China’s Cyber Chameleons: Mustang Panda Unleashes LOTUSLITE v1.1 on India and South Korea

It started with an innocent-looking email-one that most would never suspect. A "Request for Support" file, seemingly from a trusted bank, lands in an employee’s inbox at a major Indian financial institution. Meanwhile, South Korean policy experts receive invitations from a respected American diplomat. But behind these digital masks lurks Mustang Panda, a notorious China-linked hacking group, now wielding a deadlier version of its signature LOTUSLITE backdoor. Their latest campaign is a chilling reminder: in cyber warfare, appearances are everything, and trust is a weapon.

Inside the Operation: Banking and Diplomacy under Siege

In March 2026, cybersecurity researchers uncovered a new Mustang Panda campaign targeting both the Indian financial giant HDFC Bank and policy experts in South Korea. The hackers deployed a malicious file named Request for Support.chm, designed to mimic official bank communications. When activated, it triggered a deceptive pop-up window referencing HDFC Bank Limited, luring employees into a dangerous trap.

But the real payload was hidden deeper. The file quietly downloaded a JavaScript malware, music.js, from a lookalike domain. While employees believed they were interacting with legitimate banking software, the updated LOTUSLITE v1.1 backdoor was quietly infiltrating their systems, granting the attackers covert access.

Meanwhile, in a parallel ploy, Mustang Panda impersonated Victor Cha, a prominent former US National Security Council official. Using a fake Gmail account complete with Cha’s photo, they sent Google Drive links containing booby-trapped invitation letters to South Korean policymakers, hoping to infect high-value diplomatic targets.

Technical Tricks: Old Tactics, New Disguises

One of Mustang Panda’s favorite weapons is DLL sideloading. By placing their malicious code beside a trusted Microsoft-signed executable, the attackers bypass standard security checks-after all, who would suspect a file signed by Microsoft? This sleight of hand allows LOTUSLITE to slip past defenses without raising alarms.

The group hasn’t stopped there. They’ve updated internal code markers (or “magic values”) and command flags to make their traffic harder to track, shifting from the familiar 0x8899AABB and –DATA to new values like 0xB2EBCFDF and –ZoneMAX. Communication with their command servers continues via services like Gleeze, a telltale sign linking these attacks to Mustang Panda’s previous campaigns.

Despite these upgrades, researchers found old code names and even a message left for a security analyst-proof that even the most sophisticated actors sometimes leave fingerprints behind.

The Human Factor: When Trust Is a Weakness

Mustang Panda’s campaign is a masterclass in social engineering. By blending technical sophistication with psychological manipulation-like impersonating trusted institutions and individuals-they exploit the weakest link: human trust. As their tools evolve, so must our skepticism. The next “official” email you receive could be the opening move in an international cyber espionage game.

WIKICROOK

• Backdoor: A backdoor is a hidden way to access a computer or server, bypassing normal security checks, often used by attackers to gain secret control.
• DLL sideloading: DLL sideloading is when attackers trick trusted programs into loading malicious helper files (DLLs) instead of the legitimate ones, enabling hidden attacks.
• Social engineering: Social engineering is the use of deception by hackers to trick people into revealing confidential information or providing unauthorized system access.
• Command and control server: A Command and Control Server is a remote computer that cybercriminals use to manage malware and receive stolen data from infected devices.
• JavaScript malware: JavaScript malware is harmful code that exploits browsers to steal data, redirect users, or install more malware, often without the user’s knowledge.