Loading story…
A targeted cyber-espionage operation has been reported against U.S. government and policy-focused organizations, using Venezuela-themed spear-phishing lures to deliver a custom backdoor dubbed LOTUSLITE. The activity has been attributed with moderate confidence to the China-aligned threat actor Mustang Panda (also tracked as Earth Preta, HoneyMyte, and Twill Typhoon), based on overlaps in tradecraft and infrastructure consistent with prior campaigns.
The initial access method relies on a malicious ZIP archive named US now deciding what’s next for Venezuela.zip, which contains a legitimate executable (described as a renamed Tencent music streaming service binary, e.g., Maduro to be taken to New York.exe) and a malicious DLL kugou.dll. When the signed/legitimate executable is launched, it DLL-sideloads the malicious DLL, executing LOTUSLITE without requiring exploit-based intrusion; reporting characterizes the campaign as limited in scale but highly precise in targeting, and notes the implant is a custom C++ espionage tool with persistence mechanisms despite indications of relatively low development maturity in parts of the loader.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Public reporting disclosed LOTUSLITE's persistence methods, command-and-control behavior, and capabilities, including use of a hard-coded C2 at 172.81.60.97 over port 443, WinHTTP communications, a Googlebot user-agent, a mutex, and remote shell and file-operation functions. Researchers also recommended mitigations such as blocking the C2 IP and monitoring for DLL sideloading and specific persistence artifacts.
Acronis Threat Research Unit linked the LOTUSLITE campaign with moderate confidence to the China-aligned group Mustang Panda based on tradecraft and infrastructure overlaps, including DLL sideloading patterns and use of legitimate executables. The reporting described the malware as a custom C++ espionage implant focused on persistence, remote tasking, and carefully selected high-value victims.
A targeted espionage campaign used Venezuela-themed spear-phishing lures, including a ZIP archive about U.S.–Venezuela relations, to target U.S. government and policy-related organizations. The operation relied on a legitimate Tencent-associated executable to sideload a malicious DLL that installed the custom LOTUSLITE backdoor.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
rescana.com
Open sourcesecurityonline.info
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A new **LOTUSLITE** backdoor campaign has targeted India’s banking sector using DLL sideloading with a legitimate Microsoft-signed executable, `Microsoft_DNX.exe`, to evade trust controls and endpoint defenses. Researchers said the malware was delivered through banking-themed archives and malicious `CHM` files containing a signed executable, a rogue DLL, and an HTML lure that prompts user interaction before fetching JavaScript from a remote server to extract and run the payload. The backdoor then connects over HTTPS to a dynamic DNS-based command-and-control server and enables remote shell access, file operations, and session management, behavior consistent with long-term espionage. Acronis researchers linked the activity with moderate confidence to the China-associated **Mustang Panda** cluster, citing shared infrastructure and operational patterns with earlier LOTUSLITE operations. Related artifacts show the same tooling was also used against South Korean policy and diplomatic circles and U.S. individuals focused on Korean Peninsula affairs, North Korea policy, and Indo-Pacific security, indicating a broader multi-front espionage effort. The latest variant also changes a C2 packet magic value from earlier versions, suggesting the malware remains under active development to reduce detection and expand targeting.
Jun 29, 2026
Kaspersky reported that a previously undocumented malware strain, **Lotus Wiper**, was used in targeted attacks against energy and utilities organizations in Venezuela, with activity spanning late 2025 into 2026. The operation used batch scripts including `OhSyncNow.bat` and `notesreg.bat` to coordinate execution across victim networks, weaken defenses, disable accounts and logins, alter `NETLOGON` share access, shut down network interfaces, and otherwise prepare systems for destructive action before launching the final payload. Researchers said the campaign appeared aimed at **critical infrastructure disruption** rather than extortion, with no ransom demand observed and indications the attackers likely understood the victim environments and may have maintained access for months before deployment. Once executed, Lotus Wiper was designed to make recovery extremely difficult or impossible by deleting restore points, clearing logs and USN journal entries, overwriting files, mounted volumes, and physical disks with zeroes, and repeatedly wiping sectors through low-level disk `IOCTL` operations. Kaspersky said the malware was uploaded from a machine in Venezuela and noted temporal overlap with broader regional tensions and a separate cyberattack that disrupted PDVSA delivery systems, though there is no public evidence that PDVSA itself was hit by Lotus. Defenders were advised to watch for precursor behaviors such as `UI0Detect` manipulation, mass account changes, disabled network interfaces, and suspicious use of tools like `diskpart`, `robocopy`, and `fsutil`, while maintaining validated offline backups.
Jun 29, 2026
Recent reporting highlights multiple **social-engineering-driven malware delivery** efforts that culminate in remote access and persistent compromise. In South Korea, attackers distributed **counterfeit adult games** via popular “webhard” file-sharing services; victims received a ZIP containing a decoy `Game.exe` launcher that stages additional components (`Data1.Pak`, `Data2.Pak`, `Data3.Pak`) and ultimately injects **QuasarRAT** (aka **xRAT**), enabling host profiling, keylogging, and unauthorized file transfer. The execution chain included masqueraded artifacts such as `GoogleUpdate.exe` and `WinUpdate.db`, with AES used to decrypt/extract shellcode prior to privilege escalation and RAT injection. Separately, a spear-phishing campaign weaponized news about a purported **Nicolás Maduro arrest** to deliver a **backdoor**: emails carried a ZIP with a lure executable (`Maduro to be taken to New York.exe`) alongside a malicious DLL (`kuguo.dll`) that abuses a legitimate KuGuo binary for execution. Post-run behavior included replication to `C:\ProgramData\Technology360NB`, persistence via an auto-start renamed binary (`DataTechnology.exe`), and C2 beaconing for tasking and configuration updates; researchers noted tradecraft consistent with **Mustang Panda** but said attribution was not yet confirmed. A separate research note described **GravityRAT** reemerging as a multi-platform RAT with expanded **Android** targeting (in addition to Windows/macOS), emphasizing mobile endpoints as increasingly high-value targets for data theft and persistent access, though it did not describe the same specific campaigns as the Windows-focused lures above.
Jun 29, 2026