Cyber: Lotuslite Backdoor Targets U.s. Policy Entities Using...

Security experts have disclosed details of a new campaign that has targeted U.S. government and policy entities using politically themed lures to deliver a backdoor known as LOTUSLITE.

The targeted malware campaign leverages decoys related to the recent geopolitical developments between the U.S. and Venezuela to distribute a ZIP archive ("US now deciding what's next for Venezuela.zip") containing a malicious DLL that's launched using DLL side-loading techniques. It's not known if the campaign managed to successfully compromise any of the targets.

The activity has been attributed with moderate confidence to a Chinese state-sponsored group known as Mustang Panda (aka Earth Pret, HoneyMyte, and Twill Typhoon), citing tactical and infrastructure patterns. It's worth noting that the threat actor is known for extensively relying on DLL side-loading to launch its backdoors, including TONESHELL.

"This campaign reflects a continued trend of targeted spear phishing using geopolitical lures, favoring reliable execution techniques such as DLL side-loading over exploit-based initial access," Acronis researchers Ilia Dafchev and Subhajeet Singha said in an analysis.

The backdoor ("kugou.dll") employed in the attack, LOTUSLITE, is a bespoke C++ implant that's designed to communicate with a hard-coded command-and-control (C2) server using Windows WinHTTP APIs to enable beaconing activity, remote tasking using "cmd.exe," and data exfiltration. The complete list of supported commands is as follows -

LOTUSLITE is also capable of establishing persistence by making Windows Registry modifications to ensure that it's automatically executed each time the user logs in to the system.

Acronis said the backdoor "mimics the behavioral shenanigans of Claimloader by embedding provocative messages." Claimloader is the name assigned to a DLL that's launched using DLL side-loading and is used to deploy PUBLOAD, another Mustang Panda tool. The malware was first documented by IBM X-Force in June 2025 in connection with a cyber espionage campaign aimed at the Tibetan community.

"This campaign demonstrates how simple and well-tested techniques can still be effective when paired with targeted delivery and relevant geopolitical lures," the Singaporean cybersecurity company concluded. "Although the LOTUSLITE backdoor lacks advanced evasion features, its use of DLL sideloading, reliable execution flow, and basic command-and-control functionality reflects a focus on operational dependability

Source: The Hacker News