Hacker groupG0030
Lotus Blossom
Also tracked as DRAGONFISH, Spring Dragon, RADIUM, Raspberry Typhoon, Bilbug, Thrip
Lotus Blossom is a long-standing threat group largely targeting various entities in Asia since at least 2009. In addition to government and related targets, Lotus Blossom has also targeted entities such as digital certificate issuers.
- Known attack methods
- 21
- First seen
- 2009
- Source
- MITRE ATT&CK
How they break in
Techniques MITRE has documented this group using, mapped onto the ATT&CK matrix. Each one is a behaviour you can look for in your own logs, and a control you can test.
Used by this groupNot documented for this groupIn brackets: sub-techniques this group uses, of those that exist.
Reconnaissance
12 techniques
Resource Development
9 techniques · 1 used
Initial Access
11 techniques
Execution
20 techniques · 1 used
Persistence
22 techniques · 1 used
Privilege Escalation
13 techniques
Stealth
30 techniques · 1 used
Defense Impairment
18 techniques · 1 used
Credential Access
17 techniques · 1 used
Discovery
34 techniques · 8 used
Lateral Movement
9 techniques
Collection
17 techniques · 2 used
Command and Control
18 techniques · 1 used
Exfiltration
9 techniques
Impact
15 techniques
Resource development1
Execution1
Persistence1
Stealth1
Defense impairment1
Credential access1
Discovery10
- T1012Query Registry
- T1016System Network Configuration Discovery
- T1016.001Internet Connection Discovery
- T1018Remote System Discovery
- T1046Network Service Discovery
- T1049System Network Connections Discovery
- T1083File and Directory Discovery
- T1087.001Local Account
- T1087.002Domain Account
- T1482Domain Trust Discovery
Collection3
Command and control2
Malware
Families MITRE records this group deploying. Detection names for these are a reasonable place to start.
EliseEmissaryHannotogSagerunex
Tools
Legitimate or dual-use software the group is documented using. Most of it is software your own administrators use too, which is the point.
AdFindImpacketNBTscanPingcertutil