Microsoft-Signed Binary Helps Deliver LOTUSLITE in India Spy Campaign

Microsoft-signed developer tooling is being abused to quietly deploy a new LOTUSLITE backdoor variant against India’s banking sector, in what researchers link to the China‑nexus Mustang Panda espionage cluster with moderate confidence.

The backdoor retains its espionage profile, offering remote shell access, file operations, and session management rather than any obvious monetization features.

Communications are tunneled over HTTPS to a command‑and‑control (C2) endpoint hosted on dynamic DNS infrastructure at editor[.]gleeze[.]com, consistent with earlier LOTUSLITE activity.

This updated implant is tracked as LOTUSLITE v1.1 and preserves the same core protocol and command set as the original campaign, indicating an iterative upgrade rather than a new malware family.

Acronis Threat Research Unit (TRU) has identified a fresh LOTUSLITE build themed around India’s financial sector, moving the group’s focus from earlier U.S. government targeting to banks and related organizations in the region.

TRU assesses that the codebase is under active maintenance, with incremental changes aimed at evasion and flexibility while maintaining a familiar operational playbook.

From CHM lures to Microsoft-signed

The attack chain starts with spear‑phishing that delivers a compiled HTML Help (CHM) file using banking‑style “request for support” ticket naming conventions.

When opened, the CHM presents a benign‑looking pop‑up and then loads embedded HTML that abuses ActiveX controls to decompile the CHM via hh.exe, drop a Microsoft‑signed executable (Microsoft_DNX.exe) and the malicious DLL into C:\Users\Public\Documents, and finally execute the binary using JavaScript automation.

The JavaScript loader, served as music.js from a compromised domain, orchestrates the entire drop‑and‑execute chain by programmatically clicking the ActiveX objects in sequence.

Once launched, Microsoft_DNX.exe performs DLL sideloading by dynamically loading a same‑directory DLL via LoadLibraryExW and resolving the DnxMain export through GetProcAddress, handing control to attacker code while running under a trusted Microsoft signature.

The domain hxxps[://]cosmosmusic[.]com, we found that it contained a total of three functions, which are aownroia, getCwd and calniown.

This reflects a broader shift in Mustang Panda’s delivery techniques from earlier CHM‑only and JavaScript‑loader chains toward clean DLL sideloading into legitimate binaries.

Code‑level analysis shows direct lineage with the original LOTUSLITE: the same TLV packet structure, identical command IDs, shared persistence mechanisms and several residual export names, including the long‑standing KugouMain label from earlier KuGou‑themed sideloading.

In v1.1 the export table has been expanded and reorganized, with DnxMain now routing execution into a new HDFCBankMain export that explicitly signals the Indian banking focus.

Developers have cleaned up comments and jokey strings, but continue to embed “messages” via exports and MessageBox pop‑ups, now referencing “HDFC Bank Limited” and even name‑checking an independent researcher tracking Mustang Panda under the handle “goldenjackel12.”

All sensitive Windows API calls are now resolved at runtime via an ntdll‑based LdrLoadDll chain, leaving the import table almost empty and complicating static detection.

Persistence still relies on a Run key under HKCU written through SHSetValueA, but this logic has been split into dedicated helper functions and wrapped in the same dynamic‑resolution pattern.

The result is a backdoor that is architecturally simple yet harder to fingerprint, favoring longevity and low noise over cutting‑edge exploitation.

Expanding victimology beyond India

The same LOTUSLITE v1.1 lineage also appears in parallel campaigns against South Korean and U.S. policy communities, using diplomatic‑themed lures and spoofed identities of high‑profile figures involved in Korean peninsula and Indo‑Pacific security.

Under the hood, they have rotated internal flags (from –DATA to –ZoneMAX) and changed the C2 packet “magic” value from 0x8899AABB to 0xB2EBCFDF, likely to evade existing detections without altering behavior.

In these cases, the operator reuses internal exports such as HDFCBankMain in DLLs repurposed for non‑financial lures, underscoring a pattern of recycling code across geographically distinct operations.

Researchers observed spear‑phishing archives distributed via cloud‑storage links, including Google Drive, and emails spoofing policy experts while abusing their photos and identities in account profiles.

The malware itself remains largely unchanged aside from mutex names and decoy files, further reinforcing that Mustang Panda is iterating a single codebase against multiple regions and interest areas.

TRU attributes this activity to the Mustang Panda cluster with moderate confidence, citing overlapping C2 infrastructure on Dynu‑managed dynamic DNS, repeated DLL sideloading tradecraft, identical LOTUSLITE command sets, and recurring “signature” habits such as residual export names and embedded researcher references.

The campaigns align with Mustang Panda’s long‑standing focus on strategic espionage over financial gain, now extending from earlier U.S. government‑focused operations to India’s banking sector and Korean diplomacy.

For defenders in Indian financial institutions and regional policy organizations, LOTUSLITE v1.1 highlights the need to monitor signed binaries loading unusual same‑directory DLLs, HTTPS traffic to dynamic DNS subdomains, and rare internal flags or packet markers in outbound connections.

Even modestly sophisticated implants can deliver sustained access when paired with relevant lures, trusted tooling and modest but continuous evolution in response to public reporting.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.