Ire identifies another LOTUSLITE specimen
| Source: Microsoft Research Blog
Tags: Microsoft, Project Ire, LOTUSLITE, malware, EDR, cybersecurity, LLM agents, Mustang Panda
Microsoft Research's autonomous malware-classification agent Project Ire identified a LOTUSLITE backdoor variant — attributed to Mustang Panda — that six major EDR vendors (CrowdStrike, SentinelOne, Sophos, Trellix, Palo Alto, ESET) missed, using decompiler-based behavioral analysis with no human input.
Details
Microsoft Research's Project Ire was tasked blind with a DLL sample whose hash didn't appear in any known IOC lists. The sample turned out to be a LOTUSLITE variant — a Windows backdoor attributed to the Mustang Panda APT group — that most commercial EDR products missed when analyzed on May 28, 2026. The agent produced a comprehensive behavioral report covering the binary's install routine, C2 packet layout, command IDs, persistence mechanism, and obfuscation techniques — matching Acronis's published analysis of the LOTUSLITE family. At the time, only 1 of 72 VirusTotal vendors flagged the sample; a week later that rose to 7 of 70, with major EDRs still silent. The significance is operational: variants that share tactics but not indicators of compromise routinely bypass signature-based detection. Ire's approach — behavioral, agentic static analysis without human priors or prior signatures — offers a complementary detection layer that flags variants based on what they do, not what they look like. The agent explicitly declined to attribute the malware despite cleartext threat actor names in the binary, focusing on statically verifiable behaviors rather than potentially contested attribution claims.