DLL Sideloading at Scale: From LOTUSLITE Espionage to Multi Actor Malware

Du'aine Davis

Observed in the wild

• Recent investigations by Acronis and Trellix reveal multiple active campaigns abusing DLL sideloading to compromise victims across US government entities and global commercial sectors including finance, procurement and supply‑chain roles. The attacks leveraged politically themed ZIP archives, renamed legitimate binaries, and business‑document lures to deliver malicious DLLs. Victim profiles indicate both espionage‑focused APT activity and commodity‑malware distribution.
• Across the campaigns, threat actors consistently abused DLL search‑order hijacking by placing a malicious DLL with a trusted module’s expected filename alongside a legitimate, signed executable. In Acronis’s LOTUSLITE case, a renamed KuGou launcher explicitly invoked kugou.dll, allowing the implant to run under a trusted process. Trellix observed similar sideloading of ahost.exe, a signed c‑ares component, using a forged libcares‑2.dll, enabling controlled code execution, evasion of signature‑based tooling and alignment with both Mustang Panda TTPs and multi‑actor commodity‑malware activity.
• Defenders are advised to monitor for unsigned or unexpected DLLs loaded by trusted signed binaries, especially KuGou launchers and ahost.exe variants renamed as lures. Use Microsoft Defender ASR rules to block abnormal DLL loads, enforce application control/allow‑listing, and inspect WinHTTP outbound traffic with spoofed User‑Agents or suspicious POST patterns. Hunt for search‑order hijacking, anomalous child processes, and persistence paths such as ProgramData‑based folders or registry Run‑key entries created by implanted loaders.

LOTUSLITE: Targeted espionage leveraging geopolitical themes

Hiding in Plain Sight: Multi-Actor ahost.exe Attacks