Case 2: LOTUSLITE backdoor used in Iran conflict-themed lures by Mustang Panda

On March 4, 2026, ThreatLabz identified a malicious ZIP archive whose name is related to the conflict theme. Executing the malware in the archive triggered the download and execution of the LOTUSLITE backdoor.

The ZIP contained:

• A legitimate KuGou music software binary, renamed by the threat actor to Iran Strikes U.S. Military Facilities Across Gulf Region.exe
• A malicious DLL, libmemobook.dll

Based on the extracted directory name, JCPOA, ThreatLabz assesses the contents were intended to appear related to the Joint Comprehensive Plan of Action (JCPOA), the Iran nuclear deal signed in 2015. The file name Iran Strikes U.S. Military Facilities Across Gulf Region.exe appears deliberately chosen to align with ongoing military conflict in the Middle East.

When executed, the legitimate executable sideloads the malicious libmemobook.dll located in the same directory.

Stage 1: libmemobook.dll analysis (LOTUSLITE downloader)

libmemobook.dll is a 32-bit C++ DLL used to download the next-stage payloads and set up persistence on the endpoint. The malicious functionality is implemented in the export function named ProcessMain.

On the first run, the downloader performs checks to determine whether LOTUSLITE is already installed. It looks for two files under C:\ProgramData\CClipboardCm\.

• WebFeatures.exe
• kugou.dll

The downloader also verifies that both files match expected file sizes. If the checks pass, the downloader launches WebFeatures.exe and then exits.

If the environment checks fail, the downloader begins its installation routine:

• Ensures it is running from the target directory: The downloader checks whether it is already executing from C:\ProgramData\CClipboardCm\. If not, it creates the directory and copies:
  • itself to C:\ProgramData\CClipboardCm\libmemobook.dll
  • the legitimate host executable to C:\ProgramData\CClipboardCm\SafeChrome.exe
• Establishes persistence: The downloader creates a Windows Run key
  HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ACboardCm
  and sets it to: C:\ProgramData\CClipboardCm\SafeChrome.exe.

The downloader then checks for the next-stage components in C:\ProgramData\WebFeatures\.

• WebFeatures.exe
• kugou.dll

If both files are present and their sizes validate, the downloader executes WebFeatures.exe via CreateProcessW. WebFeatures.exe then sideloads the malicious DLL kugou.dll from the same directory, continuing the infection chain.

If the next-stage payloads are not present, the downloader decrypts embedded shellcode, allocates executable memory using VirtualAlloc, copies the decrypted shellcode into the allocated region, and executes it indirectly by:

• setting the EnumFontsW callback to the shellcode address, and
• invoking EnumFontsW to trigger execution.

Shellcode analysis

The 32-bit shellcode primarily downloads and drops the next-stage payloads using the pre-configured URLs in the table below.

Table 1: Pre-configured URLs used by the shellcode.

It is worth noting that the domain e-kflower[.]com is compromised and used by the threat actor to stage the payloads.

The shellcode hardcodes the User-Agent used for all network requests to Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36. This User-Agent is applied consistently across its HTTP traffic to mimic legitimate Chrome browser activity. After downloading the next-stage payloads, the downloader copies them to C:\ProgramData\WebFeatures\. It then establishes persistence by creating the following Run key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ASEdge and setting it to launch  C:\ProgramData\WebFeatures\WebFeatures.exe -Edge.

Stage 2: kugou.dll analysis

WebFeatures.exe is a legitimate data importer utility from the KuGou music software suite. When executed from the compromised directory, it sideloads the malicious kugou.dll placed alongside it. ThreatLabz observed substantial code overlap between kugou.dll and the LOTUSLITE backdoor documented in January 2026, including use of the same C2 IP address: 172.81.60[.]97.

Threat actors associated with LOTUSLITE appear to rapidly weaponize themes tied to active geopolitical events. In January 2026, they leveraged narratives related to tensions between the United States and Venezuela. In this campaign, we observed them adopting a Middle East conflict theme.