Chinese spies used Maduro's capture as a lure to phish US govt agencies
(2026/01/15)
- Reference: 1768515302
- News link: https://www.theregister.co.uk/2026/01/15/chinese_spies_used_maduros_capture/
- Source link:
What policy wonk wouldn't want to click on an attachment promising to unveil US plans for Venezuela? Chinese cyberspies used just such a lure to target US government agencies and policy-related organizations in a phishing campaign that began just days after an American military operation captured Venezuelan President Nicolás Maduro.
Acronis Threat Research Unit discovered the campaign after finding a zip file named "US now deciding what's next for Venezuela" uploaded in early January to VirusTotal. It contained a legitimate executable and a hidden, DLL-based backdoor called Lotuslite.
This combination, along with other factors such as infrastructure and technical overlaps, helped the security sleuths attribute the phishing campaign with "moderate confidence" to a Beijing-backed espionage crew called [1]Mustang Panda (aka UNC6384, Twill Typhoon).
[2]
US law enforcement and cyber agents have [3]tracked Mustang Panda for years , and [4]blamed the snoops for breaking into "numerous government and private organizations" in the US, Europe, and the Indo-Pacific region.
[5]
[6]
In a Thursday report, Acronis' threat hunters detailed the crew's latest campaign and [7]provided a technical analysis of its new Lotuslite malware. One of the authors, threat intelligence research lead Santiago Pontiroli, said it's unknown if the PRC spies successfully compromised any targeted computers.
"This was a precise, targeted campaign, not a wide-reaching or random attack. The targeting appears selective rather than broad spray and pray," Pontiroli told The Register .
[8]
"The threat actor responsible fits into a broader pattern of ongoing cyberespionage activity that is opportunistic and event-responsive rather than static," he added. "In this particular campaign, the threat actor moved fast immediately after Maduro was captured."
Speaking of PRC operatives…
A suspected China-linked group known for targeting US critical infrastructure sectors [9]exploited CVE-2025-53690 , a ViewState deserialization zero-day vulnerability in SiteCore products, and used this security hole to gain initial access to victims' environments.
Cisco Talos, which tracks the crew as UAT-8837, assesses "with medium confidence" that the group is a "China-nexus advanced persistent threat (APT) actor."
The September attacks abusing CVE-2025-53690 indicate that "UAT-8837 may have access to zero-day exploits," Talos said in a Thursday [10]report .
Mustang Panda, as with its previous phishing expeditions, aligned its cyber operation with current geopolitical events. In this case, it was Maduro's capture, while earlier campaigns used lures tied to [11]diplomatic conferences and [12]region-specific political events .
[13]Suspected Chinese snoops weaponize unpatched Windows flaw to spy on European diplomats
[14]Google issued 'State-backed attack in progress' warnings after spotting web hijack scheme
[15]FBI wipes Chinese PlugX malware from thousands of Windows PCs in America
[16]China-linked cybercrims abused VMware ESXi zero-days a year before disclosure
"Operationally, Mustang Panda favors medium-complexity, repeatable execution techniques, most notably the extensive use of DLL sideloading to deploy custom implants via benign or trusted executables," the threat research unit wrote.
Additional analysis of the zip archive revealed an executable launcher named "Maduro to be taken to New York" - this turned out to be a renamed launcher binary for a [17]music streaming service owned by Tencent - plus a hidden, malicious DLL called kugou.
Kugou.dll, according to the researchers, turned out to be a never-before-seen backdoor that they named Lotuslite. The custom C++ implant communicates with a hard-coded, IP-based command-and-control server. It establishes persistence on infected machines, performs beaconing tasks and allows operators to steal data from victims' environments. ®
Get our [18]Tech Resources
[1] https://www.theregister.com/2025/08/27/google_china_captive_portal_hijack_warning/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aWlxlRDWmm5mFOdf0fxa_QAAA5c&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://www.theregister.com/2023/06/23/camaro_dragon_usb_malware_spreads/
[4] https://www.theregister.com/2025/01/14/fbi_french_cops_boot_chinas/
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aWlxlRDWmm5mFOdf0fxa_QAAA5c&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aWlxlRDWmm5mFOdf0fxa_QAAA5c&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www.acronis.com/en/tru/posts/lotuslite-targeted-espionage-leveraging-geopolitical-themes/
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aWlxlRDWmm5mFOdf0fxa_QAAA5c&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://www.theregister.com/2025/09/04/unknown_miscreants_snooping_around_sitecore/
[10] https://blog.talosintelligence.com/uat-8837/
[11] https://www.theregister.com/2025/10/30/suspected_chinese_snoops_abuse_unpatched/
[12] https://www.virustotal.com/gui/file/9335e9ec308de135651bec4b3f2f4f43324e7ab40329796e6d4343698c8a0d2a/relations
[13] https://www.theregister.com/2025/10/30/suspected_chinese_snoops_abuse_unpatched/
[14] https://www.theregister.com/2025/08/27/google_china_captive_portal_hijack_warning/
[15] https://www.theregister.com/2025/01/14/fbi_french_cops_boot_chinas/
[16] https://www.theregister.com/2026/01/09/china_esxi_zerodays/
[17] https://www.kugou.com/
[18] https://whitepapers.theregister.com/
Acronis Threat Research Unit discovered the campaign after finding a zip file named "US now deciding what's next for Venezuela" uploaded in early January to VirusTotal. It contained a legitimate executable and a hidden, DLL-based backdoor called Lotuslite.
This combination, along with other factors such as infrastructure and technical overlaps, helped the security sleuths attribute the phishing campaign with "moderate confidence" to a Beijing-backed espionage crew called [1]Mustang Panda (aka UNC6384, Twill Typhoon).
[2]
US law enforcement and cyber agents have [3]tracked Mustang Panda for years , and [4]blamed the snoops for breaking into "numerous government and private organizations" in the US, Europe, and the Indo-Pacific region.
[5]
[6]
In a Thursday report, Acronis' threat hunters detailed the crew's latest campaign and [7]provided a technical analysis of its new Lotuslite malware. One of the authors, threat intelligence research lead Santiago Pontiroli, said it's unknown if the PRC spies successfully compromised any targeted computers.
"This was a precise, targeted campaign, not a wide-reaching or random attack. The targeting appears selective rather than broad spray and pray," Pontiroli told The Register .
[8]
"The threat actor responsible fits into a broader pattern of ongoing cyberespionage activity that is opportunistic and event-responsive rather than static," he added. "In this particular campaign, the threat actor moved fast immediately after Maduro was captured."
Speaking of PRC operatives…
A suspected China-linked group known for targeting US critical infrastructure sectors [9]exploited CVE-2025-53690 , a ViewState deserialization zero-day vulnerability in SiteCore products, and used this security hole to gain initial access to victims' environments.
Cisco Talos, which tracks the crew as UAT-8837, assesses "with medium confidence" that the group is a "China-nexus advanced persistent threat (APT) actor."
The September attacks abusing CVE-2025-53690 indicate that "UAT-8837 may have access to zero-day exploits," Talos said in a Thursday [10]report .
Mustang Panda, as with its previous phishing expeditions, aligned its cyber operation with current geopolitical events. In this case, it was Maduro's capture, while earlier campaigns used lures tied to [11]diplomatic conferences and [12]region-specific political events .
[13]Suspected Chinese snoops weaponize unpatched Windows flaw to spy on European diplomats
[14]Google issued 'State-backed attack in progress' warnings after spotting web hijack scheme
[15]FBI wipes Chinese PlugX malware from thousands of Windows PCs in America
[16]China-linked cybercrims abused VMware ESXi zero-days a year before disclosure
"Operationally, Mustang Panda favors medium-complexity, repeatable execution techniques, most notably the extensive use of DLL sideloading to deploy custom implants via benign or trusted executables," the threat research unit wrote.
Additional analysis of the zip archive revealed an executable launcher named "Maduro to be taken to New York" - this turned out to be a renamed launcher binary for a [17]music streaming service owned by Tencent - plus a hidden, malicious DLL called kugou.
Kugou.dll, according to the researchers, turned out to be a never-before-seen backdoor that they named Lotuslite. The custom C++ implant communicates with a hard-coded, IP-based command-and-control server. It establishes persistence on infected machines, performs beaconing tasks and allows operators to steal data from victims' environments. ®
Get our [18]Tech Resources
[1] https://www.theregister.com/2025/08/27/google_china_captive_portal_hijack_warning/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aWlxlRDWmm5mFOdf0fxa_QAAA5c&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://www.theregister.com/2023/06/23/camaro_dragon_usb_malware_spreads/
[4] https://www.theregister.com/2025/01/14/fbi_french_cops_boot_chinas/
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aWlxlRDWmm5mFOdf0fxa_QAAA5c&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aWlxlRDWmm5mFOdf0fxa_QAAA5c&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www.acronis.com/en/tru/posts/lotuslite-targeted-espionage-leveraging-geopolitical-themes/
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aWlxlRDWmm5mFOdf0fxa_QAAA5c&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://www.theregister.com/2025/09/04/unknown_miscreants_snooping_around_sitecore/
[10] https://blog.talosintelligence.com/uat-8837/
[11] https://www.theregister.com/2025/10/30/suspected_chinese_snoops_abuse_unpatched/
[12] https://www.virustotal.com/gui/file/9335e9ec308de135651bec4b3f2f4f43324e7ab40329796e6d4343698c8a0d2a/relations
[13] https://www.theregister.com/2025/10/30/suspected_chinese_snoops_abuse_unpatched/
[14] https://www.theregister.com/2025/08/27/google_china_captive_portal_hijack_warning/
[15] https://www.theregister.com/2025/01/14/fbi_french_cops_boot_chinas/
[16] https://www.theregister.com/2026/01/09/china_esxi_zerodays/
[17] https://www.kugou.com/
[18] https://whitepapers.theregister.com/