The LOTUSLITE backdoor version 1.1 is a malware variant targeting sensitive sectors in India and South Korea, delivered via DLL sideloading with legitimate Microsoft-signed executables and initially through CHM files with malicious JavaScript. It maintains command structures and persistence mechanisms from LOTUSLITE v1.0 but includes enhancements such as updated magic values and API resolution techniques. Communication with command-and-control servers uses dynamic DNS over HTTPS, enabling remote shell, file operations, and session management. The campaign infrastructure shows continuity with previous LOTUSLITE operations hosted under Dynu Systems. The threat actor identified is MUSTANG PANDA. There is no CVE or patch information available, and no known exploits in the wild have been reported.

The backdoor provides attackers with remote shell access, file operation capabilities, and session management on compromised systems within India's banking sector and South Korean diplomatic circles. This enables espionage activities and potential unauthorized data access or manipulation. The use of DLL sideloading with legitimate Microsoft-signed executables and evolving delivery mechanisms increases the difficulty of detection. However, no confirmed exploitation in the wild has been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Organizations should monitor for indicators of compromise such as the provided IP addresses, domains, and file hashes. Given the delivery methods, restricting or monitoring CHM file usage and DLL sideloading behaviors may reduce risk. Employ application whitelisting and verify the integrity of Microsoft-signed executables to detect sideloading attempts. No official fix or vendor advisory has been provided at this time.