Mustang Panda’s New LOTUSLITE Variant Targets India Banks, South Korea Policy Circles
Cybersecurity researchers have discovered a new variant of a known malware called LOTUSLITE that is distributed via a theme related to India’s banking sector. Acronis researchers Subhajeet Singha and Santiago Pontiroli said the backdoor communicates with a dynamic DNS-based command-and-control server over HTTPS and supports remote shell access, file operations, and session management. The use of LOTUSLITE was previously observed in spear-phishing attacks targeting U.S. government and policy entities using decoys associated with geopolitical developments between the U.S. and Venezuela.
The latest activity flagged by Acronis involves deploying an evolved version of LOTUSLITE that demonstrates incremental improvements over its predecessor, indicating the malware is being actively maintained and refined by its operators. The starting point of the attack is a Compiled HTML (CHM) file embedding the malicious payloads – a legitimate executable and a rogue DLL – along with an HTML page that contains a pop-up which prompts the user to click Yes. This step is designed to silently retrieve and execute a JavaScript malware from a remote server (cosmosmusic[.]com), whose primary responsibility is to extract and run the malware contained inside the CHM file using DLL side-loading. The DLL (dnx.onecore.dll) is an updated version of LOTUSLITE that communicates with the domain editor.gleeze[.]com to receive commands and exfiltrate data of interest.
The activity is attributed with medium confidence to a Chinese nation-state group tracked as Mustang Panda. Further analysis has uncovered similar artifacts designed to target South Korean entities, specifically individuals within the policy and diplomatic community. Acronis believes the group had been targeting certain entities belonging to the South Korean and U.S. diplomatic and policy communities, specifically those involved in Korean peninsula affairs, North Korea policy discussions and Indo-Pacific security dialogues. What stands out is the broadening of the group’s targeting, from U.S. government entities with geopolitical lures, to India’s banking sector through implants embedded with HDFC Bank references and pop-ups masquerading as legitimate banking software, and now to South Korean and U.S. policy circles through the impersonation of a prominent figure in Korean peninsula diplomacy.
This campaign represents a concerning evolution in nation-state espionage tactics. The pivot from purely geopolitical targeting to India’s banking sector suggests Mustang Panda is expanding its intelligence-gathering scope to include financial infrastructure – a shift that could signal preparation for future financial disruption or deeper economic intelligence collection. The continued refinement of LOTUSLITE demonstrates sustained investment in this malware family, and the use of spoofed Gmail accounts and Google Drive staging shows the group is adapting its delivery mechanisms to evade detection. The dual focus on financial and diplomatic targets in the Indo-Pacific region underscores the strategic importance of this geography to Chinese intelligence interests.
Click here for the original article.