Ultimate MSP Guide to Structuring and Selling vCISO Services

The Ultimate MSP Guide to Structuring and Selling vCISO Services

February 19, 2025
Translators’ Voices: China shares technological achievements with the world for mutual benefit

Translators’ Voices: China shares technological achievements with the world for mutual benefit

June 3, 2025

PTechHub

A tech news platform delivering fresh perspectives, critical insights, and in-depth reporting — beyond the buzz. We cover innovation, policy, and digital culture with clarity, independence, and a sharp editorial edge.

Follow Us

Industries

  • AI & ML
  • Cybersecurity
  • Enterprise IT
  • Finance
  • Telco

Navigation

  • About
  • Advertise
  • Privacy & Policy
  • Contact

Subscribe to Our Newsletter

  • About
  • Advertise
  • Privacy & Policy
  • Contact

Copyright © 2025 | Powered By Porpholio

No Result
View All Result
  • News
  • Industries
    • Enterprise IT
    • AI & ML
    • Cybersecurity
    • Finance
    • Telco
  • Brand Hub
    • Lifesight
  • Blogs

Copyright © 2025 | Powered By Porpholio