Microsoft

Gbhackers •Mayura Kathir • April 22, 2026

Microsoft-signed developer tooling is being abused to quietly deploy a new LOTUSLITE backdoor variant against India’s banking sector, in what researchers link to the China‑nexus Mustang Panda espionage cluster with moderate confidence. The backdoor retains its espionage profile, offering remote shell access, file operations, and session management rather than any obvious monetization features. Communications are […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Microsoft-Signed Tooling Used in LOTUSLITE Espionage Against India's Banking Sector A new variant of the LOTUSLITE backdoor has been deployed against India's banking sector using a Microsoft-signed developer tool. Researchers attribute this campaign to the Mustang Panda espionage group, linked to Chinese state interests. The backdoor provides remote shell access and file operations, focusing on espionage rather than financial gain. The attack employs DLL sideloading to bypass security measures, exploiting the trust placed in Microsoft-signed binaries. This operation highlights vulnerabilities in trusted software that can be leveraged for state-sponsored cyber espionage. The full scope of the impact is still being assessed, but the targeted sector is critical to India's economy. Current mitigation strategies are not detailed in the articles. Ongoing investigations are expected to provide further insights into the attack vector and potential defenses. 2 sources 73

Extracted Entities

Microsoft

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Countries (1)

Malware (1)

MITRE ATT&CK (1)