# Mustang Panda LOTUSLITE v1.1 Espionage Campaign Targets Indian Banking (HDFC) and South Korean Policy Circles

> Chinese state-sponsored APT Mustang Panda (G0129 / TA416 / Stately Taurus / Earth Preta) launched a March 2026 espionage campaign deploying an updated LOTUSLITE v1.1 backdoor against India's banking sector via HDFC-themed CHM lures and against South Korean policy circles via Victor Cha impersonation through Gmail/Google Drive. The infection chain abuses CHM (Request_for_Support.chm), a JavaScript loader (music.js) staged on cosmosmusic[.]com, and DLL side-loading (dnx.onecore.dll into legitimate Microsoft_DNX.exe), with HTTPS C2 to editor[.]gleeze[.]com using the new magic header 0xB2EBCFDF. Disclosed by Acronis Threat Research Unit on 2026-04-22.

- **Published:** 2026-04-27T12:00:00Z
- **Last reviewed:** 2026-04-27T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0430
- **ID:** TL-2026-0430
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** Mustang Panda (China)
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-04-22 the Acronis Threat Research Unit (TRU) published "Same packet, different magic" — disclosing a Mustang Panda (G0129) espionage operation that ran from late March 2026 against Indian banking entities (with HDFC-themed lures) and South Korean policy advisors impersonating Center for Strategic and International Studies (CSIS) Korea Chair Victor Cha. The campaign deploys an updated LOTUSLITE v1.1 backdoor that retains the same network packet structure of earlier variants but switches the protocol magic header from 0xB2ECCFDB / 0xB2EBCFDB used in 2024-2025 builds to 0xB2EBCFDF — hence the report's title.

Initial access is achieved through spearphishing emails (T1566.002) carrying Google Drive links to a ZIP archive named "MARCH 30.zip" (SHA256 6d22d50634c2c2fc853bfd2b564e1837d51087aa684a9c4415634c8c13c44135). The archive contains a Compiled HTML Help file Request_for_Support.chm (SHA256 18bc0e0f627d90fb283aa243055b46d0bfb5d85a7240d8f63ec2d1c8a2c15893). When opened by hh.exe (T1218.001), the CHM executes embedded JScript (T1059.007) that reaches out to https://www.cosmosmusic[.]com/imgs/img/music.js to fetch a second-stage JavaScript loader. The Indian banking variant uses HDFC-branded decoys with subjects such as "Request for Support — HDFC Bank".

The second stage drops three components into C:\ProgramData\Microsoft_DNX\: the legitimate signed binary Microsoft_DNX.exe (SHA256 af31ebe9085df408bedcf8f027fb60389897e5c8d3b0e9695fea29774f9d3aec) renamed for masquerading (T1036.005), the malicious side-loaded DLL dnx.onecore.dll (SHA256 7beede15ecdc7d3f01db4b699e5fe5f4f2e7c79cd7ef0e918ed0583bf621de7d) which contains the LOTUSLITE v1.1 stub, and an encrypted payload blob. Persistence is established via HKCU\Software\Microsoft\Windows\CurrentVersion\Run autorun key (T1547.001) pointing at Microsoft_DNX.exe so the side-loader executes at every user logon.

LOTUSLITE v1.1 communicates with the C2 hostname editor[.]gleeze[.]com (a DuckDNS / dynamic DNS provider, T1568.002) over TCP/443 using HTTPS-tunneled custom protocol. Each command/response packet begins with the 0xB2EBCFDF magic dword followed by an XOR-encrypted command structure preserving the v1.0 RC4-derived key schedule. Capabilities include shell command execution (T1059.003), file upload/download for collection (T1005, T1041), screenshot capture (T1113), and module loading. A secondary loader kwpswnsserver.exe (SHA256 cc0ff7e25ea686171919575916e2d9ebaeb5800a063f370a6980ea791f8851b8) and Microsoft.WindowsAppRuntime.Bootstrap.dll (SHA256 9bf2f3b15a621789f898f9bd7710ba857e3f238a4937b64fdc47ef9a92e0b05d) are observed in the South Korean cluster, with mutex strings "mdseccoUkFuiCkTrump" and "1ac5e7ee1a107499" used to prevent multiple infections.

Attribution to Mustang Panda is HIGH confidence based on infrastructure overlap (gleeze.com / DuckDNS pattern reused since 2023 ToneShell campaigns), TTP continuity (CHM + DLL side-loading with renamed Microsoft binaries), code lineage with LOTUSLITE v1.0 (documented by Picus Security in January 2026), and victimology aligned with PRC strategic interests (South Asian banking competitive intelligence, ROK-US policy monitoring around Trump-era Indo-Pacific posture). The 0xB2EBCFDF magic value differs from prior LOTUSLITE builds by a single byte yet preserves an identical packet layout — likely a deliberate detection-evasion tweak rather than a fork.

## MITRE ATT&CK

- T1589.002 Gather Victim Identity Information: Email Addresses
- T1583.001 Acquire Infrastructure: Domains
- T1583.006 Acquire Infrastructure: Web Services
- T1587.001 Develop Capabilities: Malware
- T1566.002 Phishing: Spearphishing Link
- T1566.001 Phishing: Spearphishing Attachment
- T1204.002 User Execution: Malicious File
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1574.001 DLL
- T1218.001 System Binary Proxy Execution: Compiled HTML File
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1082 System Information Discovery
- T1016 System Network Configuration Discovery
- T1033 System Owner/User Discovery
- T1083 File and Directory Discovery
- T1005 Data from Local System
- T1113 Screen Capture
- T1071.001 Application Layer Protocol: Web Protocols
- T1573.002 Encrypted Channel: Asymmetric Cryptography
- T1568.002 Domain Generation Algorithms
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel

## Sources

- [Acronis TRU: Same packet, different magic — Mustang Panda hits India's banking sector and Korea geopolitics](https://www.acronis.com/en/tru/posts/same-packet-different-magic-mustang-panda-hits-indias-banking-sector-and-korea-geopolitics/)
- [The Hacker News: Mustang Panda's New LOTUSLITE Variant Targets India Banks, South Korea Policy Circles](https://thehackernews.com/2026/04/mustang-pandas-new-lotuslite-variant.html)
- [SC Media: Mustang Panda expands cyber-espionage to India's financial sector and South Korean politics](https://www.scworld.com/brief/mustang-panda-expands-cyber-espionage-to-indias-financial-sector-and-south-korean-politics)
- [Hackread: Mustang Panda India / S. Korea LOTUSLITE backdoor campaign](https://hackread.com/mustang-panda-india-s-korea-lotuslite-backdoor/)
- [MITRE ATT&CK Group G0129 — Mustang Panda](https://attack.mitre.org/groups/G0129/)
- [Picus Security: Mustang Panda (TA416) — LOTUSLITE, SnakeDisk, ToneShell Endpoint Campaign](https://www.picussecurity.com/resource/blog/breaking-down-mustang-panda-windows-endpoint-campaign)
- [Malpedia: Mustang Panda actor profile](https://malpedia.caad.fkie.fraunhofer.de/actor/mustang_panda)
- [MITRE ATT&CK T1574.002 — DLL Side-Loading](https://attack.mitre.org/techniques/T1574/002/)
- [MITRE ATT&CK T1218.001 — Compiled HTML File](https://attack.mitre.org/techniques/T1218/001/)
- [MITRE ATT&CK T1566.002 — Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0430