{"id":1175369,"date":"2026-06-12T13:30:48","date_gmt":"2026-06-12T20:30:48","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/research\/?p=1175369"},"modified":"2026-06-12T13:30:50","modified_gmt":"2026-06-12T20:30:50","slug":"ire-identifies-another-lotuslite-specimen","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/research\/blog\/ire-identifies-another-lotuslite-specimen\/","title":{"rendered":"Ire identifies another LOTUSLITE specimen"},"content":{"rendered":"\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1400\" height=\"788\" src=\"https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2026\/06\/ProjectIre-BlogHeroFeature-1400x788-1.jpg\" alt=\"Project Ire | | three white line icons on an abstract purple background | greater than \/ less than icon, search icon, shield icon\" class=\"wp-image-1175384\" srcset=\"https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2026\/06\/ProjectIre-BlogHeroFeature-1400x788-1.jpg 1400w, https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2026\/06\/ProjectIre-BlogHeroFeature-1400x788-1-300x169.jpg 300w, https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2026\/06\/ProjectIre-BlogHeroFeature-1400x788-1-1024x576.jpg 1024w, https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2026\/06\/ProjectIre-BlogHeroFeature-1400x788-1-768x432.jpg 768w, https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2026\/06\/ProjectIre-BlogHeroFeature-1400x788-1-1066x600.jpg 1066w, https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2026\/06\/ProjectIre-BlogHeroFeature-1400x788-1-655x368.jpg 655w, https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2026\/06\/ProjectIre-BlogHeroFeature-1400x788-1-240x135.jpg 240w, https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2026\/06\/ProjectIre-BlogHeroFeature-1400x788-1-640x360.jpg 640w, https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2026\/06\/ProjectIre-BlogHeroFeature-1400x788-1-960x540.jpg 960w, https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2026\/06\/ProjectIre-BlogHeroFeature-1400x788-1-1280x720.jpg 1280w\" sizes=\"auto, (max-width: 1400px) 100vw, 1400px\" \/><\/figure>\n\n\n\n<div style=\"padding-bottom:0; padding-top:0\" class=\"wp-block-msr-immersive-section alignfull row wp-block-msr-immersive-section\">\n\t\n\t<div class=\"container\">\n\t\t<div class=\"wp-block-msr-immersive-section__inner wp-block-msr-immersive-section__inner--narrow\">\n\t\t\t<div class=\"wp-block-columns mb-10 pb-1 pr-1 is-layout-flex wp-container-core-columns-is-layout-9d6595d7 wp-block-columns-is-layout-flex\" style=\"box-shadow:var(--wp--preset--shadow--outlined)\">\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\">\n<h2 class=\"wp-block-heading h3\" id=\"at-a-glance\">At a glance<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Project Ire identifies a LOTUSLITE variant that shares TTPs (tools, tactics, procedures) with the public family but none of its indicators of compromise (IOC).&nbsp;<\/li>\n\n\n\n<li>The LLM-driven agent produces a function-by-function behavioral report on the sample without any user interaction to determine whether it is malicious.<\/li>\n\n\n\n<li>The binary names a threat actor in cleartext; the agent declines to attribute and instead focuses on statically analyzing the behaviors.<\/li>\n<\/ul>\n<\/div>\n<\/div>\t\t<\/div>\n\t<\/div>\n\n\t<\/div>\n\n\n\n<p>We pointed <a href=\"https:\/\/www.microsoft.com\/en-us\/research\/project\/project-ire\/\" type=\"msr-project\" id=\"1144806\">Project Ire<\/a>, Microsoft&#8217;s autonomous malware-classification agent, at a malware sample\u2014blind\u2014and asked for a verdict. The sample is a variant of LOTUSLITE, a Windows DLL backdoor recently documented by Acronis. Our copy&#8217;s hash isn&#8217;t in their IOC list, and as of June 4, most major EDRs (CrowdStrike Falcon, SentinelOne, Sophos, Trellix, Palo Alto, ESET) still don&#8217;t flag it as malware. Ire produced a function-by-function behavioral report\u2014install routine, C2 packet layout, command IDs, persistence mechanism, obfuscation\u2014that lines up with Acronis&#8217;s published analysis. One decompiler-based run, no human priors.<\/p>\n\n\n\n<p>This is what behavioral, agentic reverse engineering can achieve when signature matching and manual inspections fall short. Variants that share TTPs but not indicators of compromise (IOC) get caught instead of slipping past signature lists. Novel malware classification is a domain with no automatic validator, requiring in-depth investigation and holistic understanding of the software\u2019s behaviors to surface and determine intent. Ire operates without context: no origin metadata, no telemetry, no analyst prompt. It invokes decompilers and binary-analysis tools, builds an auditable chain of evidence, and reaches a malicious-or-benign verdict.<\/p>\n\n\n\n<p>Acronis&#8217;s Threat Research Unit (TRU) <a class=\"msr-external-link glyph-append glyph-append-open-in-new-tab glyph-append-xsmall\" href=\"https:\/\/www.acronis.com\/en\/tru\/posts\/lotuslite-targeted-espionage-leveraging-geopolitical-themes\/\" type=\"link\" id=\"https:\/\/www.acronis.com\/en\/tru\/posts\/lotuslite-targeted-espionage-leveraging-geopolitical-themes\/\" target=\"_blank\" rel=\"noopener noreferrer\">published a writeup<span class=\"sr-only\"> (opens in new tab)<\/span><\/a> on LOTUSLITE, a DLL backdoor delivered through a politically themed ZIP, sideloaded through a renamed Tencent KuGou launcher. They attribute it to Mustang Panda at moderate confidence based on infrastructure overlap and the loader\/DLL split. Hunting on VirusTotal for samples whose behavior matched the report, we surfaced one whose SHA-256 doesn&#8217;t appear in Acronis&#8217;s IOC list.<\/p>\n\n\n\n<p>The sample:\u202f<a class=\"msr-external-link glyph-append glyph-append-open-in-new-tab glyph-append-xsmall\" href=\"https:\/\/www.virustotal.com\/gui\/file\/47e51e82229e80a387c3cb100d39d3705e6360bbf9bfa1601dbc484e8d02e653\" type=\"link\" id=\"https:\/\/www.virustotal.com\/gui\/file\/47e51e82229e80a387c3cb100d39d3705e6360bbf9bfa1601dbc484e8d02e653\" target=\"_blank\" rel=\"noopener noreferrer\">47e51e82229e80a387c3cb100d39d3705e6360bbf9bfa1601dbc484e8d02e653<span class=\"sr-only\"> (opens in new tab)<\/span><\/a>. When we picked it up on May 28, VirusTotal showed\u202f1 of 72 vendors\u202fflagging it.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1120\" height=\"272\" src=\"https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2026\/06\/detections_initial.png\" alt=\"A screenshot of a 253 KB sample on VirusTotal taken on May 28, 2026 showing that only one of 72 vendors flagged this as malicious. \" class=\"wp-image-1175443\" srcset=\"https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2026\/06\/detections_initial.png 1120w, https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2026\/06\/detections_initial-300x73.png 300w, https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2026\/06\/detections_initial-1024x249.png 1024w, https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2026\/06\/detections_initial-768x187.png 768w, https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2026\/06\/detections_initial-240x58.png 240w\" sizes=\"auto, (max-width: 1120px) 100vw, 1120px\" \/><figcaption class=\"wp-element-caption\">Figure 1. File Sample 47e51e82229e80a387c3cb100d39d3705e6360bbf9bfa1601dbc484e8d02e653 detection state on VirusTotal on May 28, 2026.<\/figcaption><\/figure>\n\n\n\n<p>A week later, that rose to 7 of 70. The cluster: Microsoft\u202fTrojan:Win32\/Malgent!MSR, Kaspersky\u202fHEUR:Trojan-Dropper.Win32.Dorifel.gen, Rising\u202fDropper.Dorifel!8.31E (CLOUD), Cynet (score 100), Elastic (moderate confidence), Kingsoft, TrendMicro-HouseCall. With Microsoft now flagging, VT&#8217;s popular threat label has shifted to\u202fdropper.dorifel \/ malgent. CrowdStrike Falcon, SentinelOne, Sophos, Trellix, Palo Alto, and ESET still miss it. VT lists the file type as\u202fpedll\u202f(PE DLL) and the filename as\u202fSmartPrintScreen.Print.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1265\" height=\"760\" src=\"https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2026\/06\/detections_later.png\" alt=\"A screenshot of the same 253KB sample on June 4, 2026 showing that 7 of 70 security vendors have identified this sample as malicious: Cynet, Kaspersky, Microsoft, TrendMicro-HouseCall, Elastic, Kingsoft, Rising, and Acronis (Static MIL). \" class=\"wp-image-1175447\" srcset=\"https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2026\/06\/detections_later.png 1265w, https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2026\/06\/detections_later-300x180.png 300w, https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2026\/06\/detections_later-1024x615.png 1024w, https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2026\/06\/detections_later-768x461.png 768w, https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2026\/06\/detections_later-240x144.png 240w\" sizes=\"auto, (max-width: 1265px) 100vw, 1265px\" \/><figcaption class=\"wp-element-caption\">Figure 2. File Sample 47e51e82229e80a387c3cb100d39d3705e6360bbf9bfa1601dbc484e8d02e653 detection state on VirusTotal on June 4, 2026.<\/figcaption><\/figure>\n\n\n\n<p>We analyzed the sample with Ire, using only its decompiler-based tools through a single tool call. Ire&#8217;s verdict was\u202f\u201cmalicious\u201d; you can review the complete report <a class=\"msr-external-link glyph-append glyph-append-open-in-new-tab glyph-append-xsmall\" href=\"https:\/\/nam06.safelinks.protection.outlook.com\/?url=https%3A%2F%2Fgithub.com%2Fmicrosoft%2Fproject-ire%2Fblob%2Fmain%2Freports%2F47e51e82229e80a387c3cb100d39d3705e6360bbf9bfa1601dbc484e8d02e653.md&data=05%7C02%7Csmithsarah%40microsoft.com%7Cabbc5bb6be7e4ddca50b08dec7d70737%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C639167923516521150%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=rr4gCWnGCAHITM4ARAtVXqu66UzUVqByMacq%2BsOmNQ8%3D&reserved=0\" target=\"_blank\" rel=\"noopener noreferrer\">on Github<span class=\"sr-only\"> (opens in new tab)<\/span><\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"on-ire-s-calibration\">On Ire&#8217;s calibration<\/h2>\n\n\n\n<p>One noteworthy observation in <a class=\"msr-external-link glyph-append glyph-append-open-in-new-tab glyph-append-xsmall\" href=\"https:\/\/github.com\/microsoft\/project-ire\/blob\/main\/reports\/47e51e82229e80a387c3cb100d39d3705e6360bbf9bfa1601dbc484e8d02e653.md\" type=\"link\" id=\"https:\/\/github.com\/microsoft\/project-ire\/blob\/main\/reports\/47e51e82229e80a387c3cb100d39d3705e6360bbf9bfa1601dbc484e8d02e653.md\" target=\"_blank\" rel=\"noopener noreferrer\">Ire\u2019s report<span class=\"sr-only\"> (opens in new tab)<\/span><\/a> is worth highlighting first. Ire flagged the nfapi::nf_unRegisterDriver and NetFilter naming as suspicious but explicitly did\u202fnot\u202fclaim active packet interception. The function in question writes the Run key; it does not install a driver. This is where LLM-driven analysis can go wrong: suggestive strings can steer the verdict. A function called nf_unRegisterDriver sounds\u202flike it does kernel-level work, and a less thorough agent would write that into the report. Downstream defenders would then chase a phantom, building detection rules for behavior that may or may not be there. Ire flagged the misleading name and considered the behavior as one piece of the evidence during its final adjudication of malice.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"comparing-the-two-reports\">Comparing the two reports<\/h2>\n\n\n\n<figure class=\"wp-block-table is-style-stripes\"><table><thead><tr><th><\/th><th>Acronis specimen<\/th><th>Our sample<\/th><\/tr><\/thead><tbody><tr><td>Sample type<\/td><td>loader EXE +\u202fkugou.dll<\/td><td>the malicious DLL itself:\u202fAMPV.dll\u202f(VT type\u202fpedll)<\/td><\/tr><tr><td>Install dir<\/td><td>C:\\ProgramData\\Technology360NB\\<\/td><td>C:\\ProgramData\\SmartPrint\\<\/td><\/tr><tr><td>Installed exe<\/td><td>DataTechnology.exe<\/td><td>SmartPrintScreen.exe<\/td><\/tr><tr><td>Run-key value<\/td><td>Lite360<\/td><td>DadaBank<\/td><\/tr><tr><td>Marker arg<\/td><td>&#8211;DATA<\/td><td>&#8211;DaDaBar<\/td><\/tr><tr><td>C2 magic<\/td><td>0x8899AABB<\/td><td>0xB2EBCFDF<\/td><\/tr><tr><td>Lure<\/td><td>politically themed ZIP, Venezuela-themed launcher<\/td><td>fake &#8220;PDF corrupted&#8221; message box<\/td><\/tr><tr><td>Mustang Panda link<\/td><td>infra and TTP overlap, moderate confidence (Acronis&#8217;s call)<\/td><td>not independently assessed; binary contains the literal string\u202fBelievemeIamMustang-Panda<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>Comparing Ire\u2019s output with Acronis\u2019 report, the sample we analyzed matches the behavioral profile of the LOTUSLITE family of malware. Both show a loader\/DLL split, HTTPS C2 carrying a custom binary protocol with a magic DWORD, interactive shell over pipes, directory enumeration, file primitives, chunked upload, HKCU persistence, and traffic camouflaged as Google and Microsoft services. The surface details differ\u2014filenames, paths, magic value\u2014but the underlying behaviors align. Ire correctly identified this sample as part of the same family of malware because of the behaviors it was able to identify through decompilation and reverse engineering, not on string match alone.<\/p>\n\n\n\n<p>Because the sample is a DLL (pedll\u202fper VT), the sample&#8217;s install routine reads differently than it might look at first. The DLL copies two files into C:\\ProgramData\\SmartPrint\\: the loader EXE that sideloaded it (its host process, obtained via GetModuleFileName(NULL), written as\u202fSmartPrintScreen.exe) and itself (AMPV.dll, the analyzed sample). The Run key points at the loader with\u202f&#8211;DaDaBar. On the next logon, the loader runs and sideloads AMPV.dll from the install path. This is the same Acronis-identified pattern but with different filenames.<\/p>\n\n\n\n<p>This also explains the binary&#8217;s strange export surface. The DLL exports a long list of banking and QR-themed names (Query_Bank,\u202fBankSepah_Iran,\u202fBankToman_BMI,\u202fBankofChina,\u202fqrBankInit,\u202fJpgSymbolToBMP, and others), most of which resolve to a message box or ExitProcess. The shape suggests a hijacked banking\/QR SDK shell, repurposed so the host EXE can call any one of those exports via GetProcAddress and reach the LOTUSLITE entry point. Acronis names theirs DataImporterMain. The Ire report does not surface a matching entry-point name, but it identifies that the behavioral shape is the same.<\/p>\n\n\n\n<p>Acronis attributes the malware family to Mustang Panda at moderate confidence based on infrastructure and TTPs we don&#8217;t have access to, while our sample directly contains a literal actor-name string \u201cBelievemeIamMustang-Panda\u201d with no obfuscation. A string isn&#8217;t direct proof of authorship; it could be a developer artifact, a trophy, or a deliberate plant. While we are not making an attribution call, we note that the binary names the same actor that Acronis named through other means, and we leave the question open. Another consideration to make for this finding: a string like this can function as adversarial input to LLM-driven analysis, biasing the verdict.<\/p>\n\n\n\n\t<div class=\"border-bottom border-top border-gray-300 mt-5 mb-5 msr-promo text-center text-md-left alignwide\" data-bi-aN=\"promo\" data-bi-id=\"1002645\">\n\t\t\n\n\t\t<p class=\"msr-promo__label text-gray-800 text-center text-uppercase\">\n\t\t<span class=\"px-4 bg-white display-inline-block font-weight-semibold small\">Spotlight: AI-POWERED EXPERIENCE<\/span>\n\t<\/p>\n\t\n\t<div class=\"row pt-3 pb-4 align-items-center\">\n\t\t\t\t\t\t<div class=\"msr-promo__media col-12 col-md-5\">\n\t\t\t\t<a class=\"bg-gray-300 display-block\" href=\"https:\/\/aka.ms\/research-copilot\/?OCID=msr_researchforum_Copilot_MCR_Blog_Promo\" aria-label=\"Microsoft research copilot experience\" data-bi-cN=\"Microsoft research copilot experience\" target=\"_blank\">\n\t\t\t\t\t<img decoding=\"async\" class=\"w-100 display-block\" src=\"https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2024\/01\/MSR-Chat-Promo.png\" alt=\"\" \/>\n\t\t\t\t<\/a>\n\t\t\t<\/div>\n\t\t\t\n\t\t\t<div class=\"msr-promo__content p-3 px-5 col-12 col-md\">\n\n\t\t\t\t\t\t\t\t\t<h2 class=\"h4\">Microsoft research copilot experience<\/h2>\n\t\t\t\t\n\t\t\t\t\t\t\t\t<p id=\"microsoft-research-copilot-experience\" class=\"large\">Discover more about research at Microsoft through our AI-powered experience<\/p>\n\t\t\t\t\n\t\t\t\t\t\t\t\t<div class=\"wp-block-buttons justify-content-center justify-content-md-start\">\n\t\t\t\t\t<div class=\"wp-block-button\">\n\t\t\t\t\t\t<a href=\"https:\/\/aka.ms\/research-copilot\/?OCID=msr_researchforum_Copilot_MCR_Blog_Promo\" aria-describedby=\"microsoft-research-copilot-experience\" class=\"btn btn-brand glyph-append glyph-append-chevron-right\" data-bi-cN=\"Microsoft research copilot experience\" target=\"_blank\">\n\t\t\t\t\t\t\tStart now\t\t\t\t\t\t<\/a>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t<\/div><!--\/.msr-promo__content-->\n\t<\/div><!--\/.msr-promo__inner-wrap-->\n\t<\/div><!--\/.msr-promo-->\n\t\n\n\n<h2 class=\"wp-block-heading\" id=\"why-this-matters\">Why this matters<\/h2>\n\n\n\n<p>Ire statically reverse-engineers binaries and identifies the behavior from the function to the system level to describe what the software does and determine a verdict. The verdict of this sample came from a single Ire run because of the specific detail Ire was able to surface: function roles, packet layout, command IDs, persistence registry keys, and decoy strings. Ire never named LOTUSLITE in its report or chain of evidence. The family mapping is ours, after the fact, comparing Ire\u2019s report against Acronis report. Ire described the behavior precisely enough to make the mapping straightforward of this sample to LOTUSLITE.<\/p>\n\n\n\n<p>Stay up to date on the latest findings and other interesting sample detections from Project Ire by following along on our <a href=\"https:\/\/www.microsoft.com\/en-us\/research\/project\/project-ire\/\" type=\"msr-project\" id=\"1144806\">project page<\/a>.<\/p>\n\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\">\n<div class=\"wp-block-button is-style-fill-github\"><a data-bi-type=\"button\" class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/github.com\/microsoft\/project-ire\/blob\/main\/reports\/47e51e82229e80a387c3cb100d39d3705e6360bbf9bfa1601dbc484e8d02e653.md\" target=\"_blank\" rel=\"noreferrer noopener\">View Ire&#8217;s system output report<\/a><\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Project Ire examined a timely malware sample and determined its intent through reverse engineering\u2014identifying LOTUSLITE characteristics even as most major EDR tools did not detect it.<\/p>\n","protected":false},"author":43868,"featured_media":1175384,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"msr-url-field":"","msr-podcast-episode":"","msrModifiedDate":"","msrModifiedDateEnabled":false,"ep_exclude_from_search":false,"_classifai_error":"","msr-author-ordering":[{"type":"user_nicename","value":"Brian Caswell","user_id":"39420"},{"type":"user_nicename","value":"Bob Fleck","user_id":"43918"},{"type":"user_nicename","value":"Mike Walker","user_id":"39150"}],"msr_hide_image_in_river":0,"footnotes":""},"categories":[1],"tags":[],"research-area":[13558],"msr-region":[],"msr-event-type":[],"msr-locale":[268875],"msr-post-option":[243984],"msr-impact-theme":[],"msr-promo-type":[],"msr-podcast-series":[],"class_list":["post-1175369","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-research-blog","msr-research-area-security-privacy-cryptography","msr-locale-en_us","msr-post-option-blog-homepage-featured"],"msr_event_details":{"start":"","end":"","location":""},"podcast_url":"","podcast_episode":"","msr_research_lab":[],"msr_impact_theme":[],"related-publications":[],"related-downloads":[],"related-videos":[],"related-academic-programs":[],"related-groups":[],"related-projects":[1144806],"related-events":[],"related-researchers":[{"type":"user_nicename","value":"Brian Caswell","user_id":39420,"display_name":"Brian Caswell","author_link":"<a href=\"https:\/\/www.microsoft.com\/en-us\/research\/people\/bcaswell\/\" aria-label=\"Visit the profile page for Brian Caswell\">Brian Caswell<\/a>","is_active":false,"last_first":"Caswell, Brian","people_section":0,"alias":"bcaswell"},{"type":"user_nicename","value":"Bob Fleck","user_id":43918,"display_name":"Bob Fleck","author_link":"<a href=\"https:\/\/www.microsoft.com\/en-us\/research\/people\/bobfleck\/\" aria-label=\"Visit the profile page for Bob Fleck\">Bob Fleck<\/a>","is_active":false,"last_first":"Fleck, Bob","people_section":0,"alias":"bobfleck"},{"type":"user_nicename","value":"Mike Walker","user_id":39150,"display_name":"Mike Walker","author_link":"<a href=\"https:\/\/www.microsoft.com\/en-us\/research\/people\/walkerm\/\" aria-label=\"Visit the profile page for Mike Walker\">Mike Walker<\/a>","is_active":false,"last_first":"Walker, Mike","people_section":0,"alias":"walkerm"}],"msr_type":"Post","featured_image_thumbnail":"<img width=\"960\" height=\"540\" src=\"https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2026\/06\/ProjectIre-BlogHeroFeature-1400x788-1-960x540.jpg\" class=\"img-object-cover\" alt=\"Project Ire | | three white line icons on an abstract purple background | greater than \/ less than icon, search icon, shield icon\" decoding=\"async\" loading=\"lazy\" srcset=\"https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2026\/06\/ProjectIre-BlogHeroFeature-1400x788-1-960x540.jpg 960w, https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2026\/06\/ProjectIre-BlogHeroFeature-1400x788-1-300x169.jpg 300w, https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2026\/06\/ProjectIre-BlogHeroFeature-1400x788-1-1024x576.jpg 1024w, https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2026\/06\/ProjectIre-BlogHeroFeature-1400x788-1-768x432.jpg 768w, https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2026\/06\/ProjectIre-BlogHeroFeature-1400x788-1-1066x600.jpg 1066w, https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2026\/06\/ProjectIre-BlogHeroFeature-1400x788-1-655x368.jpg 655w, https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2026\/06\/ProjectIre-BlogHeroFeature-1400x788-1-240x135.jpg 240w, https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2026\/06\/ProjectIre-BlogHeroFeature-1400x788-1-640x360.jpg 640w, https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2026\/06\/ProjectIre-BlogHeroFeature-1400x788-1-1280x720.jpg 1280w, https:\/\/www.microsoft.com\/en-us\/research\/wp-content\/uploads\/2026\/06\/ProjectIre-BlogHeroFeature-1400x788-1.jpg 1400w\" sizes=\"auto, (max-width: 960px) 100vw, 960px\" \/>","byline":"<a href=\"https:\/\/www.microsoft.com\/en-us\/research\/people\/bcaswell\/\" title=\"Go to researcher profile for Brian Caswell\" aria-label=\"Go to researcher profile for Brian Caswell\" data-bi-type=\"byline author\" data-bi-cN=\"Brian Caswell\">Brian Caswell<\/a>, <a href=\"https:\/\/www.microsoft.com\/en-us\/research\/people\/bobfleck\/\" title=\"Go to researcher profile for Bob Fleck\" aria-label=\"Go to researcher profile for Bob Fleck\" data-bi-type=\"byline author\" data-bi-cN=\"Bob Fleck\">Bob Fleck<\/a>, and <a href=\"https:\/\/www.microsoft.com\/en-us\/research\/people\/walkerm\/\" title=\"Go to researcher profile for Mike Walker\" aria-label=\"Go to researcher profile for Mike Walker\" data-bi-type=\"byline author\" data-bi-cN=\"Mike Walker\">Mike Walker<\/a>","formattedDate":"June 12, 2026","formattedExcerpt":"Project Ire examined a timely malware sample and determined its intent through reverse engineering\u2014identifying LOTUSLITE characteristics even as most major EDR tools did not detect it.","locale":{"slug":"en_us","name":"English","native":"","english":"English"},"_links":{"self":[{"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/posts\/1175369","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/users\/43868"}],"replies":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/comments?post=1175369"}],"version-history":[{"count":19,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/posts\/1175369\/revisions"}],"predecessor-version":[{"id":1175508,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/posts\/1175369\/revisions\/1175508"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/media\/1175384"}],"wp:attachment":[{"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/media?parent=1175369"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/categories?post=1175369"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/tags?post=1175369"},{"taxonomy":"msr-research-area","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/research-area?post=1175369"},{"taxonomy":"msr-region","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/msr-region?post=1175369"},{"taxonomy":"msr-event-type","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/msr-event-type?post=1175369"},{"taxonomy":"msr-locale","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/msr-locale?post=1175369"},{"taxonomy":"msr-post-option","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/msr-post-option?post=1175369"},{"taxonomy":"msr-impact-theme","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/msr-impact-theme?post=1175369"},{"taxonomy":"msr-promo-type","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/msr-promo-type?post=1175369"},{"taxonomy":"msr-podcast-series","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/msr-podcast-series?post=1175369"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}