New “LOTUSLITE” Backdoor Targets U.S. Government in Suspected Mustang Panda Campaign

On 19 January 2026, security researchers reported a new espionage campaign targeting U.S. government entities with a custom backdoor named LOTUSLITE. According to Acronis TRU, the activity is linked with moderate confidence to the China-aligned Mustang Panda, based on behavioural patterns and infrastructure rather than code reuse alone.

The campaign uses spear-phishing with geopolitical lures, delivering a malicious ZIP archive titled “US now deciding what’s next for Venezuela[.]zip” and relies on DLL sideloading rather than zero-day exploits. The infection chain involves a legitimate signed launcher for a Tencent-owned music streaming service, which loads a malicious DLL named kugou.dll in the same directory to deliver LOTUSLITE.

The backdoor communicates with a hard-coded C2 IP and mimics normal web traffic with a Googlebot User-Agent, a Google referrer, and a Microsoft-hosted Host header; persistence is achieved via a registry entry in the current user’s Run key and a directory in C:\ProgramData. Researchers noted visible messaging within the malware’s export functions and described the campaign as focused strictly on U.S. government and policy-related entities.