← threatfilter.dev / all groups / Lotus Blossom
Lotus Blossom
Also known as: DRAGONFISH · Spring Dragon · RADIUM · Raspberry Typhoon · Bilbug · Thrip
Overview
Lotus Blossom is a long-standing threat group largely targeting various entities in Asia since at least 2009. In addition to government and related targets, Lotus Blossom has also targeted entities such as digital certificate issuers.
Targets
Government · Military · Private sector
Regions
Hong Kong · Indonesia · Japan · Philippines · Taiwan · United States · Vietnam
Capabilities
- Custom malware/implant development — ATT&CK: 4 attributed custom malware families
TTPs — 21 techniques across 9 tactics
Resource Development
-
T1588.002Tool
Execution
Persistence
-
T1543.003Windows Service
Stealth
Defense Impairment
-
T1112Modify Registry
Credential Access
-
T1539Steal Web Session Cookie
Discovery
-
T1012Query Registry -
T1016System Network Configuration Discovery -
T1016.001Internet Connection Discovery -
T1018Remote System Discovery -
T1046Network Service Discovery -
T1049System Network Connections Discovery -
T1083File and Directory Discovery -
T1087.001Local Account -
T1087.002Domain Account -
T1482Domain Trust Discovery
Collection
-
T1074.001Local Data Staging -
T1560.001Archive via Utility -
T1560.003Archive via Custom Method
Command and Control
-
T1090.001Internal Proxy -
T1090.003Multi-hop Proxy
Tools & malware (9)
AdFind · Ping · Impacket · Emissary · Elise · Hannotog · NBTscan · Sagerunex · certutil
Reporting (3)
- Lotus Blossom espionage group targets multiple industries with different versions of Sagerunex and hacking tools — Joey Chen, Cisco Talos
- How Microsoft names threat actors — Microsoft
- Billbug: State-sponsored Actor Targets Cert Authority, Government Agencies in Multiple Asian Countries — Symntec Threat Hunter Team