Loading story…
A new LOTUSLITE backdoor campaign has targeted India’s banking sector using DLL sideloading with a legitimate Microsoft-signed executable, Microsoft_DNX.exe, to evade trust controls and endpoint defenses. Researchers said the malware was delivered through banking-themed archives and malicious CHM files containing a signed executable, a rogue DLL, and an HTML lure that prompts user interaction before fetching JavaScript from a remote server to extract and run the payload. The backdoor then connects over HTTPS to a dynamic DNS-based command-and-control server and enables remote shell access, file operations, and session management, behavior consistent with long-term espionage.
Acronis researchers linked the activity with moderate confidence to the China-associated Mustang Panda cluster, citing shared infrastructure and operational patterns with earlier LOTUSLITE operations. Related artifacts show the same tooling was also used against South Korean policy and diplomatic circles and U.S. individuals focused on Korean Peninsula affairs, North Korea policy, and Indo-Pacific security, indicating a broader multi-front espionage effort. The latest variant also changes a C2 packet magic value from earlier versions, suggesting the malware remains under active development to reduce detection and expand targeting.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Acronis reported that the new LOTUSLITE variant communicates with a dynamic DNS-based HTTPS command-and-control server and supports remote shell, file operations, and session management. Researchers also noted a changed C2 packet magic value, suggesting the malware had evolved to evade existing detection signatures.
Researchers assessed the campaign with moderate or medium confidence as linked to the China-associated Mustang Panda cluster based on shared infrastructure and operational behavior. The attribution connected the India-focused activity to prior LOTUSLITE espionage operations.
The campaign used a legitimate Microsoft-signed executable, Microsoft_DNX.exe, alongside a malicious DLL to sideload LOTUSLITE and evade trust-based defenses. Reporting also described delivery through lure files containing the executable, rogue DLL, and decoy content that triggered payload execution.
Acronis Threat Research Unit identified a new espionage campaign targeting India's banking sector with banking-themed lures. The operation delivered a new LOTUSLITE variant and showed the malware remained under active development.
Breakglass Intelligence reported three distinct malicious Microsoft Saved Console (.msc) kill chains using WebDAV and Cloudflare-hosted infrastructure, including PowerShell download execution, DLL sideloading via a copied msdtc.exe, and a GrimResource-style technique in MMC. The investigation also recovered a Rust-based Mythic 'coffee' agent DLL and encrypted loader, while assessing only low-to-medium confidence that the MSC campaigns were related to Mustang Panda's LOTUSLITE activity.
Acronis found related LOTUSLITE artifacts aimed at South Korean and U.S. diplomatic and policy communities, particularly people focused on Korean Peninsula affairs, North Korea policy, and Indo-Pacific security. This indicated the infrastructure and tooling were being reused beyond a single lure theme.
Before the newly reported activity, LOTUSLITE had been observed in campaigns using U.S.-Venezuela geopolitical themes. Those earlier operations were later used as a baseline for comparing the new malware variant and targeting expansion.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
community.gurucul.com
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourceintel.breakglass.tech
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A targeted cyber-espionage operation has been reported against **U.S. government and policy-focused organizations**, using Venezuela-themed spear-phishing lures to deliver a custom backdoor dubbed **LOTUSLITE**. The activity has been attributed with *moderate confidence* to the China-aligned threat actor **Mustang Panda** (also tracked as *Earth Preta*, *HoneyMyte*, and *Twill Typhoon*), based on overlaps in tradecraft and infrastructure consistent with prior campaigns. The initial access method relies on a malicious ZIP archive named `US now deciding what’s next for Venezuela.zip`, which contains a legitimate executable (described as a renamed Tencent music streaming service binary, e.g., `Maduro to be taken to New York.exe`) and a malicious DLL `kugou.dll`. When the signed/legitimate executable is launched, it **DLL-sideloads** the malicious DLL, executing LOTUSLITE without requiring exploit-based intrusion; reporting characterizes the campaign as limited in scale but highly precise in targeting, and notes the implant is a custom C++ espionage tool with persistence mechanisms despite indications of relatively low development maturity in parts of the loader.
Jun 29, 2026
China-aligned espionage group **Mustang Panda** carried out two concurrent intrusion campaigns against Indian government entities and hydropower organizations, compromising systems used by senior administrative staff and seeking intelligence on India’s hydropower planning and defense ties with Taiwan. Researchers said the attacks relied on ZIP-based spear-phishing lures, DLL sideloading through legitimate signed binaries, and a malware chain involving **SHARDLOADER**, **MINIRECON**, and **ZOHOMURK**, with active beaconing observed in mid-June. The most notable tradecraft involved **ZOHOMURK** abusing **Zoho WorkDrive** as a covert command-and-control and data exfiltration channel using hardcoded OAuth credentials. Acronis attributed the activity to Mustang Panda with high confidence based on malware and code overlap, reused infrastructure, sideloading patterns, and the recurring typo `RunOnece`, and said it coordinated notification and remediation with **CERT-In**. Defenders were urged to hunt for indicators including `couldinstallup[.]com`, the scheduled task `SolidPDFPcl2Bmp`, suspicious Zoho user agents in non-browser processes, and persistence through `HKCU` Run keys.
Jun 30, 2026
Darktrace linked a cyberespionage campaign targeting Asia-Pacific government entities to the Chinese state-aligned group **Mustang Panda**—also tracked as **Twill Typhoon** and **Earth Preta**—after observing the actor evolve its known `.NET` downloader **FDMTP** into a more modular backdoor. The updated framework reportedly supports plugin loading, updates, and persistence while hiding behind legitimate-looking Windows and developer-related processes, indicating a shift from a simple downloader to a more flexible remote access platform. Researchers said compromised hosts had been contacting spoofed domains impersonating CDN infrastructure associated with brands including **Yahoo** and **Apple** since September 2025, and that the attackers repeatedly paired legitimate Windows binaries with malicious DLLs to side-load FDMTP. In one April incident, a finance-sector endpoint fetched binaries, configuration files, and DLL components from **`yahoo-cdn.it.com`** over an 11-day period, underscoring the group's use of modular tooling, deceptive infrastructure, and adaptable persistence techniques in ongoing espionage operations.
Jun 29, 2026