Loading story…
Researchers detailed LotusLite, a Windows backdoor linked by multiple technical indicators to activity long associated with Mustang Panda, though attribution remains disputed because some embedded references may be deliberate false flags. The malware was observed disguised as a WPS Office component and as a PDF-related file, installing under C:\ProgramData\WKwpsOffice2\, creating persistence through a Run registry key, and masquerading as a Microsoft runtime DLL. Analysts said the implant gives operators reverse shell access, directory listing, file writing and staging, and session control, while using anti-analysis techniques including dynamic API resolution, runtime string decryption, and command-line sandbox evasion.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On May 28, 2026, a later LotusLite update labeled version 7 changed the C2 API path to /info/faq/v7 and added new anti-China strings. ExaTrack says this version also showed reduced antivirus detections after the earlier sample became more widely detected.
An ExaTrack analysis covers a May 2026 LotusLite variant that masqueraded as a PDF-related component, persisted via the Run key under the value name DadaBank, and communicated with 103.79.77.181 using spoofed requests to forms.microsoft.com at /info/faq/v6. The sample shared multiple technical overlaps with earlier LotusLite reporting, including the same IP address, HTTP headers, magic value, dropper directory pattern, and command set, while changing the API path from v5 to v6.
A May 2026 writeup describes LotusLite as a newly documented Windows backdoor attributed to Mustang Panda and targeting financial entities in India, South Korea, and the United States. The malware used a WPS Office-themed installation path, Run-key persistence, and HTTPS C2 traffic to the /info/faq/v5 path with infrastructure tied to 103.79.77.181.
The 0x3oBAD writeup says infrastructure tied to LotusLite, including IP address 103.79.77.181, had a certificate reportedly issued in March 2026.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A new **LOTUSLITE** backdoor campaign has targeted India’s banking sector using DLL sideloading with a legitimate Microsoft-signed executable, `Microsoft_DNX.exe`, to evade trust controls and endpoint defenses. Researchers said the malware was delivered through banking-themed archives and malicious `CHM` files containing a signed executable, a rogue DLL, and an HTML lure that prompts user interaction before fetching JavaScript from a remote server to extract and run the payload. The backdoor then connects over HTTPS to a dynamic DNS-based command-and-control server and enables remote shell access, file operations, and session management, behavior consistent with long-term espionage. Acronis researchers linked the activity with moderate confidence to the China-associated **Mustang Panda** cluster, citing shared infrastructure and operational patterns with earlier LOTUSLITE operations. Related artifacts show the same tooling was also used against South Korean policy and diplomatic circles and U.S. individuals focused on Korean Peninsula affairs, North Korea policy, and Indo-Pacific security, indicating a broader multi-front espionage effort. The latest variant also changes a C2 packet magic value from earlier versions, suggesting the malware remains under active development to reduce detection and expand targeting.
Jun 29, 2026
A targeted cyber-espionage operation has been reported against **U.S. government and policy-focused organizations**, using Venezuela-themed spear-phishing lures to deliver a custom backdoor dubbed **LOTUSLITE**. The activity has been attributed with *moderate confidence* to the China-aligned threat actor **Mustang Panda** (also tracked as *Earth Preta*, *HoneyMyte*, and *Twill Typhoon*), based on overlaps in tradecraft and infrastructure consistent with prior campaigns. The initial access method relies on a malicious ZIP archive named `US now deciding what’s next for Venezuela.zip`, which contains a legitimate executable (described as a renamed Tencent music streaming service binary, e.g., `Maduro to be taken to New York.exe`) and a malicious DLL `kugou.dll`. When the signed/legitimate executable is launched, it **DLL-sideloads** the malicious DLL, executing LOTUSLITE without requiring exploit-based intrusion; reporting characterizes the campaign as limited in scale but highly precise in targeting, and notes the implant is a custom C++ espionage tool with persistence mechanisms despite indications of relatively low development maturity in parts of the loader.
Jun 29, 2026
A China-linked espionage group tracked as **Mustang Panda** targeted India’s banking sector and South Korean policy circles with an updated **LOTUSLITE** backdoor, according to Acronis Threat Research. In India, the attackers used **HDFC Bank**-themed `.chm` lure files that fetched a JavaScript payload from `cosmosmusic[.]com`, displayed fake banking pop-ups, and established persistence on infected systems. In South Korea, the operation used a fake Gmail account impersonating **Victor Cha** and malicious invitation documents hosted on Google Drive to target policy-makers and geopolitical experts. Researchers said the newer **LOTUSLITE v1.1** variant improves stealth through **DLL sideloading** with legitimate Microsoft-signed executables, runtime API resolution via `ntdll.dll` call chains, and altered network markers and command flags. Acronis attributed the campaign to Mustang Panda with moderate confidence, citing shared code lineage, reused infrastructure, overlapping command structures, use of **Dynu Systems** dynamic DNS, and recurring operational patterns linking the India and South Korea intrusions.
Aug 14, 2026