Afternoon Review in IT Security — April 22, 2026

The threat landscape continues to evolve with sophisticated nation-state actors and organized cybercriminal groups deploying advanced malware targeting critical infrastructure and financial institutions across multiple regions. Today's briefing covers emerging threats from Chinese and North Korean threat actors, alongside destructive campaigns impacting Venezuela's energy sector.

Mustang Panda Hits India and S. Korea with Updated LOTUSLITE Backdoor

Acronis has identified a campaign by the Chinese-linked threat actor Mustang Panda deploying an updated LOTUSLITE backdoor against targets in India and South Korea. The malware leverages DLL sideloading techniques to establish persistent access on compromised systems. Indian banking institutions and Korean diplomatic entities represent the primary targets of this operation, indicating a focus on both financial and geopolitical intelligence gathering.

Source: Mustang Panda Hits India and S. Korea with Updated LOTUSLITE Backdoor

New Wiper Malware Targeted Venezuelan Energy Sector Prior to US Intervention

Researchers have discovered Lotus Wiper, a previously undocumented data destruction malware that targeted Venezuela's energy sector at the end of 2025 and into early 2026. The wiper malware employs sophisticated techniques to target recovery mechanisms, overwrite drives, and systematically delete files across infected systems. The timing and targeting of critical infrastructure suggest nation-state involvement in this destructive campaign.

Source: New Wiper Malware Targeted Venezuelan Energy Sector Prior to US Intervention

Lotus Wiper Malware Targets Venezuelan Energy Systems in Destructive Attack

Kaspersky's analysis confirms that Lotus Wiper represents a novel file wiper deployed in destructive attacks against Venezuela's energy and utilities sector. The malware employs batch scripts to initiate its destructive payload, systematically compromising operational systems across the targeted infrastructure. This campaign demonstrates the escalating threat of wiper malware being weaponized against critical national infrastructure.

Source: Lotus Wiper Malware Targets Venezuelan Energy Systems in Destructive Attack

North Korean Hackers Use AppleScript, ClickFix in Fresh macOS Attacks

North Korean threat actors have launched fresh campaigns targeting macOS systems, incorporating AppleScript and ClickFix techniques in their attack chains. Financial organizations represent the primary targets, with particular focus on cryptocurrency exchanges, venture capital firms, and blockchain-related entities. The Mach-O Man malware family has been identified as part of these coordinated operations against the financial sector.

Source: North Korean Hackers Use AppleScript, ClickFix in Fresh macOS Attacks

The convergence of multiple sophisticated threat actors targeting critical sectors underscores the heightened risk environment facing organizations globally. Security teams should prioritize detection of these malware families and implement robust defenses against both destructive and espionage-focused campaigns.