A group of hackers linked to China, identified as Mustang Panda, has intensified its surveillance operations to target the financial sector in India and political entities in South Korea. Recent discoveries by the Acronis Threat Research Unit reveal that this follows their earlier campaign in 2026, which involved deceptive tactics related to Venezuela aimed at infiltrating U.S. government systems.
Focus on HDFC Bank and Political Experts
This latest campaign appears to have commenced in March 2026. In India, the group utilized a file called Request for Support.chm to deceive employees within the banking industry. The file generated a pop-up that mentioned HDFC Bank Limited, creating an air of authenticity. When opened, it initiated the download of a malicious JavaScript file tagged as music.js from the domain cosmosmusiccom.
According to an investigation shared by Acronis, Mustang Panda did not limit itself to employing support ticket schemes. They created convincing pop-up windows mimicking actual HDFC Bank software. While bank employees were misled into believing they were interacting with a legitimate banking application, they were unwittingly allowing a new variant of the LOTUSLITE backdoor—referred to as LOTUSLITE v1.1—access to their systems.
In a different aspect of this operation, the hackers masqueraded as Victor Cha, a former Director for Asian Affairs at the U.S. National Security Council. They created a fraudulent Gmail account bearing Mr. Cha’s likeness and sent Google Drive links containing folders labeled March 30. These folders housed misleading invitation letters designed to compromise the computers of policymakers.
Familiar Techniques, New Strategies
The hackers employed a technique known as DLL sideloading in their operations. By positioning a malicious file adjacent to a trusted, signed Microsoft file, such as Microsoft_DNX.exe, they exploited the computer’s inherent trust in the Microsoft label, allowing their infecting file to execute seamlessly.
Researchers have observed that this group is striving for greater concealment in their tactics. They modified their internal code markers, commonly known as “magic values,” shifting from 0x8899AABB to 0xB2EBCFDF, and replaced a command flag initially called –DATA with a new designation: –ZoneMAX.
It was also noted that Mustang Panda utilized the service Gleeze for communication with their server located at editorgleezecom. This infrastructure is consistent with those employed in past operations, linking this activity back to the Mustang Panda group.
Despite their attempts to innovate, the group left remnants of older codename references, such as KugouMain and DataImporterMain, within their new files. Furthermore, they included a message in the code referring to a security researcher tracking their movements.
The continued evolution of their impersonation tactics and use of trusted software for social engineering emphasizes the critical need for vigilance against unexpected emails or file attachments, even from seemingly legitimate sources. Cybersecurity professionals are advised to maintain a healthy skepticism to mitigate the risks posed by such advanced threats.