Loading story…
A China-linked espionage group tracked as Mustang Panda targeted India’s banking sector and South Korean policy circles with an updated LOTUSLITE backdoor, according to Acronis Threat Research. In India, the attackers used HDFC Bank-themed .chm lure files that fetched a JavaScript payload from cosmosmusic[.]com, displayed fake banking pop-ups, and established persistence on infected systems. In South Korea, the operation used a fake Gmail account impersonating Victor Cha and malicious invitation documents hosted on Google Drive to target policy-makers and geopolitical experts.
Researchers said the newer LOTUSLITE v1.1 variant improves stealth through DLL sideloading with legitimate Microsoft-signed executables, runtime API resolution via ntdll.dll call chains, and altered network markers and command flags. Acronis attributed the campaign to Mustang Panda with moderate confidence, citing shared code lineage, reused infrastructure, overlapping command structures, use of Dynu Systems dynamic DNS, and recurring operational patterns linking the India and South Korea intrusions.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
In the South Korean targeting, the attackers impersonated Victor Cha using the Gmail account victorcha707@gmail.com and sent Google Drive links containing fake invitation letters for policy-makers. The lure used folders named 'March 30' as part of the infection attempt.
Acronis Threat Research Unit said the espionage campaign was first observed in March 2026, targeting India’s banking sector and South Korean policy circles. The activity used an updated LOTUSLITE backdoor and marked an expansion beyond the group’s earlier focus on U.S. government entities.
Acronis Threat Research Unit published research detailing the India and South Korea campaign, including LOTUSLITE v1.1 changes such as DLL sideloading, runtime API resolution, and modified protocol markers. The researchers attributed the activity to Mustang Panda with moderate confidence based on shared code lineage, reused infrastructure, command overlaps, Dynu Systems dynamic DNS usage, and recurring operational patterns.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
secureblink.com
Open sourceacronis.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A new **LOTUSLITE** backdoor campaign has targeted India’s banking sector using DLL sideloading with a legitimate Microsoft-signed executable, `Microsoft_DNX.exe`, to evade trust controls and endpoint defenses. Researchers said the malware was delivered through banking-themed archives and malicious `CHM` files containing a signed executable, a rogue DLL, and an HTML lure that prompts user interaction before fetching JavaScript from a remote server to extract and run the payload. The backdoor then connects over HTTPS to a dynamic DNS-based command-and-control server and enables remote shell access, file operations, and session management, behavior consistent with long-term espionage. Acronis researchers linked the activity with moderate confidence to the China-associated **Mustang Panda** cluster, citing shared infrastructure and operational patterns with earlier LOTUSLITE operations. Related artifacts show the same tooling was also used against South Korean policy and diplomatic circles and U.S. individuals focused on Korean Peninsula affairs, North Korea policy, and Indo-Pacific security, indicating a broader multi-front espionage effort. The latest variant also changes a C2 packet magic value from earlier versions, suggesting the malware remains under active development to reduce detection and expand targeting.
Jun 29, 2026
A targeted cyber-espionage operation has been reported against **U.S. government and policy-focused organizations**, using Venezuela-themed spear-phishing lures to deliver a custom backdoor dubbed **LOTUSLITE**. The activity has been attributed with *moderate confidence* to the China-aligned threat actor **Mustang Panda** (also tracked as *Earth Preta*, *HoneyMyte*, and *Twill Typhoon*), based on overlaps in tradecraft and infrastructure consistent with prior campaigns. The initial access method relies on a malicious ZIP archive named `US now deciding what’s next for Venezuela.zip`, which contains a legitimate executable (described as a renamed Tencent music streaming service binary, e.g., `Maduro to be taken to New York.exe`) and a malicious DLL `kugou.dll`. When the signed/legitimate executable is launched, it **DLL-sideloads** the malicious DLL, executing LOTUSLITE without requiring exploit-based intrusion; reporting characterizes the campaign as limited in scale but highly precise in targeting, and notes the implant is a custom C++ espionage tool with persistence mechanisms despite indications of relatively low development maturity in parts of the loader.
Jun 29, 2026
China-aligned espionage group **Mustang Panda** carried out two concurrent intrusion campaigns against Indian government entities and hydropower organizations, compromising systems used by senior administrative staff and seeking intelligence on India’s hydropower planning and defense ties with Taiwan. Researchers said the attacks relied on ZIP-based spear-phishing lures, DLL sideloading through legitimate signed binaries, and a malware chain involving **SHARDLOADER**, **MINIRECON**, and **ZOHOMURK**, with active beaconing observed in mid-June. The most notable tradecraft involved **ZOHOMURK** abusing **Zoho WorkDrive** as a covert command-and-control and data exfiltration channel using hardcoded OAuth credentials. Acronis attributed the activity to Mustang Panda with high confidence based on malware and code overlap, reused infrastructure, sideloading patterns, and the recurring typo `RunOnece`, and said it coordinated notification and remediation with **CERT-In**. Defenders were urged to hunt for indicators including `couldinstallup[.]com`, the scheduled task `SolidPDFPcl2Bmp`, suspicious Zoho user agents in non-browser processes, and persistence through `HKCU` Run keys.
Aug 8, 2026