{
  "name": "Same packet, different magic: Hits India's banking sector and Korea geopolitics",
  "slug": "same-packet-different-magic-hits-indias-banking-sector-and-korea-geopolitics",
  "description": "A new variant of the LOTUSLITE backdoor, version 1.1, has been identified targeting India's banking sector and South Korean diplomatic circles. The backdoor is delivered via DLL sideloading using legitimate Microsoft-signed executables and initially through CHM files containing malicious JavaScript. It communicates with dynamic DNS-based command-and-control servers over HTTPS, supporting remote shell access, file operations and session management. Code-level analysis reveals direct lineage to LOTUSLITE v1.0, including identical command structures, shared persistence mechanisms, and residual exports from the original codebase. The campaign demonstrates incremental improvements including updated magic values, API resolution techniques, and delivery mechanisms evolving from CHM-based to JavaScript loaders to DLL sideloading. Infrastructure hosted under Dynu Systems shows continuity with previous operations.",
  "published": "2026-04-22T01:40:38.268000+00:00",
  "created_at": "2026-04-22T09:00:05.814000+00:00",
  "modified_at": "2026-04-22T07:00:05+00:00",
  "created_at_opencti": "2026-04-22T09:00:05.814000+00:00",
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "backdoor",
    "chm files",
    "dll sideloading",
    "espionage",
    "india banking",
    "javascript loader",
    "lotuslite",
    "south korea diplomacy"
  ],
  "tags": [
    "2026-04-22",
    "backdoor",
    "chm files",
    "dll sideloading",
    "espionage",
    "india banking",
    "javascript loader",
    "lotuslite",
    "south korea diplomacy"
  ],
  "related_entities": {
    "indicators": [
      {
        "id": "9e0d22d7-1f58-412a-9f4c-aa60c65a3603",
        "name": "editor.gleeze.com"
      },
      {
        "id": "e692bec5-eb44-469b-8143-e56272612912",
        "name": "www.cosmosmusic.com"
      },
      {
        "id": "faf7b722-b37e-4543-8c5c-b70438776179",
        "name": "7beede15ecdc7d3f01db4b699e5fe5f4f2e7c79cd7ef0e918ed0583bf621de7d"
      },
      {
        "id": "9ef3ed77-38f2-4695-be26-cff8b3b96e5b",
        "name": "9bf2f3b15a621789f898f9bd7710ba857e3f238a4937b64fdc47ef9a92e0b05d"
      },
      {
        "id": "169c72f5-fe90-45ff-a244-b4e4d5e442f3",
        "name": "18bc0e0f627d90fb283aa243055b46d0bfb5d85a7240d8f63ec2d1c8a2c15893"
      },
      {
        "id": "d95cd650-05e4-4335-9455-94bf6c572b06",
        "name": "af31ebe9085df408bedcf8f027fb60389897e5c8d3b0e9695fea29774f9d3aec"
      },
      {
        "id": "b2c5f712-8783-4113-8beb-f41c4d691bf7",
        "name": "6d22d50634c2c2fc853bfd2b564e1837d51087aa684a9c4415634c8c13c44135"
      },
      {
        "id": "1d59b33c-959c-4147-8623-363760611ede",
        "name": "cc0ff7e25ea686171919575916e2d9ebaeb5800a063f370a6980ea791f8851b8"
      },
      {
        "id": "d7a9315c-a28b-4ea0-ac7f-32cf7caacbd4",
        "name": "cosmosmusic.com"
      },
      {
        "id": "e506c895-34b5-413d-ae5c-3740e15848c6",
        "name": "172.81.60.97"
      }
    ],
    "intrusion_sets": [
      {
        "id": "d84a7548-8d06-45c7-80bf-46911d6e40c0",
        "name": "MUSTANG PANDA",
        "slug": "mustang-panda"
      }
    ],
    "attack_patterns": [
      {
        "id": "6ccd4566-e15e-40cf-b7df-4a3f737ce5cd",
        "name": "T1036.005"
      },
      {
        "id": "9322d33b-00c1-4f99-9f1a-a33d93c0dac2",
        "name": "T1059.007"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "196f2a64-c55b-47a6-8e38-beb76ba700b6",
        "name": "T1204.002"
      },
      {
        "id": "dc410646-9cdd-427b-92e7-179a54f78f90",
        "name": "T1566.001"
      },
      {
        "id": "6b2e0999-c7e8-4662-94ac-19aa8520ee46",
        "name": "T1059.003"
      },
      {
        "id": "29a20d73-65dc-4dc0-b5de-d943bc32d282",
        "name": "T1218.001"
      },
      {
        "id": "60972cf6-e90b-4600-af3c-13c468391d9c",
        "name": "T1106"
      },
      {
        "id": "97d377d8-89c7-48f8-a79f-0f48bd60df74",
        "name": "T1005"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "e8422fc8-8365-4a6a-a556-d6ec16cb4e5d",
        "name": "T1574.002"
      },
      {
        "id": "5999052b-e9ae-49e8-9235-d9bf975c22af",
        "name": "T1547.001"
      },
      {
        "id": "6f00068c-812c-4e2b-9100-2cfa86b3aed9",
        "name": "T1132.001"
      },
      {
        "id": "05ac27d4-58d0-44b2-a984-cd5aefd1f7f9",
        "name": "T1497.001"
      },
      {
        "id": "14660ccf-ca6b-42f6-8bca-e1b7a04650b3",
        "name": "T1573.001"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "e1b18ecf-d74e-4fe6-9bd4-ca6a62e7d818",
        "name": "T1027.002"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "fa3b8b48-d97c-4242-83a6-07d435a5a79e",
        "name": "T1041"
      }
    ],
    "malware": [
      {
        "id": "01673717-78f1-4b67-a642-8260806d76e3",
        "name": "LOTUSLITE",
        "slug": "lotuslite"
      }
    ],
    "observables": [
      {
        "id": "924a36ea-a26c-4c3c-9518-3f370b2c22d8",
        "name": "cosmosmusic.com"
      },
      {
        "id": "1d8643fc-2a26-450d-8ac4-0c0f35e9d2ce",
        "name": "www.cosmosmusic.com"
      },
      {
        "id": "47cec2fd-c480-4588-bf29-769e45f11337",
        "name": "editor.gleeze.com"
      },
      {
        "id": "2d8845e4-4362-48c2-9ffc-1bdd51399fa8",
        "name": "172.81.60.97"
      },
      {
        "id": "",
        "name": "7beede15ecdc7d3f01db4b699e5fe5f4f2e7c79cd7ef0e918ed0583bf621de7d"
      },
      {
        "id": "",
        "name": "9bf2f3b15a621789f898f9bd7710ba857e3f238a4937b64fdc47ef9a92e0b05d"
      },
      {
        "id": "",
        "name": "18bc0e0f627d90fb283aa243055b46d0bfb5d85a7240d8f63ec2d1c8a2c15893"
      },
      {
        "id": "",
        "name": "af31ebe9085df408bedcf8f027fb60389897e5c8d3b0e9695fea29774f9d3aec"
      },
      {
        "id": "",
        "name": "6d22d50634c2c2fc853bfd2b564e1837d51087aa684a9c4415634c8c13c44135"
      },
      {
        "id": "",
        "name": "cc0ff7e25ea686171919575916e2d9ebaeb5800a063f370a6980ea791f8851b8"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "India"
      },
      {
        "id": "",
        "name": "British Indian Ocean Territory"
      },
      {
        "id": "",
        "name": "United States of America"
      },
      {
        "id": "",
        "name": "Finance"
      },
      {
        "id": "",
        "name": "Government"
      },
      {
        "id": "",
        "name": "editor.gleeze.com"
      },
      {
        "id": "",
        "name": "cosmosmusic.com"
      }
    ]
  },
  "external_refs": [
    {
      "id": "141238a1-ce31-4901-814d-26b2202cfd4b",
      "standard_id": "external-reference--65ab05b6-7a72-5da2-8162-e9f83405240f",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/69e827168edcf67707285b4e",
      "hash": null,
      "external_id": "69e827168edcf67707285b4e",
      "created": "2026-04-22T08:59:59.526Z",
      "modified": "2026-04-22T08:59:59.526Z",
      "createdById": null
    },
    {
      "id": "8ea3cab6-0fc6-488c-803b-7957111c8451",
      "standard_id": "external-reference--d48f9c12-d453-51f6-b533-3546cf67ae35",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://www.acronis.com/en/tru/posts/same-packet-different-magic-mustang-panda-hits-indias-banking-sector-and-korea-geopolitics/",
      "hash": null,
      "external_id": null,
      "created": "2026-04-22T08:59:59.552Z",
      "modified": "2026-04-22T08:59:59.552Z",
      "createdById": null
    }
  ]
}