Mustang Panda-Linked LOTUSLITE v1.1 Targets Indian Banks and Korea Policy Circles
Summary
Acronis researchers detail LOTUSLITE v1.1 campaigns targeting India’s banking sector and South Korean/U.S. policy circles, describing DLL sideloading, CHM/JavaScript loaders and evasion changes. Attribution to Mustang Panda is assessed with moderate confidence.
Key points
- Researchers report LOTUSLITE v1.1 activity assessed as targeting India’s banking sector and South Korean and U.S. policy circles.
- A CHM file and JavaScript loader used hh.exe and ActiveX to extract and run files; the Microsoft-signed Microsoft_DNX.exe then loaded the malicious DLL through DLL sideloading.
- The implant retains LOTUSLITE’s command set and packet structure while changing its magic value and execution flag, resolving APIs dynamically, and modularizing persistence.
- The backdoor supports remote shell access, file operations and session management, and communicates with dynamic DNS-based C2 over HTTPS.
- Researchers link the variant to LOTUSLITE v1.0 through shared command IDs, persistence behavior, code artifacts and reused infrastructure; they assess Mustang Panda attribution with moderate confidence.
- A South Korea-focused lure reportedly impersonated policy figure Victor Cha through a spoofed Gmail account and Google Drive delivery.
Article Details
- Attack Vectors
- A CHM file believed to have been delivered through spearphishing prompted users to click a popup and led to a malicious JavaScript loader.
- The JavaScript used ActiveX controls and hh.exe to extract and execute files from the CHM archive.
- A crafted LOTUSLITE DLL was placed beside a legitimate Microsoft-signed executable, Microsoft DNX, which loaded it through DLL sideloading.
- A spoofed email address impersonating Victor Cha was used to deliver an archive to people assessed to be in the Korea policy and diplomatic community; Google Drive was used for staging.
- LOTUSLITE communicated with command-and-control infrastructure over HTTPS.
- Defensive Notes
- Monitor for Microsoft_DNX.exe loading an unexpected DLL from its own directory, including the article-listed sample hashes.
- Hunt for the identified C2 domain and loader host, as well as the reported Dynu-managed C2 IP.
- Inspect suspicious CHM files and JavaScript that use ActiveX and hh.exe to extract and run payloads.
- Monitor HKCU Run-key persistence and LOTUSLITE's runtime API-resolution behavior, which the article says was used to make static analysis harder.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | editor[.]gleeze[.]com | Dynamic DNS command-and-control domain hardcoded in the LOTUSLITE variant. |
| DOMAIN | www[.]cosmosmusic[.]com | Host reported as serving the malicious music.js loader. |
victorcha707@gmail[.]com | Spoofed sender address impersonating Victor Cha and used to deliver the campaign archive. | |
| IPV4 | 172[.]81[.]60[.]97 | Dynu-managed IP reported as C2 infrastructure for the earlier LOTUSLITE campaign. |
| SHA256 | 18bc0e0f627d90fb283aa243055b46d0bfb5d85a7240d8f63ec2d1c8a2c15893 | SHA-256 hash of the malicious Request_for_Support.chm delivery artifact. |
| SHA256 | 6d22d50634c2c2fc853bfd2b564e1837d51087aa684a9c4415634c8c13c44135 | SHA-256 hash of the malicious MARCH 30.zip delivery archive. |
| SHA256 | 7beede15ecdc7d3f01db4b699e5fe5f4f2e7c79cd7ef0e918ed0583bf621de7d | SHA-256 hash of the malicious dnx.onecore.dll sample. |
| SHA256 | 9bf2f3b15a621789f898f9bd7710ba857e3f238a4937b64fdc47ef9a92e0b05d | SHA-256 hash of a malicious Microsoft.WindowsAppRuntime.Bootstrap.dll sample. |
| SHA256 | af31ebe9085df408bedcf8f027fb60389897e5c8d3b0e9695fea29774f9d3aec | SHA-256 hash of the Microsoft_DNX.exe loader associated with the campaign. |
| SHA256 | cc0ff7e25ea686171919575916e2d9ebaeb5800a063f370a6980ea791f8851b8 | SHA-256 hash of kwpswnsserver.exe, reported as a renamed lure-associated executable. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe variant resolved APIs at runtime through an ntdll-based chain, keeping its import table clean to hinder static analysis.T1059.007 · JavaScriptThe malicious music.js file used JavaScript functions to drop and run the payload.T1071.001 · Web ProtocolsThe implant communicated with its C2 server over HTTPS, including TCP port 443.T1204.002 · Malicious FileA CHM popup prompted the user to click Yes, after which embedded HTML and JavaScript triggered ActiveX controls to extract and run files.T1218 · System Binary Proxy ExecutionThe campaign used a legitimate Microsoft-signed executable, Microsoft_DNX.exe, to load and execute the malicious DLL.T1547.001 · Registry Run Keys / Startup FolderLOTUSLITE used SHSetValueA to write a Run key under HKCU for persistence.T1566.001 · Spearphishing AttachmentThe report says Request for Support.chm was believed to have been delivered as a spearphishing attachment.T1574.001 · DLLThe LOTUSLITE DLL was placed alongside Microsoft_DNX.exe, which loaded it by name at runtime.
People
R3BELF0XThe article identifies R3BELF0X as an independent threat researcher publicly tracking Mustang Panda and UNC6384 campaigns; the malware contained the related reference goldenjackel12.Victor ChaThe campaign used a spoofed email address and his personal photo to impersonate him while targeting Korea policy and diplomatic circles.
Threat Actors
Malware
Vendors
Products
Countries
IndiaA new LOTUSLITE v1.1 backdoor variant was deployed in targeted campaigns against India’s banking sector and South Korean/U.S.South KoreaKorea policy, U.S.-South Korea relations and Indo-Pacific security.United StatesA new LOTUSLITE v1.1 backdoor variant was deployed in targeted campaigns against India’s banking sector and South Korean/U.S.