Mustang Panda is using a new LOTUSLITE backdoor to target Indian banks and Korean diplomats. Learn how this DLL sideloading attack works.

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

Microsoft's AI agent 'Ire' has identified a new LOTUSLITE malware variant missed by traditional security tools, showcasing AI's prowess in behavioral analysis.

Ireが未知のLOTUSLITE亜種を自律解析。AI駆動型リバースエンジニアリングの技術を詳説。

✓ LOTUSLITE malware used by Mustang Panda via Venezuela news lures. Learn how it works and how to defend systems.

A Chinese-linked cyberespionage campaign by Mustang Panda targeted U.S. government officials with Venezuela-themed phishing emails deploying the LOTUSLITE backdoor.

The LOTUSLITE backdoor is targeting U.S. policy entities using Venezuela-themed spear phishing campaigns to gain covert access.

China-linked attackers used Venezuela-themed phishing and DLL side-loading to deploy the LOTUSLITE backdoor against U.S. government and policy targets

Acronis reveals Mustang Panda is using an updated version of LOTUSLITE backdoor to target Indian banks and Korean diplomats. Learn how this DLL sideloading attack works.

Researchers have found a new spying campaign using news about Venezuela to trick US government officials. Learn how the LOTUSLITE virus sneaks into computers to steal secrets.

China-linked attackers used Venezuela-themed phishing and DLL side-loading to deploy the LOTUSLITE backdoor against U.S. government and policy targets

A new LOTUSLITE v1.1 backdoor variant was deployed in targeted campaigns against India's banking sector and South Korean/U.S. policy circles, using DLL sideloading via Microsoft-signed binaries and CHM/JavaScript-based loaders. Attribution points to Mustang Panda with moderate confidence based on shared code lineage, residual exports (e.g., KugouMain), and reused Dynu-managed C2 infrastructure. #LOTUSLITE #MustangPanda

China-linked APT Mustang Panda has shifted its focus from purely geopolitical espionage to target Indian financial organizations, using spear-phishing and DLL sideloading to deliver a variant of its LotusLite backdoor disguised as regional banking software. The campaign relies on unsophisticated but disciplined tradecraft that remains effective against inconsistent basic defenses and appears aimed at intelligence collection rather than direct financial theft. #MustangPanda #LotusLite

Cybersecurity researchers have discovered a new variant of a known malware called LOTUSLITE that's distributed via a theme related to India's banking sector. "The backdoor communicates with a dynamic DNS-based command-and-control server over HTTPS and supports remote shell access, file operations, and session management, indicating a continued espionage-focused capability set rather than