LOTUSLITE: Targeted espionage leveraging geopolitical themes

Authors: Ilia Dafchev, Subhajeet Singha

Summary

Acronis Threat Research Unit (TRU) observed a targeted malware campaign against U.S. government entities leveraging a politically themed ZIP archive containing a loader executable and a malicious dynamic-link library (DLL). The executable is used to sideload and execute the DLL, which functions as the primary backdoor, tracked as LOTUSLITE.

The backdoor, referred to as LOTUSLITE, is a custom C++ implant that communicates with a hard-coded IP-based command-and-control server and supports basic remote tasking and data exfiltration with a decent persistence technique indicating an espionage-focused capability set rather than financially motiv…