New “LOTUSLITE” Backdoor Targets U.S. Government in Suspected Mustang Panda Campaign

Acronis TRU reports a targeted espionage campaign delivering a custom C++ backdoor named LOTUSLITE via spear-phishing ZIP attachments that sideload a malicious kugou.dll alongside a signed Tencent music player executable; researchers link the operation with moderate confidence to Mustang Panda, noting persistence via a Run registry entry, C2 communications that mimic legitimate web traffic, and hard-coded network indicators.