Lotus Blossom

Introduction

Lotus Blossom is a long-standing threat group largely targeting various entities in Asia since at least 2009. In addition to government and related targets, Lotus Blossom has also targeted entities such as digital certificate issuers. Lotus Blossom Jun 2015 Symantec Bilbug 2022 Cisco LotusBlossom 2025

Activities and Tactics

Targeted Sectors: Private sector

Country of Origin: 🇨🇳 China

Incident Type: Espionage

Suspected Victims: United States

Notable Campaigns

Information pending cataloguing.

Tactics, Techniques, and Procedures (TTPs)

• T1016 System Network Configuration Discovery
• T1543.003 Windows Service
• T1087.002 Domain Account
• T1074.001 Local Data Staging
• T1134 Access Token Manipulation
• T1087.001 Local Account
• T1090.001 Internal Proxy
• T1539 Steal Web Session Cookie
• T1112 Modify Registry
• T1049 System Network Connections Discovery
• T1047 Windows Management Instrumentation
• T1482 Domain Trust Discovery
• T1016.001 Internet Connection Discovery
• T1090.003 Multi-hop Proxy
• T1588.002 Tool
• T1018 Remote System Discovery
• T1083 File and Directory Discovery
• T1560.003 Archive via Custom Method
• T1560.001 Archive via Utility
• T1046 Network Service Discovery
• T1012 Query Registry

ATT&CK technique IDs (denormalized)

• T1012
• T1016
• T1016.001
• T1018
• T1046
• T1047
• T1049
• T1074.001
• T1083
• T1087.001
• T1087.002
• T1090.001
• T1090.003
• T1112
• T1134
• T1482
• T1539
• T1543.003
• T1560.001
• T1560.003
• T1588.002

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

MITRE ATT&CK Software

• AdFind (S0552) — tool
• Ping (S0097) — tool
• Impacket (S0357) — tool
• Emissary (S0082) — malware
• Elise (S0081) — malware
• Hannotog (S1211) — malware
• NBTscan (S0590) — tool
• Sagerunex (S1210) — malware
• certutil (S0160) — tool

Attribution and Evidence

Country of Origin: China Additional attribution information pending cataloguing.

References

[1] mitre-attack [9] Accenture Dragonfish Jan 2018 Accenture Security. (2018, January 27). DRAGONFISH DELIVERS NEW FORM OF ELISE MALWARE TARGETING ASEAN DEFENCE MINISTERS’ MEETING AND ASSOCIATES. Retrieved November 17, 2024. [10] Spring Dragon Jun 2015 Baumgartner, K.. (2015, June 17). The Spring Dragon APT. Retrieved February 15, 2016. [11] Lotus Blossom Jun 2015 Falcone, R., et al.. (2015, June 16). Operation Lotus Blossom. Retrieved February 15, 2016. [12] Cisco LotusBlossom 2025 Joey Chen, Cisco Talos. (2025, February 27). Lotus Blossom espionage group targets multiple industries with different versions of Sagerunex and hacking tools. Retrieved March 15, 2025. [13] Microsoft Threat Actor Naming July 2023 Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023. [14] Symantec Bilbug 2022 Symntec Threat Hunter Team. (2022, November 12). Billbug: State-sponsored Actor Targets Cert Authority, Government Agencies in Multiple Asian Countries. Retrieved March 15, 2025.