Mustang Panda LOTUSLITE v1.1 Espionage Campaign Targets Indian Banking (HDFC) and South Korean Policy Circles

Mustang Panda LOTUSLITE v1.1 Espionage Campaign Targets (TL-2026-0430), also tracked as LOTUSLITE v1.1, is a high-severity advanced persistent threat campaign, first published 2026-04-27. It is attributed to Mustang Panda (China) with high confidence, affects Microsoft Windows (10/11, Server), maps to 26 MITRE ATT&CK techniques (T1005, T1016, T1027), and is covered by 9 detection rules and 28 indicators of compromise.

Key facts for TL-2026-0430

Threat ID
TL-2026-0430
Also known as
LOTUSLITE v1.1, Same Packet Different Magic, Operation Victor Cha, HDFC CHM Campaign, 0xB2EBCFDF Campaign
Severity
HIGH
Status
ACTIVE
Category
APT
First published
2026-04-27
Last reviewed
2026-04-27
Attribution
Mustang Panda
Attribution confidence
HIGH
Nation-state nexus
China
Motivation
ESPIONAGE
Target sectors
financial, banking, government, diplomatic, policy-research, think-tank
Target regions
India, South Korea, United States, Asia-Pacific
Detection rules
9
Indicators of compromise
28

Malware and tooling in Mustang Panda LOTUSLITE v1.1 Espionage Campaign Targets

Malware and tooling: LOTUSLITE, SnakeDisk, TONESHELL - S1239, at - S0110

Chinese state-sponsored APT Mustang Panda (G0129 / TA416 / Stately Taurus / Earth Preta) launched a March 2026 espionage campaign deploying an updated LOTUSLITE v1.1 backdoor against India's banking sector via HDFC-themed CHM lures and against South Korean policy circles via Victor Cha impersonation through Gmail/Google Drive. The infection chain abuses CHM (Request_for_Support.chm), a JavaScript loader (music.js) staged on cosmosmusic[.]com, and DLL side-loading (dnx.onecore.dll into legitimate Microsoft_DNX.exe), with HTTPS C2 to editor[.]gleeze[.]com using the new magic header 0xB2EBCFDF. Disclosed by Acronis Threat Research Unit on 2026-04-22.

How Mustang Panda LOTUSLITE v1.1 Espionage Campaign Targets works

On 2026-04-22 the Acronis Threat Research Unit (TRU) published "Same packet, different magic" — disclosing a Mustang Panda (G0129) espionage operation that ran from late March 2026 against Indian banking entities (with HDFC-themed lures) and South Korean policy advisors impersonating Center for Strategic and International Studies (CSIS) Korea Chair Victor Cha. The campaign deploys an updated LOTUSLITE v1.1 backdoor that retains the same network packet structure of earlier variants but switches the protocol magic header from 0xB2ECCFDB / 0xB2EBCFDB used in 2024-2025 builds to 0xB2EBCFDF — hence the report's title.

Initial access is achieved through spearphishing emails (T1566.002) carrying Google Drive links to a ZIP archive named "MARCH 30.zip" (SHA256 6d22d50634c2c2fc853bfd2b564e1837d51087aa684a9c4415634c8c13c44135). The archive contains a Compiled HTML Help file Request_for_Support.chm (SHA256 18bc0e0f627d90fb283aa243055b46d0bfb5d85a7240d8f63ec2d1c8a2c15893). When opened by hh.exe (T1218.001), the CHM executes embedded JScript (T1059.007) that reaches out to https://www.cosmosmusic[.]com/imgs/img/music.js to fetch a second-stage JavaScript loader. The Indian banking variant uses HDFC-branded decoys with subjects such as "Request for Support — HDFC Bank".

The second stage drops three components into C:\ProgramData\Microsoft_DNX\: the legitimate signed binary Microsoft_DNX.exe (SHA256 af31ebe9085df408bedcf8f027fb60389897e5c8d3b0e9695fea29774f9d3aec) renamed for masquerading (T1036.005), the malicious side-loaded DLL dnx.onecore.dll (SHA256 7beede15ecdc7d3f01db4b699e5fe5f4f2e7c79cd7ef0e918ed0583bf621de7d) which contains the LOTUSLITE v1.1 stub, and an encrypted payload blob. Persistence is established via HKCU\Software\Microsoft\Windows\CurrentVersion\Run autorun key (T1547.001) pointing at Microsoft_DNX.exe so the side-loader executes at every user logon.

LOTUSLITE v1.1 communicates with the C2 hostname editor[.]gleeze[.]com (a DuckDNS / dynamic DNS provider, T1568.002) over TCP/443 using HTTPS-tunneled custom protocol. Each command/response packet begins with the 0xB2EBCFDF magic dword followed by an XOR-encrypted command structure preserving the v1.0 RC4-derived key schedule. Capabilities include shell command execution (T1059.003), file upload/download for collection (T1005, T1041), screenshot capture (T1113), and module loading. A secondary loader kwpswnsserver.exe (SHA256 cc0ff7e25ea686171919575916e2d9ebaeb5800a063f370a6980ea791f8851b8) and Microsoft.WindowsAppRuntime.Bootstrap.dll (SHA256 9bf2f3b15a621789f898f9bd7710ba857e3f238a4937b64fdc47ef9a92e0b05d) are observed in the South Korean cluster, with mutex strings "mdseccoUkFuiCkTrump" and "1ac5e7ee1a107499" used to prevent multiple infections.

Attribution to Mustang Panda is HIGH confidence based on infrastructure overlap (gleeze.com / DuckDNS pattern reused since 2023 ToneShell campaigns), TTP continuity (CHM + DLL side-loading with renamed Microsoft binaries), code lineage with LOTUSLITE v1.0 (documented by Picus Security in January 2026), and victimology aligned with PRC strategic interests (South Asian banking competitive intelligence, ROK-US policy monitoring around Trump-era Indo-Pacific posture). The 0xB2EBCFDF magic value differs from prior LOTUSLITE builds by a single byte yet preserves an identical packet layout — likely a deliberate detection-evasion tweak rather than a fork.

MITRE ATT&CK techniques used in TL-2026-0430

Collection

T1005 Data from Local System; T1113 Screen Capture

Discovery

T1016 System Network Configuration Discovery; T1033 System Owner/User Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1218.001 System Binary Proxy Execution: Compiled HTML File

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1059.007 Command and Scripting Interpreter: JavaScript; T1204.002 User Execution: Malicious File

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1105 Ingress Tool Transfer; T1568.002 Domain Generation Algorithms; T1573.002 Encrypted Channel: Asymmetric Cryptography

Persistence

T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Initial Access

T1566.001 Phishing: Spearphishing Attachment; T1566.002 Phishing: Spearphishing Link

stealth

T1574.001 DLL

Resource Development

T1583.001 Acquire Infrastructure: Domains; T1583.006 Acquire Infrastructure: Web Services; T1587.001 Develop Capabilities: Malware

Reconnaissance

T1589.002 Gather Victim Identity Information: Email Addresses

Affected products and versions in Mustang Panda LOTUSLITE v1.1 Espionage Campaign Targets

  • Microsoft — Windows (10/11, Server)
    Vulnerable versions: all current versions where users execute .chm and DLL side-loading is permitted
  • Microsoft — Help Viewer (hh.exe)
    Vulnerable versions: abused as living-off-the-land binary
  • HDFC Bank (decoy theme) — Banking sector targets
    Vulnerable versions: employees and contractors of Indian banks receiving HDFC-themed lures
  • Google — Gmail / Google Drive (delivery channel)
    Vulnerable versions: abused for phishing and ZIP staging

Remediation for Mustang Panda LOTUSLITE v1.1 Espionage Campaign Targets

Patches

  • No patch — TTP-based campaign exploits user execution and DLL side-loading rather than CVEs

Immediate actions

  • Block C2 domain editor.gleeze.com and parent gleeze.com at egress proxies and DNS RPZ
  • Block staging domain cosmosmusic.com (and www.cosmosmusic.com) at perimeter
  • Quarantine and hash-block IOCs (SHA256: 18bc0e0f627d90fb283aa243055b46d0bfb5d85a7240d8f63ec2d1c8a2c15893, 7beede15ecdc7d3f01db4b699e5fe5f4f2e7c79cd7ef0e918ed0583bf621de7d, 6d22d50634c2c2fc853bfd2b564e1837d51087aa684a9c4415634c8c13c44135) in EDR
  • Hunt for the directory C:\ProgramData\Microsoft_DNX\ and the file dnx.onecore.dll on every endpoint
  • Search HKCU\Software\Microsoft\Windows\CurrentVersion\Run for entries pointing to ProgramData paths or Microsoft_DNX.exe
  • Search proxy/DNS logs for 90 days of connections to *.gleeze.com, cosmosmusic.com, and DuckDNS dynamic-DNS hostnames
  • Hunt for hh.exe spawning script interpreters (cscript.exe, wscript.exe, mshta.exe) or making outbound HTTPS connections

Workarounds

  • Block hh.exe network outbound at host firewall (it should never need internet access)
  • Configure Windows to block child-process creation from hh.exe via attack surface reduction (ASR) rule
  • Apply WDAC / AppLocker policies allowing only signed binaries from %ProgramFiles% and Windows directories
  • Use Microsoft Defender for Office 365 Safe Links and Safe Attachments with detonation enabled for ZIP and CHM

Longer-term hardening

  • Disable execution of .chm files from email attachments and browser-downloaded ZIPs via attachment policy and SRP/AppLocker
  • Deploy EDR rules for unsigned DLL side-loading into signed Microsoft binaries running from non-standard paths (especially %ProgramData% and %AppData%)
  • Enable PowerShell, ScriptBlock, and CommandLine logging plus Sysmon Event ID 7 (image load) on all endpoints
  • Mandate phishing-resistant MFA (FIDO2 / hardware keys) for accounts handling cross-border financial intelligence and policy materials
  • Implement email banner warnings on external Gmail / Google Drive shared links to high-value targets (executives, policy advisors, banking analysts)
  • Establish geo-restricted egress filtering for finance and policy-research workstations with no business need to reach DDNS providers

Weaknesses (CWE) in Mustang Panda LOTUSLITE v1.1 Espionage Campaign Targets

CWE-427, CWE-829, CWE-345

Timeline of Mustang Panda LOTUSLITE v1.1 Espionage Campaign Targets

  • Earlier LOTUSLITE v1.0 activity targeting US diplomatic and policy entities (Picus Security retrospective).
  • Picus Security publishes analysis of Mustang Panda LOTUSLITE / SnakeDisk / ToneShell endpoint campaign — establishes v1.0 baseline.
  • First observed LOTUSLITE v1.1 sample with new 0xB2EBCFDF magic header — CHM-based delivery against Indian banking targets begins.
  • 'MARCH 30' staging folder on Google Drive used for ZIP distribution; Victor Cha impersonation lures sent to South Korean policy advisors.
  • HDFC Bank-themed Request_for_Support.chm lures observed delivered to Indian financial-sector recipients via Gmail.
  • Infrastructure overlap with prior Mustang Panda ToneShell operations confirmed via gleeze.com / DuckDNS reuse.
  • The Hacker News, SC Media, and Hackread amplify the Acronis disclosure — public IOC distribution begins.
  • Acronis Threat Research Unit publishes 'Same packet, different magic' — full campaign disclosure with IOCs and the 0xB2EBCFDF magic-byte change.
  • Threadlinqs Intelligence publishes TL-2026-0430 with full D1 record, MITRE mappings, IOCs, and detection coverage.
  • As of 2026-05-29, this remains an ACTIVE Mustang Panda (G0129) espionage campaign: the LOTUSLITE v1.1 wave (Acronis TRU, Apr 2026) is corroborated by THN/Hackread/HivePro/SOCPrime with no C2 takedown of gleeze.com/cosmosmusic.com. The PRC actor stays highly operational in 2026 (CoolClient, FDMTP), and the CHM + DLL side-loading TTPs have no patch and remain viable.

Sources cited for Mustang Panda LOTUSLITE v1.1 Espionage Campaign Targets

Threats related to Mustang Panda LOTUSLITE v1.1 Espionage Campaign Targets

Detection coverage for TL-2026-0430

As of 2026-04-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0430 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats