New “LOTUSLITE” Backdoor Targets U.S. Government in Suspected Mustang Panda Campaign

A new espionage campaign targeting U.S. government entities has been uncovered, utilizing a custom backdoor dubbed LOTUSLITE. Researchers from the Acronis Threat Research Unit (TRU) have linked the activity with moderate confidence to the China-aligned threat group Mustang Panda, citing overlaps in tradecraft and infrastructure.

The campaign capitalizes on high-stakes geopolitical tensions, using a spear-phishing strategy that lures victims with documents related to U.S.-Venezuela relations.

The attack vector is classic but effective. The TRU team identified a malicious ZIP archive titled “US now deciding what’s next for Venezuela.zip”. While the scale of the campaign appears limited, the precise nature of the targeting—focused strictly on U.S. government and policy-related entities—raises the stakes regarding potential strategic impact.

According to the report, “This campaign reflects a continued trend of targeted spear phishing using geopolitical lures, favoring reliable execution techniques such as DLL sideloading over exploit-based initial access”.

Rather than using sophisticated zero-day exploits, the attackers relied on DLL sideloading, a technique frequently associated with Mustang Panda’s operations.

The infection chain involves a legitimate, signed executable—a launcher for a Tencent-owned music streaming service—which is used to sideload a malicious DLL file named kugou.dll. By placing the malicious DLL in the same directory as the trusted application, the attackers trick the legitimate program into running their code.

“The executable is used to sideload and execute the DLL, which functions as the primary backdoor, tracked as LOTUSLITE,” reads the report.

The payload, LOTUSLITE, is a custom C++ implant designed for espionage rather than financial gain. While researchers noted that the loader demonstrates “low development maturity” with minimal error handling, it possesses a decent persistence technique and supports remote tasking.

Once established, the backdoor communicates with a command-and-control (C2) server using a hard-coded IP address. To blend in with normal network traffic, it mimics legitimate web requests:

• It uses a Googlebot User-Agent string.
• It sets the referrer to Google and the Host header to a Microsoft domain.
• It utilizes a “magic” hex marker (0x8899AABB) to authenticate itself to the C2 server.

For persistence, the malware creates a directory in C:\ProgramData and adds a registry entry under the current user’s “Run” key, ensuring it executes every time the user logs in.

One of the more bizarre aspects of the analysis involves hidden messages within the malware’s export functions. The researchers found “developer-inserted messaging” that appears to reference national identity.

“One function includes text distancing the author from a Russian origin, while the other contains an explicit self-identification statement claiming Chinese identity”.

Acronis TRU assesses with moderate confidence that the campaign is attributable to Mustang Panda. This conclusion is not based on code reuse alone, but rather on behavioral patterns, including the delivery style, the separation of the loader and DLL, and the specific use of legitimate executables like the “KuGou” music player.

The discovery of LOTUSLITE serves as a reminder that advanced persistent threats (APTs) often rely on operational reliability over technical complexity. As the report concludes, “While the malware itself demonstrates limited technical sophistication, its selective targeting and contextual lure usage indicate deliberate victim selection”.

Related Posts:

• China-Linked Mustang Panda Targets Vietnamese Entities in Cyber Espionage Campaign
• Mustang Panda Backdoor Exposed: New ToneShell Malware Masquerades as Chrome to Spy on Gov’t & Military
• PANDA Banker Malware Attacks Bank Institutions, Cryptocurrency Trading Platforms, and Social Media
• ToneShell Backdoor Evolves With Anti-Analysis Tricks, Continues Targeting Myanmar
• Mustang Panda APT Uses Hidden DLL and EnumFontsW to Launch Stealthy Tibet-Themed Campaign

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy