Introduction
Lotus Blossom is a long-standing threat group largely targeting various entities in Asia since at least 2009. In addition to government and related targets, Lotus Blossom has also targeted entities such as digital certificate issuers. Lotus Blossom Jun 2015 Symantec Bilbug 2022 Cisco LotusBlossom 2025
Activities and Tactics
Targeted Sectors: Private sector
Country of Origin: 🇨🇳 China
Incident Type: Espionage
Suspected Victims: United States
Notable Campaigns
Information pending cataloguing.
Tactics, Techniques, and Procedures (TTPs)
Information pending cataloguing.
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
Information pending cataloguing.
Attribution and Evidence
Country of Origin: China Additional attribution information pending cataloguing.
References
[1] MITRE ATT&CK MITRE ATT&CK entry [2] Lotus Blossom Jun 2015 [3] Symantec Bilbug 2022 [4] Cisco LotusBlossom 2025