Lotus Blossom

Threat Actors · Lotus Blossom

· ATT&CK GroupG0030

DRAGONFISHSpring DragonRADIUMRaspberry TyphoonBilbugThrip

Techniques

Software

Tactics

Aliases

Description

Lotus Blossom is a long-standing threat group largely targeting various entities in Asia since at least 2009. In addition to government and related targets, Lotus Blossom has also targeted entities such as digital certificate issuers.(Citation: Lotus Blossom Jun 2015)(Citation: Symantec Bilbug 2022)(Citation: Cisco LotusBlossom 2025)

Tactic Coverage

discovery (10)collection (3)command and control (2)persistence (2)privilege escalation (2)execution (1)defense impairment (1)stealth (1)credential access (1)resource development (1)

Techniques Used (21)

T1012Query Registry

discovery

T1016System Network Configuration Discovery

discovery

T1016.001Internet Connection Discovery

discovery

T1018Remote System Discovery

discovery

T1046Network Service Discovery

discovery

Registration Required

Create a free account to access full Threat Actor Techniques

Showing 5 of 21 results

✓ Personal dashboard✓ Track 1 vendor/product✓ 1 keyword alert✓ Weekly digest✓ 1 CSV export/month

Already have an account? Sign in →

Software Used (9)

S0552AdFindtool S0081Elisemalware S0082Emissarymalware S1211Hannotogmalware S0357Impackettool S0590NBTscantool S0097Pingtool S1210Sagerunex

References (14)

https://attack.mitre.org/groups/G0030 https://web.archive.org/web/20190508165226/https://www.accenture.com/t20180127T003755Z_w_/us-en/_acnmedia/PDF-46/Accenture-Security-Dragonfish-Threat-Analysis.pdf https://securelist.com/the-spring-dragon-apt/70726/https://www.paloaltonetworks.com/resources/research/unit42-operation-lotus-blossom.html https://blog.talosintelligence.com/lotus-blossom-espionage-group/https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide https://www.security.com/threat-intelligence/espionage-asia-governments-cert-authority