LOTUSLITE
LOTUSLITE is a custom C++ backdoor associated with the China-linked espionage cluster Mustang Panda, with reporting assessing the attribution at moderate to high confidence depending on the campaign. It has been used in targeted espionage operations against U.S. government and policy-focused organizations, India’s banking sector, and South Korean and U.S. diplomatic and policy communities. Reported lure themes include U.S.–Venezuela political developments, India banking/HDFC Bank themes, and Korean policy and diplomatic topics.
Observed delivery commonly relies on DLL sideloading with legitimate executables. In earlier campaigns, a ZIP archive such as "US now deciding what’s next for Venezuela.zip" contained a renamed legitimate Tencent KuGou executable (for example, "Maduro to be taken to New York.exe") that loaded a malicious DLL named kugou.dll. Additional reporting describes a related chain using a legitimate KuGou component (WebFeatures.exe) and a first-stage downloader DLL (libmemobook.dll), with persistence under C:\ProgramData\CClipboardCm\ and C:\ProgramData\WebFeatures. More recent LOTUSLITE activity targeting India used legitimate Microsoft-signed executables, including Microsoft_DNX.exe, to sideload an updated malicious DLL such as dnx.onecore.dll. Acronis also reported a CHM-based chain in which the CHM contained a legitimate executable, a rogue DLL, and an HTML lure that prompted the victim to click "Yes," after which JavaScript was fetched from cosmosmusic[.]com to extract and execute the payload.
LOTUSLITE capabilities consistently described across reporting include remote shell or remote command execution, file and directory enumeration, file manipulation/operations, session management or session control, beaconing, system and user profiling/enumeration, and data exfiltration. Multiple reports characterize the malware as espionage-focused rather than financially motivated. In the Venezuela-themed campaign, LOTUSLITE communicated with a hard-coded IP-based C2 at 172.81.60.97 over TCP/443 using WinHTTP, attempted to blend into benign traffic with a Googlebot User-Agent, Google referrer, Microsoft Host header, and a fixed session cookie, and used a custom protocol magic header 0x8899AABB. Later variants were reported to use dynamic DNS-based HTTPS C2 infrastructure and an updated packet magic value.
Persistence artifacts reported for LOTUSLITE include creation of C:\ProgramData\Technology360NB, renaming the launcher to DataTechnology.exe with a "-DATA" argument, and a Run key named Lite360 under HKCU\Software\Microsoft\Windows\CurrentVersion\Run. Other related persistence observed in later chains includes HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ACboardCm pointing to C:\ProgramData\CClipboardCm\SafeChrome.exe and HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ASEdge launching C:\ProgramData\WebFeatures\WebFeatures.exe -Edge. A global mutex Global\Technology360-A@P@T-Team was also reported.
High-confidence indicators mentioned in the content include kugou.dll, dnx.onecore.dll, libmemobook.dll, Microsoft_DNX.exe, WebFeatures.exe, the C2 IP 172.81.60.97, domains editor.gleeze.com and www.cosmosmusic.com / cosmosmusic[.]com, the compromised staging domain www.e-kflower[.]com, the path C:\ProgramData\Microsoft_DNX, and the persistence path C:\ProgramData\Technology360NB.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Three Attack Variants Observed GrimResource (CVE-2025-26633): XSS via apds.dll res:// protocol handler
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
This investigation examines the intersection of two active threat campaigns: (1) the LOTUSLITE backdoor attributed to Mustang Panda (Chinese APT)... LOTUSLITE Campaign (Mustang Panda) ... DLL sideloading: KuGou player loads kugou.dll (LOTUSLITE).
Techniques & procedures
19 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
3 techniquesThe use of LOTUSLITE was previously observed in spear-phishing attacks targeting U.S. government and policy entities using decoys associated with the geopolitical developments between the U.S. and Venezuela.
MITRE ATT&CK Mapping Tactic Technique ID Initial Access Spearphishing Attachment T1566.001
delivered via spoofed Gmail accounts and Google Drive staging
Execution
5 techniquesThe malware communicates with a dynamic DNS-based C2 over HTTPS and enables remote shell access, file operations, and session control, indicating espionage-driven objectives.
external.ExecuteShellCommand() calls powershell.exe with: -ExecutionPolicy Bypass -WindowStyle Hidden Downloads svchost.exe, executes from %TEMP% hidden.
"the downloader executes WebFeatures.exe via CreateProcessW."
The starting point of the attack is a Compiled HTML (CHM) file embedding the malicious payloads – a legitimate executable and a rogue DLL – along with an HTML page that contains a pop-up which prompts the user to click "Yes."
Persistence
1 techniquePrivilege Escalation
1 techniqueStealth
4 techniquesThe TRU team flagged the use of a Microsoft-signed executable as a deliberate tactic to bypass standard endpoint checks, since most security products extend implicit trust to Microsoft-signed files and rarely raise alerts based on their execution alone.
"the downloader decrypts embedded shellcode..."
Discovery
2 techniquesThe malware communicates with a dynamic DNS-based C2 over HTTPS and enables remote shell access, file operations, and session control, indicating espionage-driven objectives.
Command and Control
5 techniquesThe backdoor communicates with a dynamic DNS-based command-and-control server over HTTPS and supports remote shell access, file operations, and session management.
This step is designed to silently retrieve and execute a JavaScript malware from a remote server ("cosmosmusic[.]com")
The backdoor communicates with a dynamic DNS-based command-and-control server over HTTPS and supports remote shell access, file operations, and session management
The malware communicates with a dynamic DNS-based C2 over HTTPS and enables remote shell access, file operations, and session control, indicating espionage-driven objectives.
Exfiltration
1 techniqueThe DLL ("dnx.onecore.dll") is an updated version of LOTUSLITE that communicates with the domain "editor.gleeze[.]com" to receive commands and exfiltrate data of interest.
IOCs tracked for this family
14 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
LOTUSLITE is a backdoor used for espionage-oriented intrusions. In this report, it uses DLL sideloading with legitimate Microsoft-signed executables, communicates with a dynamic DNS-based C2 over HTTPS, and supports remote shell access, file operations, and session control.
An espionage-focused backdoor that communicates with dynamic DNS-based C2 over HTTPS and supports remote shell access, file operations, session management, and data exfiltration. The latest observed variant is delivered via CHM files and executed using DLL side-loading.
A backdoor used in espionage-focused campaigns that is delivered via DLL sideloading using a legitimate Microsoft-signed executable. It provides remote shell access, file operations, session management, and persistent access while communicating with C2 over HTTPS.
A backdoor malware family observed in a new variant themed around India's banking sector and delivered via DLL sideloading through a legitimate Microsoft-signed executable.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.