# Mustang Panda LOTUSLITE Backdoor & StealC Campaigns Exploiting Middle East Conflict Themes

> Mustang Panda (Chinese APT) and opportunistic threat actors are weaponizing Middle East conflict themes to deliver the LOTUSLITE backdoor and StealC infostealer via DLL sideloading, CHM files, and malicious LNK shortcuts. Over 8,000 newly registered conflict-themed domains have been identified. Multiple active multi-stage attack chains with concrete C2 infrastructure (172.81.60.97, 80.97.160.190) were observed as of March 2026.

- **Published:** 2026-03-06T12:00:00Z
- **Last reviewed:** 2026-03-06T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0184
- **ID:** TL-2026-0184
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** Mustang Panda (China)
- **Detections:** 9 · **IOCs:** 47 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Zscaler ThreatLabz identified a surge of cyber operations exploiting Middle East geopolitical tensions, documenting eight distinct attack cases spanning espionage malware deployment, credential phishing, financial fraud, and cryptocurrency scams. Over 8,000 newly registered domains leveraging conflict themes were identified.

**Case 1 — GCC Region Targeted Attack (March 1, 2026):** A ZIP archive containing a malicious LNK file (photo_2026-03-01_01-20-48.pdf.lnk) uses cURL to download a CHM file from 360printsol.com. The CHM is decompiled via hh.exe, extracting a secondary LNK that copies a decoy PDF about Iranian missile strikes against a US base in Bahrain, extracts a TAR archive to %AppData%, and executes ShellFolder.exe. This triggers DLL sideloading of ShellFolderDepend.dll (32-bit), which checks for Bitdefender's bdagent.exe before establishing persistence via HKCU\Software\Microsoft\Windows\CurrentVersion\Run. The loader then decrypts RC4-encrypted shellcode from Shelter.ex using the key "20260301@@@" via the Windows Native API SystemFunction033, allocates memory with VirtualAlloc, and executes the payload.

**Case 2 — LOTUSLITE Backdoor / Mustang Panda (March 4, 2026):** A ZIP archive contains a legitimate KuGou music application binary renamed "Iran Strikes U.S. Military Facilities Across Gulf Region.exe" alongside a malicious libmemobook.dll in a directory named "JCPOA". The executable sideloads libmemobook.dll, which checks for prior installation at C:\ProgramData\CClipboardCm\WebFeatures.exe. If not installed, it copies itself to C:\ProgramData\CClipboardCm\, renames the legitimate binary to SafeChrome.exe, and establishes persistence via the registry key ACboardCm. It then downloads secondary payloads (WebFeatures.exe and kugou.dll) from e-kflower.com. The kugou.dll component is the LOTUSLITE backdoor — a custom C++ implant that communicates with C2 server 172.81.60.97 over TCP 443 using HTTP POST requests with a hardcoded Chrome 143.0.0.0 User-Agent. LOTUSLITE provides system/user enumeration, interactive cmd.exe shell, file manipulation, and periodic beaconing. Code overlap confirms connection to the January 2026 Venezuela-themed LOTUSLITE campaign. A secondary persistence key (ASEdge) is established at C:\ProgramData\WebFeatures\.

**Case 3 — Fake News to StealC Infostealer:** A fake news blog at goldman-iran-krieg.pages.dev performs device fingerprinting and redirects victims to file-hosting sites serving password-protected ZIP archives. The password is displayed on the same page. The archive contains StealC v2 (MD5: 098BC0DD6A02A777FABB1B7D6F2DA505), which communicates with C2 server 80.97.160.190 to exfiltrate browser credentials, cookies, cryptocurrency wallets, and system information.

**Cases 4-8 — Opportunistic Exploitation:** Additional cases include a fake US Social Security Administration portal (cfgomma.com) delivering PDQConnect RMM for remote access, a fake Israeli Kvish 6 toll gateway exfiltrating payment data via Telegram bot, donation scams (irandonation.org) routing payments through suspicious channels, conflict-themed merchandise storefronts (nowarwithiran.store) for payment card harvesting, and a pump-and-dump cryptocurrency scheme via khameneisol.xyz. Persian-language source code comments in cases 4-5 provide attribution indicators toward Iran-aligned actors.

---

**Revalidated on 2026-03-12**

Since the original publication of TL-2026-0184, this threat has been independently corroborated and significantly expanded by at least seven major security vendors (Check Point, Proofpoint, Cisco Talos, Unit 42, Kaspersky, Acronis TRU, IBM X-Force), elevating confidence in both attribution and scope. The most critical development is Check Point Research's March 1, 2026 disclosure confirming Camaro Dragon (Mustang Panda) launched targeted espionage campaigns against Qatari entities within 24 hours of the U.S.-Israel Operation Epic Fury strikes on Iran. The PlugX deployment used configuration key 'qwedfgx202211' and RC4 decryption key '20260301@@@' — the identical key format documented in the original Zscaler Case 1 GCC region attack — providing high-confidence attribution and confirming the same operator cluster executed both campaigns. Proofpoint's parallel discovery of UNK_InnerAmbush (assessed China-aligned) targeting Middle Eastern government organizations with identical lure themes (Bahrain base attacks, Gulf oil/gas facilities) further validates the original threat intelligence.

Mustang Panda's operational tempo in late 2025 through early 2026 demonstrates a deliberate post-PlugX-takedown retooling: after the FBI/DOJ January 2025 disruption of 4,258 PlugX-infected U.S. systems, the group rapidly deployed LOTUSLITE (January 2026, U.S. policy targets), updated COOLCLIENT with browser stealers (January 2026, Southeast Asian governments), a kernel-mode rootkit for ToneShell (December 2025, Asian targets), and SnakeDisk USB worm with geofenced Yokai backdoor (August 2025, Thailand). The March 2026 pivot to Middle East conflict exploitation represents the latest in this accelerating operational cadence.

New IOCs from Check Point include C2 IPs 185.219.220.73 and 91.193.17.117, domain almersalstore[.]com, and 10 file hashes. Proofpoint contributed C2 domain support.almersalstore[.]com and tracking infrastructure at deepdive.hypernas[.]com. Kaspersky added COOLCLIENT hashes (F518D8E5FE70D9090F6280C68A95998F loader, browser stealer variants A/B/C), C2 domains account.hamsterxnxx[.]com and japan.Lenovoappstore[.]com, and FTP exfiltration server 113.23.212.15. The StealC campaign (original Case 3) remains active with C2 at 80.97.160.190 and distribution via conflict-themed fake news domains including goldman-iran-krieg[.]pages[.]dev.

Detection coverage should be updated to include: PlugX with key 'qwedfgx202211' config detection, NVDA screen reader DLL sideloading (nvdaHelperRemote.dll), COOLCLIENT browser stealer output at C:\Users\Public\Libraries\License.txt, Baidu NetDisk binary sideloading, kernel-mode rootkit driver registration as minifilter (ProjectConfiguration.sys), and SnakeDisk USB propagation patterns. The MITRE ATT&CK mapping should be expanded to include T1014 (Rootkit), T1091 (Replication Through Removable Media), T1036.007 (Double File Extensions), and T1480 (Execution Guardrails/Geofencing).

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1608 Stage Capabilities
- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1218 System Binary Proxy Execution
- T1547 Boot or Logon Autostart Execution
- T1574 Hijack Execution Flow
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1555 Credentials from Password Stores
- T1518 Software Discovery
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1033 System Owner/User Discovery
- T1005 Data from Local System
- T1115 Clipboard Data
- T1113 Screen Capture
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service

## Sources

- [Zscaler ThreatLabz: Middle East Conflict Fuels Opportunistic Cyber Attacks](https://www.zscaler.com/blogs/security-research/middle-east-conflict-fuels-opportunistic-cyber-attacks)
- [Picus Security: Mustang Panda LOTUSLITE, SnakeDisk, and ToneShellws Campaign](https://www.picussecurity.com/resource/blog/breaking-down-mustang-panda-windows-endpoint-campaign)
- [The Hacker News: LOTUSLITE Backdoor Targets US Policy Entities](https://thehackernews.com/2026/01/lotuslite-backdoor-targets-us-policy.html)
- [Acronis TRU: LOTUSLITE Targeted Espionage Leveraging Geopolitical Themes](https://www.acronis.com/en/tru/posts/lotuslite-targeted-espionage-leveraging-geopolitical-themes/)
- [PolySwarm Blog: Mustang Panda's LotusLite Backdoor](https://blog.polyswarm.io/mustang-pandas-lotuslite-backdoor)
- [CYFIRMA Weekly Intelligence Report — January 2026](https://www.cyfirma.com/news/weekly-intelligence-report-23-january-2026/)
- [ThaiCERT: Mustang Panda Uses Venezuela-Related Lures for LOTUSLITE](https://www.thaicert.or.th/en/2026/01/20/mustang-panda-uses-venezuela-related-news-as-lure-to-spread-lotuslite-malware/)
- [Rescana: LOTUSLITE Campaign Analysis](https://www.rescana.com/post/lotuslite-backdoor-targets-u-s-government-and-policy-organizations-via-venezuela-themed-spear-phish)
- [MITRE ATT&CK: Mustang Panda (G0129)](https://attack.mitre.org/groups/G0129/)
- [Picus Security: StealC V2 Malware Analysis](https://www.picussecurity.com/resource/blog/stealc-v2-malware-enhances-stealth-and-expands-data-theft-features)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0184