China-Linked Hackers Shift Tactics: LOTUSLITE Malware Strikes Indian Banks, South Korean Policymakers

It began as a seemingly routine email-an innocuous attachment, a familiar banking reference, a prompt to click “Yes.” But behind this façade lurked a covert operation, targeting the digital vaults of Indian banks and the inboxes of South Korean policymakers. The culprit: Mustang Panda, a notorious China-linked cyber-espionage group, now deploying a newly sharpened weapon-an advanced variant of its LOTUSLITE backdoor malware.

Behind the Curtain: Mustang Panda’s Expanding Playbook

For years, Mustang Panda has been on the radar of threat analysts, infamous for its carefully crafted spear-phishing campaigns. Previously, the group targeted U.S. government and policy organizations, often exploiting hot-button geopolitical issues. But according to new research by Acronis, the group’s latest campaign marks a significant geographic pivot: India’s banking sector and South Korea’s diplomatic elite are now in the crosshairs.

The attack chain begins with a Compiled HTML (CHM) file, camouflaged as a legitimate banking resource-sometimes even referencing well-known institutions like HDFC Bank. When opened, the CHM file launches a pop-up, coaxing the user to click “Yes.” This seemingly harmless action triggers the silent download of JavaScript malware from a remote domain. The script’s main function: extract and execute a rogue DLL (dynamic link library), an updated version of the LOTUSLITE backdoor.

Once inside the system, LOTUSLITE establishes encrypted communication with its command-and-control (C2) server using HTTPS and dynamic DNS infrastructure. This allows the attackers to remotely execute commands, manage files, and siphon off sensitive information. The technical sophistication is notable-the malware is modular, actively maintained, and refined to evade detection.

Investigators have also linked similar tactics to attacks against South Korean policy and diplomatic communities. Here, the lure changes: emails impersonate influential figures in Korean peninsula diplomacy, delivered via spoofed Gmail accounts and Google Drive links. The operational goal remains the same-covert access, persistent surveillance, and extraction of high-value intelligence.

The Bigger Picture: Espionage Over Profit

Unlike financially motivated cybercrime, Mustang Panda’s campaigns are marked by strategic intelligence gathering. The group’s ability to adapt its social engineering ploys, update its malware, and shift geographic focus signals a persistent and well-resourced adversary. The ongoing refinement of LOTUSLITE highlights an alarming trend: nation-state actors are investing heavily in stealthy, multi-purpose backdoors that threaten critical sectors far beyond traditional government targets.

As the lines between finance, policy, and cyberwarfare blur, defenders face a formidable challenge-one that demands constant vigilance, robust user education, and relentless technical innovation.

WIKICROOK

• Backdoor: A backdoor is a hidden way to access a computer or server, bypassing normal security checks, often used by attackers to gain secret control.
• Command: A command is an instruction sent to a device or software, often by a C2 server, directing it to perform specific actions, sometimes for malicious purposes.
• DLL Side: DLL Side is a technique where attackers trick programs into loading malicious DLL files, bypassing security and gaining unauthorized access or control.
• Dynamic DNS: Dynamic DNS updates domain records with changing IPs, helping attackers hide servers by frequently altering their network locations.
• Spear: Spear phishing is a targeted cyberattack using personalized emails to trick specific individuals or organizations into revealing sensitive information.

With Mustang Panda’s latest campaign, the message is clear: the cyber-espionage landscape is evolving, and so must our defenses. The digital shadows grow longer, but so too does our resolve to expose them.