LOTUSLITE Backdoor Targets U.S. Policy Entities Using Venezuela-Themed Spear Phishing

Security researchers have disclosed a campaign that targeted U.S. government and policy entities with a backdoor named LOTUSLITE delivered via Venezuela-themed spear phishing. The attackers used a ZIP archive titled “US now deciding what's next for Venezuela[.]zip” containing a malicious DLL that is launched through DLL side-loading, with the backdoor known as kugou.dll communicating with a hard-coded C2 server to enable beaconing, remote tasking via cmd.exe, and data exfiltration.

LOTUSLITE can achieve persistence by modifying Windows Registry so it runs at login, and its command set includes remote CMD initiation (0x0A), remote shell termination (0x0B), file enumeration (0x01), and beacon management (0x06, 0x0D, 0x0E, 0x0F). Acronis researchers noted the backdoor mimics the shenanigans of Claimloader, and IBM X-Force first documented the malware in June 2025 in connection with a campaign aimed at the Tibetan community.

The campaign has been attributed with moderate confidence to Mustang Panda, a China‑based state‑sponsored group, with The New York Times publishing details about a separate U.S. operation in Caracas around 3 January 2026.