Lotus Blossom Uses Sagerunex Backdoor Variants and Cloud Services in Espionage Campaigns
Summary
Cisco Talos attributes campaigns targeting government, manufacturing, telecommunications and media organizations to Lotus Blossom, detailing Sagerunex variants that use Dropbox, Twitter and Zimbra for command and control.
Key points
- Talos attributes the campaigns to Lotus Blossom, also known as Spring Dragon, Billbug and Thrip, with high confidence.
- Targets included organizations in government, manufacturing, telecommunications and media across the Philippines, Vietnam, Hong Kong and Taiwan.
- Sagerunex variants establish persistence by installing the backdoor as a Windows service through registry changes.
- Newer variants use Dropbox, Twitter or Zimbra as command-and-control channels, blending activity with legitimate services.
- The Zimbra variant can receive commands through mailbox content and send collected information and command results through email drafts.
- The group used tools for credential theft, proxying, privilege adjustment and archiving, and used VMProtect to obfuscate Sagerunex.
- Talos says the Dropbox and Twitter variant was active mainly from 2018 to 2022 and may remain active; the Zimbra variant has been active since 2019.
Article Details
- Attack Vectors
- Lotus Blossom deploys Sagerunex backdoors, including DLL injection and in-memory execution, with registry-based persistence configured to run as a service.
- The group uses Dropbox, Twitter, or Zimbra webmail as command-and-control channels to beacon, receive commands, and transfer collected data.
- The operators use Impacket for remote process and command execution, and a customized Venom proxy to connect isolated machines to internet-accessible systems.
- The operators use a Chrome cookie-stealing tool to harvest browser credentials and customized archiving tools to collect and package files, including browser cookies.
- Sagerunex variants use VMProtect to obfuscate code and may use proxy settings or hardcoded proxy servers to reach command-and-control infrastructure.
- Defensive Notes
- Talos recommends Cisco security products, including Secure Endpoint, Secure Web Appliance, Secure Email, Secure Firewall, Secure Malware Analytics, Umbrella, and Cisco Duo, for malware prevention, detection, access protection, and blocking malicious destinations.
- The article lists Snort SIDs 64511, 64510, and 64509, and ClamAV detections Win.Backdoor.Sagerunex-10041845-0, Win.Tool.Mtrain-10041846-0, Win.Tool.Ntfsdump-10041854-0, and Win.Backdoor.Sagerunex-10041857-0.
MITRE ATT&CK
T1016 · System Network Configuration DiscoveryThe actor runs ipconfig and netstat to gather network configuration and connection information.T1027 · Obfuscated Files or InformationThe actor uses VMProtect to obfuscate Sagerunex code.T1036.004 · Masquerade Task or ServiceThe actor configures the backdoor under service names including tapisrv, swprv, and appmgmt.T1041 · Exfiltration Over C2 ChannelThe backdoor sends encrypted collected host information and command results to Dropbox, Twitter, or a Zimbra mailbox.T1055 · Process InjectionSagerunex is described as a DLL injected into an infected endpoint and executed in memory.T1059.003 · Windows Command ShellThe actor runs Windows commands including net, tasklist, quser, ipconfig, netstat, and dir.T1071.001 · Web ProtocolsSagerunex uses Dropbox and Twitter APIs as command-and-control channels.T1071.003 · Mail ProtocolsA Sagerunex variant uses Zimbra webmail and its API for command-and-control.T1082 · System Information DiscoverySagerunex gathers host information, including hostname, MAC address, and IP address.T1090 · ProxyThe actor uses a customized Venom proxy and a modified HTran-based relay tool to route connections.T1105 · Ingress Tool TransferThe Zimbra variant downloads mail content containing commands to the compromised machine.T1547.001 · Registry Run Keys / Startup FolderThe actor installs Sagerunex through Windows registry service keys to persist and run it as a service.T1555.003 · Credentials from Web BrowsersA Chrome cookie-stealing tool is used to harvest Chrome browser credentials and cookies.T1560.001 · Archive via UtilitySagerunex encrypts and archives collected data, and the Zimbra variant saves data in mail_report.rar.T1562.001 · Disable or Modify ToolsThe article says VMProtect obfuscation is used to evade detection by antivirus products.
People
Threat Actors
BillbugThe article identifies this as another name for Lotus Blossom.Lotus BlossomTalos attributes the espionage campaigns and Sagerunex deployment to this group with high confidence.Spring DragonThe article identifies this as another name for Lotus Blossom.ThripThe article identifies this as another name for Lotus Blossom.
Malware
EvoraSagerunex is a remote access tool (RAT) assessed to be an evolution of an older Billbug tool known as Evora. Sagerunex is designed to be dynamic link library (DLL) injected into an infected endpoint and executedSagerunexLotus Blossom espionage group targets multiple industries with different versions of Sagerunex and hacking tools
Vendors
Products
Cisco DuoCisco Duo provides multi-factor authentication for users to ensure only those authorized are accessing your network. Cisco Secure EmailCisco Secure Email (formerly Cisco Email Security) can block malicious emails sent by threat actors as part of their campaign. You can try Secure Email for free here. Cisco Secure EndpointCisco Secure Endpoint (formerly AMP for Endpoints) is ideally suited to prevent the execution of the malware detailed in this post. Try Secure Endpoint for free here. Cisco Secure FirewallCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with thisCisco Secure Malware AnalyticsCisco Secure Malware Analytics (Threat Grid) identifies malicious binaries and builds protection into all Cisco Secure products. Cisco Secure Web ApplianceCisco Secure Web Appliance web scanning prevents access to malicious websites and detects malware used in these attacks. ClamAVClamAV detections are also available for this threat: Dropboxtraditional command and control (C2) servers but also use legitimate, third-party cloud services such as Dropbox, Twitter, and the Zimbra open-source webmail as C2 tunnels. Google ChromeCookie stealer tool: Pyinstaller bundle of a Chrome cookie stealer which is an open-source tool from github. Lotus Blossom used it to harvest Chrome browser credentials. Microsoft Windowsreg add HKLM\SYSTEM\CurrentControlSet\Services\tapisrv\Parameters /v ServiceDll /t REG_EXPAND_SZ /d c:\windows\tapisrv.dll /f Mozilla Firefoxor entire folder to the specific file path with protection. For example, the tool archived Chrome and Firefox browser cookies folders. SnortOpen-source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org. Snort SIDs for this threat are 64511, 64510, 64509. Twittercommand and control (C2) servers but also use legitimate, third-party cloud services such as Dropbox, Twitter, and the Zimbra open-source webmail as C2 tunnels. UmbrellaUmbrella, Cisco's secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs and URLs, whether users are on or off the corporate network. Sign up for a free trial of Umbrella here. Zimbra(C2) servers but also use legitimate, third-party cloud services such as Dropbox, Twitter, and the Zimbra open-source webmail as C2 tunnels.
Tools
HTranPort relay tool: The threat actor named this tool “mtrain V1.01” which is a modified proxy relay tool from HTran. The tool allowed the threat actor to relay the connection from the victim machine to the internet. ImpacketLotus Blossom frequently utilizes the Impacket tool to execute remote processes and commands within the victim's environment, consistent with known Lotus Blossom TTPs. Once they gain access to a target, their operationsmtrain V1.01Port relay tool: The threat actor named this tool “mtrain V1.01” which is a modified proxy relay tool from HTran. The tool allowed the threat actor to relay the connection from the victim machine to the internet. VenomVenom proxy tool: A proxy tool developed for penetration testers using Go language. The threat actor customized this Venom tool and hardcoded the destination IP address in each activity. VMProtectFurthermore, we also observed the actor employ VMProtect, a software protection tool, to obfuscate Sagerunex code and evade detection by antivirus products. These sophisticated techniques are used to maintain the
Countries
Hong Kongas government, manufacturing, telecommunications and media in areas including the Philippines, Vietnam, Hong Kong and Taiwan. Philippinesin sectors such as government, manufacturing, telecommunications and media in areas including the Philippines, Vietnam, Hong Kong and Taiwan. Taiwanmanufacturing, telecommunications and media in areas including the Philippines, Vietnam, Hong Kong and Taiwan. Vietnamsuch as government, manufacturing, telecommunications and media in areas including the Philippines, Vietnam, Hong Kong and Taiwan.
Industries
GovernmentCisco Talos discovered multiple cyber espionage campaigns that target government, manufacturing, telecommunications and media, delivering Sagerunex and other hacking tools for post-compromise activities. ManufacturingCisco Talos discovered multiple cyber espionage campaigns that target government, manufacturing, telecommunications and media, delivering Sagerunex and other hacking tools for post-compromise activities. MediaCisco Talos discovered multiple cyber espionage campaigns that target government, manufacturing, telecommunications and media, delivering Sagerunex and other hacking tools for post-compromise activities. TelecommunicationsCisco Talos discovered multiple cyber espionage campaigns that target government, manufacturing, telecommunications and media, delivering Sagerunex and other hacking tools for post-compromise activities.