The LOTUSLITE backdoor version 1.1 is a malware variant targeting sensitive sectors in India and South Korea. It is delivered primarily via DLL sideloading using legitimate Microsoft-signed executables, initially through CHM files with embedded malicious JavaScript. The backdoor communicates with its command-and-control infrastructure using dynamic DNS over HTTPS, enabling attackers to perform remote shell commands, file operations, and manage sessions on compromised systems. Code analysis confirms it retains command structures and persistence mechanisms from LOTUSLITE v1.0 but includes enhancements such as updated magic values and API resolution techniques. The campaign infrastructure remains hosted under Dynu Systems, showing continuity with previous LOTUSLITE operations. The threat actor behind this campaign is identified as MUSTANG PANDA. There is no CVE or patch information available, and no confirmed exploitation in the wild has been reported.

The backdoor enables attackers to gain persistent remote shell access and perform file operations on compromised systems within India's banking sector and South Korean diplomatic circles, facilitating espionage and unauthorized data access or manipulation. The use of DLL sideloading with legitimate Microsoft-signed executables and evolving delivery mechanisms complicates detection and mitigation efforts. However, no confirmed active exploitation or widespread impact has been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Organizations should monitor for indicators of compromise including the provided IP addresses, domains, and file hashes. Restricting or monitoring the use of CHM files and DLL sideloading behaviors can reduce risk. Employ application whitelisting and verify the integrity of Microsoft-signed executables to detect potential sideloading attempts. No official fix or vendor advisory has been provided at this time.