GROUPS
Overview admin@338 APT1 APT12 APT16 APT17 APT18 APT19 APT28 APT29 APT3 APT30 APT32 APT33 APT37 APT38 APT39 APT41 Axiom BlackOasis BRONZE BUTLER Carbanak Charming Kitten Cleaver Cobalt Group CopyKittens Dark Caracal Darkhotel DarkHydrus Deep Panda Dragonfly Dragonfly 2.0 DragonOK Dust Storm Elderwood Equation FIN10 FIN4 FIN5 FIN6 FIN7 FIN8 Gallmaker Gamaredon Group GCMAN Gorgon Group Group5 Honeybee Ke3chang Kimsuky Lazarus Group Leafminer Leviathan Lotus Blossom Machete Magic Hound menuPass Moafee Molerats MuddyWater Naikon NEODYMIUM Night Dragon OilRig Orangeworm Patchwork PittyTiger PLATINUM Poseidon Group PROMETHIUM Putter Panda Rancor RTM Sandworm Team Scarlet Mimic Silence SilverTerrier Soft Cell Sowbug Stealth Falcon Stolen Pencil Strider Suckfly TA459 TA505 Taidoor TEMP.Veles The White Company Threat Group-1314 Threat Group-3390 Thrip Tropic Trooper Turla Winnti Group WIRTE
  1. Home
  2. Groups
  3. Lotus Blossom

Lotus Blossom

Lotus Blossom is a threat group that has targeted government and military organizations in Southeast Asia. [1]

ID: G0030
Associated Groups: DRAGONFISH, Spring Dragon
Version: 2.0

Associated Group Descriptions

Name Description
DRAGONFISH [3]
Spring Dragon [2][3]

Software

ID Name References Techniques
S0081 Elise [2] [3] Account Discovery, Data Encoding, Data Staged, File and Directory Discovery, File Deletion, Masquerading, New Service, Obfuscated Files or Information, Process Discovery, Process Injection, Registry Run Keys / Startup Folder, Remote File Copy, Rundll32, Standard Application Layer Protocol, Standard Cryptographic Protocol, System Information Discovery, System Network Configuration Discovery, System Service Discovery, Timestomp
S0082 Emissary [4] [5] Binary Padding, Command-Line Interface, Custom Cryptographic Protocol, New Service, Obfuscated Files or Information, Permission Groups Discovery, Process Injection, Registry Run Keys / Startup Folder, Remote File Copy, Rundll32, Standard Application Layer Protocol, System Information Discovery, System Network Configuration Discovery, System Service Discovery

References

  1. Falcone, R., et al.. (2015, June 16). Operation Lotus Blossom. Retrieved February 15, 2016.
  2. Baumgartner, K.. (2015, June 17). The Spring Dragon APT. Retrieved February 15, 2016.
  3. Accenture Security. (2018, January 27). DRAGONFISH DELIVERS NEW FORM OF ELISE MALWARE TARGETING ASEAN DEFENCE MINISTERS’ MEETING AND ASSOCIATES. Retrieved November 14, 2018.
  1. Falcone, R. and Miller-Osborn, J.. (2015, December 18). Attack on French Diplomat Linked to Operation Lotus Blossom. Retrieved February 15, 2016.
  2. Falcone, R. and Miller-Osborn, J.. (2016, February 3). Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It to Evolve?. Retrieved February 15, 2016.