Microsoft-Signed Binary Used to Sneak LOTUSLITE Into India-Focused Espionage Campaign

A state-linked threat actor (assessed as Mustang Panda) conducted a stealthy espionage campaign targeting India's banking sector by delivering a new LOTUSLITE backdoor via DLL sideloading of a legitimate Microsoft-signed executable; the implant supports remote shell, file operations and session management and communicates with a dynamic DNS-based C2 over HTTPS, with the same infrastructure observed in parallel Korea-focused activity.