Pandas at the Vault: Chinese Cyber Spies Breach Indian Banks and Korean Policy Circles

When Chinese cyber spies go hunting, their prey is usually embassies, ministries, or think tanks-not the vaults of foreign banks. But in a twist that’s rattling security experts from New Delhi to Seoul, Mustang Panda, China’s infamous cyber-espionage crew, has been caught running a surprisingly low-effort but effective campaign against India’s banking sector and Korean policy elites.

Fast Facts

• Mustang Panda, a Chinese state-sponsored APT, has expanded its targets to include Indian banks and Korean policy circles.
• The group used spear-phishing emails and malware disguised as legitimate banking software.
• Victims triggered a DLL sideloading attack, granting attackers remote access via the LotusLite backdoor.
• Despite unsophisticated methods, the campaign successfully evaded many security defenses.
• Evidence suggests the motive is intelligence gathering, not financial theft.

Espionage on a Budget: Old Tricks, New Targets

Mustang Panda-also known as TA416, Bronze President, and Stately Taurus-has long been synonymous with Chinese geopolitical cyber-espionage. Their latest campaign, however, marks a strategic shift: Indian banks, especially HDFC Bank, and influential policy figures in Korea and the US have all found themselves in the crosshairs.

Researchers at Acronis uncovered the operation after spotting phishing attempts that, while far from sophisticated, were effective enough to lure victims into opening malicious attachments. In India, employees received emails masquerading as routine IT support requests. In Korea and the US, the attackers impersonated high-profile figures-like American political scientist Victor Cha-to target those involved in sensitive diplomatic circles.

Once a victim opened the booby-trapped file, a classic DLL sideloading technique took hold, quietly installing a modified version of Mustang Panda’s LotusLite backdoor. This tool allowed the attackers to sift through files, establish remote shells, and exfiltrate sensitive data-all while masquerading as legitimate banking software. Notably, the malware even used HDFC Bank’s name to further its disguise.

Why Espionage, Not Theft?

Unlike typical banking malware, LotusLite didn’t hunt for passwords or intercept transactions. Its capabilities were tailored for intelligence collection: mapping financial flows, tracking government-linked accounts, and probing cross-border transactions. For a state-backed actor like Mustang Panda, such access offers a goldmine of information on economic relationships and strategic infrastructure-data that can shape policy, negotiations, or even covert influence campaigns.

Experts warn that Mustang Panda’s success is less about technical wizardry and more about exploiting the basics organizations often overlook. Simple phishing and DLL tricks persist because many institutions, even those with formal security programs, still struggle with core defenses-leaving the door open for well-organized, if uninspired, adversaries.

Conclusion: The Danger of Underestimating Simplicity

Mustang Panda’s latest campaign is a wake-up call: even lazy tradecraft, in disciplined hands, can breach some of the most critical institutions in Asia. As the line between geopolitical and financial targets blurs, organizations must rethink not just their defenses, but their assumptions about where and why the next attack will land.

WIKICROOK

• APT (Advanced Persistent Threat): An Advanced Persistent Threat (APT) is a long-term, targeted cyberattack by skilled groups, often state-backed, aiming to steal data or disrupt operations.
• Spear: Spear phishing is a targeted cyberattack using personalized emails to trick specific individuals or organizations into revealing sensitive information.
• DLL Sideloading: DLL sideloading is when attackers trick trusted programs into loading malicious helper files (DLLs) instead of the legitimate ones, enabling hidden attacks.
• Backdoor: A backdoor is a hidden way to access a computer or server, bypassing normal security checks, often used by attackers to gain secret control.
• Exfiltration: Exfiltration is the unauthorized transfer of sensitive data from a victim’s network to an external system controlled by attackers.