Lotus Blossom

Overview

Lotus Blossom is a long-standing threat group largely targeting various entities in Asia since at least 2009. In addition to government and related targets, Lotus Blossom has also targeted entities such as digital certificate issuers.

Naming & attribution

Lotus Blossom is tracked under 7 names across the industry. It uses 21 documented ATT&CK techniques — more than 54% of the 174 groups tracked here. Activity attributed since at least 2009.

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

• T1134 Access Token Manipulation — used by 3 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• Volt Typhoon China — 16 shared techniques (19% overlap)
• Chimera China — 13 shared techniques (19% overlap)
• menuPass China — 10 shared techniques (18% overlap)
• FIN13 — 11 shared techniques (17% overlap)
• Turla Russia — 12 shared techniques (16% overlap)
• Threat Group-3390 China — 11 shared techniques (16% overlap)

Targets

Government · Military · Private sector

Regions

Hong Kong · Indonesia · Japan · Philippines · Taiwan · United States · Vietnam

Capabilities

• Custom malware/implant development — ATT&CK: 4 attributed custom malware families

TTPs — 21 techniques across 9 tactics

Tools & malware (9)

AdFind · Ping · Impacket · Emissary · Elise · Hannotog · NBTscan · Sagerunex · certutil

Reporting (3)

• Lotus Blossom espionage group targets multiple industries with different versions of Sagerunex and hacking tools — Joey Chen, Cisco Talos
• How Microsoft names threat actors — Microsoft
• Billbug: State-sponsored Actor Targets Cert Authority, Government Agencies in Multiple Asian Countries — Symntec Threat Hunter Team