Attackers Use Microsoft-Signed Binary To Deploy LOTUSLITE In India-Focused Cyber Campaign

**Acronis TRU reports an active Mustang Panda-linked campaign targeting Indian banks using spear-phishing CHM files that drop a JavaScript loader and leverage DLL sideloading of a Microsoft-signed binary to deploy an updated LOTUSLITE backdoor; the malware includes new exports and a banking-themed entrypoint while leaving operational artifacts that aided attribution.**