Lotus Panda hits unnamed government with bespoke hacking tools and malware

• The group struck government, air control, and telco firms in Southeast Asia
• Victims were not named
• Lotus Panda used never-before-seen infostealers and loaders

Lotus Panda, a Chinese state-sponsored threat actor, managed to compromise multiple organizations in a number of Southeast-Asian countries, in a campaign that took place between mid-2024 and early 2025.

Cybersecurity researchers from the Symantec Threat Hunter Team said the organizations included government agencies, air traffic control organizations, telecom operators, and a construction company in one country, a news agency in another, and an air freight organization in another. The victim countries, or organizations, were not named.