IC Technology & Cyber — 2026-04-22

Acronis and Cisco Talos attribute Mustang Panda LOTUSLITE backdoor pivot to Indian banking sector; Microsoft-signed DLL sideload

Acronis Threat Research Unit attributed with moderate confidence a new cyber-espionage campaign against Indian banking targets to PRC state-linked APT Mustang Panda, describing an updated LOTUSLITE backdoor delivered via spear-phishing CHM attachments that DLL-sideload through a legitimate Microsoft-signed binary. Researchers said the malware now references HDFCBankMain in its entry point and reuses dynamic-DNS infrastructure seen in prior Mustang Panda operations against government targets. Cisco Talos separately reported in its Q1 2026 IR Trends that phishing reemerged as the top initial-access vector and that public administration tied with healthcare as most-targeted verticals for a third consecutive quarter, with actors leveraging AI website builders to generate credential-harvesting pages.

Analysis
The HDFCBankMain export function naming and sector pivot from government to banking indicate Mustang Panda is very likely running collection requirements against Indian financial-sector transaction data as part of PRC economic-intelligence tasking tied to renewed India-US defence cooperation, a deliberate shift for an MSS-linked APT that typically works diplomatic and military lanes (converging Acronis and Cisco Talos IR telemetry, attribution bounded at moderate given commercial rather than SIGINT visibility). Talos Q1 2026 IR data separately documents AI-generated Softr credential-harvesting templates operationally for the first time, with phishing reemerging as top initial-access vector. Lower-skill actors adopting these scaffolds are likely to drive a measurable phishing resurgence by mid-2026. The HDFC reference and a KugouMain leftover in the payload suggest a contractor group working with Mustang Panda tooling rather than a tasking shift inside MSS, which would make the banking pivot opportunistic rather than strategic. The dual pattern likely reflects a two-tier PRC cyber posture: top-tier APTs retaining custom tooling while lower-tier affiliates absorb commoditized AI scaffolds.

2 sources

Attackers Use Microsoft-Signed Binary To Deploy LOTUSLITE In India-Focused Cyber Campaign - Cyber Security News
IR Trends Q1 2026: Phishing reemerges as top initial access vector, as attacks targeting public administration persist - Cisco Talos