Mustang Panda’s New LOTUSLITE Variant Targets India Banks, South Korea Policy Circles

Acronis researchers observed an active espionage campaign deploying an updated LOTUSLITE backdoor via malicious CHM files that use JavaScript droppers and DLL side‑loading to run dnx.onecore.dll; the implant communicates over dynamic DNS/HTTPS (editor.gleeze.com) to enable remote shell, file operations, and data exfiltration. The campaign has pivoted to target India's banking sector (lures referencing HDFC Bank) while also impacting South Korean and U.S. policy/diplomatic entities, and is attributed with medium confidence to the Mustang Panda group.