MITRE ATT&CKgroup

G0030 Lotus Blossom

Published 2017-05-31 Modified 2026-07-31 Official page ↗
Domain
enterprise
Aliases
DRAGONFISH, Spring Dragon, RADIUM, Raspberry Typhoon, Bilbug, Thrip
Version
4.0
Created
2017-05-31

Description

Lotus Blossom is a long-standing threat group largely targeting various entities in Asia since at least 2009. In addition to government and related targets, Lotus Blossom has also targeted entities such as digital certificate issuers.

Related

Uses · MITRE ATT&CK (30)

  • S1211 Hannotog software (malware)
  • S1210 Sagerunex software (malware)
  • S0590 NBTscan software (tool)
  • T1016.001 Internet Connection Discovery sub-technique
  • S0552 AdFind software (tool)
  • T1588.002 Tool sub-technique
  • T1090.001 Internal Proxy sub-technique
  • T1090.003 Multi-hop Proxy sub-technique
  • T1074.001 Local Data Staging sub-technique
  • T1087.001 Local Account sub-technique
  • T1087.002 Domain Account sub-technique
  • T1560.001 Archive via Utility sub-technique
  • T1560.003 Archive via Custom Method sub-technique
  • T1543.003 Windows Service sub-technique
  • T1539 Steal Web Session Cookie technique
  • T1482 Domain Trust Discovery technique
  • S0357 Impacket software (tool)
  • S0160 certutil software (tool)
  • T1134 Access Token Manipulation technique
  • S0081 Elise software (malware)
  • S0082 Emissary software (malware)
  • S0097 Ping software (tool)
  • T1012 Query Registry technique
  • T1016 System Network Configuration Discovery technique
  • T1018 Remote System Discovery technique
  • T1046 Network Service Discovery technique
  • T1047 Windows Management Instrumentation technique
  • T1049 System Network Connections Discovery technique
  • T1083 File and Directory Discovery technique
  • T1112 Modify Registry technique

References