Ethical Hacking News
Acronis has discovered two new variants of malware that are targeting Indian banks and South Korean policy circles. The first variant, known as LOTUSLITE, has been observed in spear-phishing attacks targeting U.S. government and policy entities using decoys associated with the geopolitical developments between the U.S. and Venezuela. The latest activity flagged by Acronis involves deploying an evolved version of LOTUSLITE that demonstrates "incremental improvements" over its predecessor, indicating that the malware is being actively maintained and refined by its operators.
Acronis discovered two new variants of malware targeting India's banking sector and South Korean policy circles. The first variant, LOTUSLITE, was previously observed in spear-phishing attacks against U.S. government entities using decoys associated with Venezuela. A new evolved version of LOTUSLITE has been detected, indicating the malware is being actively maintained and refined by its operators. The attack wave now focuses on India's banking sector, with a geographic pivot from previous attacks targeting U.S. government entities. The malware uses a Compiled HTML file to embed malicious payloads, including a legitimate executable and rogue DLL. The malware communicates with a remote server to receive commands and exfiltrate data of interest through a DLL side-loading mechanism. The campaign appears to be espionage-focused rather than financially motivated, indicating advanced persistent threats (APTs) are evolving in sophistication. Organizations must remain vigilant and take proactive measures to protect themselves against such threats, highlighting the need for global cooperation in combating cyberattacks.
Acronis, a renowned cybersecurity firm, has recently uncovered two new variants of malware that are targeting India's banking sector and South Korean policy circles. The first variant, known as LOTUSLITE, has been observed in spear-phishing attacks targeting U.S. government and policy entities using decoys associated with the geopolitical developments between the U.S. and Venezuela. However, the latest activity flagged by Acronis involves deploying an evolved version of LOTUSLITE that demonstrates "incremental improvements" over its predecessor, indicating that the malware is being actively maintained and refined by its operators.
The deviation from the prior attack wave relates to a geographic pivot that focuses mainly on the banking sector of India, while keeping the rest of the operational playbook mostly intact. The starting point of the attack is a Compiled HTML (CHM) file embedding the malicious payloads – a legitimate executable and a rogue DLL – along with an HTML page that contains a pop-up which prompts the user to click "Yes." This step is designed to silently retrieve and execute a JavaScript malware from a remote server ("cosmosmusic[.]com"), whose primary responsibility is to extract and run the malware contained inside the CHM file using DLL side-loading.
The DLL ("dnx.onecore.dll") is an updated version of LOTUSLITE that communicates with the domain "editor.gleeze[.]com" to receive commands and exfiltrate data of interest. Further analysis of the campaign has uncovered similar artifacts designed to target South Korean entities, specifically individuals within the policy and diplomatic community.
"We believe that the group had been targeting certain entities belonging to the South Korean and U.S. diplomatic and policy communities, specifically those involved in Korean peninsula affairs, North Korea policy discussions and Indo-Pacific security dialogues," Acronis said. "What stands out is the broadening of the group's targeting, from U.S. government entities with geopolitical lures, to India's banking sector through implants embedded with HDFC Bank references and pop-ups masquerading as legitimate banking software, and now to South Korean and U.S. policy circles through the impersonation of a prominent figure in Korean peninsula diplomacy, delivered via spoofed Gmail accounts and Google Drive staging."
The use of LOTUSLITE was previously observed in spear-phishing attacks targeting U.S. government and policy entities using decoys associated with the geopolitical developments between the U.S. and Venezuela. The activity was attributed with medium confidence to a Chinese nation-state group tracked as Mustang Panda.
Acronis researchers Subhajeet Singha and Santiago Pontiroli said that "the backdoor communicates with a dynamic DNS-based command-and-control server over HTTPS and supports remote shell access, file operations, and session management, indicating a continued espionage-focused capability set rather than financially motivated objectives."
The development of these new variants highlights the ongoing evolution of advanced persistent threats (APTs) and their growing sophistication. It also underscores the need for organizations to remain vigilant and take proactive measures to protect themselves against such threats.
As cybersecurity concerns continue to grow globally, it is essential for individuals, organizations, and governments to work together to share intelligence and best practices to combat these threats. The recent discovery of these new variants serves as a stark reminder that cyberattacks can come from unexpected directions and should be taken seriously.
In conclusion, the emergence of new variants of malware targeting Indian banks and South Korean policy circles is a growing concern for global cybersecurity. These variants demonstrate the ongoing evolution of advanced persistent threats and highlight the need for organizations to remain vigilant and take proactive measures to protect themselves against such threats.
Related Information:
https://www.ethicalhackingnews.com/articles/New-Variants-of-Malware-Target-Indian-Banks-and-South-Korean-Policy-Circles-A-Growing-Concern-for-Global-Cybersecurity-ehn.shtml
https://thehackernews.com/2026/04/mustang-pandas-new-lotuslite-variant.html
https://www.darkreading.com/cyberattacks-data-breaches/chinese-apt-indian-banks-korean-policy
https://blog.netmanageit.com/mustang-pandas-new-lotuslite-variant-targets-india-banks-south-korea-policy-circles/
https://www.acronis.com/en/tru/posts/lotuslite-targeted-espionage-leveraging-geopolitical-themes/
https://thehackernews.com/2026/01/lotuslite-backdoor-targets-us-policy.html
https://attack.mitre.org/groups/G0129/
https://thehackernews.com/2026/01/mustang-panda-deploys-updated.html
https://apt.etda.or.th/cgi-bin/showcard.cgi?g=Mustang+Panda,+Bronze+President
Published: Wed Apr 22 03:44:51 2026 by llama3.2 3B Q4_K_M
