Microsoft-Signed Binary Used to Sneak LOTUSLITE Into India

Cybersecuritynews •Tushar Subhra Dutta • April 22, 2026

A state-linked threat group has been caught running a quiet but carefully planned espionage operation against India’s banking sector, using a trusted Microsoft-signed file to slip malware past security defenses. The campaign delivers a new version of the LOTUSLITE backdoor through a technique known as DLL sideloading, which exploits the trust that operating systems place […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Microsoft-Signed Tooling Used in LOTUSLITE Espionage Against India's Banking Sector A new variant of the LOTUSLITE backdoor has been deployed against India's banking sector using a Microsoft-signed developer tool. Researchers attribute this campaign to the Mustang Panda espionage group, linked to Chinese state interests. The backdoor provides remote shell access and file operations, focusing on espionage rather than financial gain. The attack employs DLL sideloading to bypass security measures, exploiting the trust placed in Microsoft-signed binaries. This operation highlights vulnerabilities in trusted software that can be leveraged for state-sponsored cyber espionage. The full scope of the impact is still being assessed, but the targeted sector is critical to India's economy. Current mitigation strategies are not detailed in the articles. Ongoing investigations are expected to provide further insights into the attack vector and potential defenses. 2 sources 73

Extracted Entities

Microsoft-Signed Binary Used to Sneak LOTUSLITE Into India

The full story

Extracted Entities

Attack Types (1)

Countries (1)

Malware (1)

MITRE ATT&CK (1)