Lotus Blossom Profile Traces Shift From Phishing to Supply-Chain Espionage
Summary
The profile traces China-attributed Lotus Blossom from spear-phishing and watering-hole operations to a reported Notepad++ update-channel compromise, outlining its custom implants, living-off-the-land tactics, target sectors and suggested defenses.
Key points
- The article describes Lotus Blossom, also known as Billbug and Spring Dragon, as a China-attributed espionage group active since at least 2009.
- It attributes a 2025–2026 compromise of Notepad++ update infrastructure to the group, describing selective delivery of the Chrysalis backdoor through a trojanized updater.
- The profile names Elise, Emissary, Sagerunex, Hannotog and Chrysalis among the group’s custom implants.
- It describes DLL sideloading, Windows services and registry autoruns for persistence, alongside tools such as PowerShell, WMI, PsExec, AdFind and Mimikatz.
- The article outlines historical targeting of government, military, telecommunications, manufacturing, critical infrastructure and maritime organizations.
- Suggested defenses include verifying software updates, auditing DLL loading and persistence, restricting administrative-tool use, segmenting networks and threat hunting.
Article Details
- Topic
- Lotus Blossom cyber-espionage activity, including the Notepad++ update-channel supply-chain compromise, malware, and tradecraft.
MITRE ATT&CK
T1003 · OS Credential DumpingThe article describes credential harvesting with utilities such as Mimikatz.T1021 · Remote ServicesThe article reports PsExec use for remote execution and lateral movement.T1047 · Windows Management InstrumentationThe group used WMI as a living-off-the-land mechanism for lateral movement.T1055 · Process InjectionThe group used process injection and in-memory execution to reduce forensic artifacts.T1059.001 · PowerShellPowerShell was used for execution and lateral movement.T1071.001 · Web ProtocolsCustom backdoors communicated over HTTP/S.T1087 · Account DiscoveryThe group conducted Active Directory reconnaissance with AdFind.T1090 · ProxyProxy chaining and custom relays were used to obscure traffic routing.T1189 · Drive-by CompromiseThe article describes watering-hole attacks in which the group compromised trusted regional websites to deliver malware.T1195 · Supply Chain CompromiseThe group tampered with the Notepad++ update channel to deliver malware through a trusted software supply chain.T1218.011 · Rundll32Emissary was executed through legitimate Windows binaries such as rundll32.T1543.003 · Windows ServiceThe article describes backdoors and loaders installed as Windows services for persistence.T1547.001 · Registry Run Keys / Startup FolderRegistry-based autorun entries were used to establish persistence.T1566.001 · Spearphishing AttachmentThe article says Lotus Blossom used targeted phishing emails with weaponized Office documents for initial access.T1574.001 · DLLAttackers used DLL sideloading through a legitimate updater process to load a malicious component.
CVE
CVE-2009-4324Adobe · Acrobat; Adobe · Acrobat reader; +3 moreCVE-2009-4324 and CVE-2010-0188: Legacy Adobe Reader and Acrobat vulnerabilities exploited during the group’s initial detection phase to establish long-term persistence in regional government and military networks.CVE-2010-0188Adobe · Acrobat; Adobe · Acrobat readerCVE-2009-4324 and CVE-2010-0188: Legacy Adobe Reader and Acrobat vulnerabilities exploited during the group’s initial detection phase to establish long-term persistence in regional government and military networks.CVE-2010-2883Adobe · Acrobat; Adobe · Acrobat readerCVE-2010-2883: An Adobe Acrobat and Reader font processing flaw exploited in 2012 to target organizations in Myanmar via malicious PDF files masquerading as Unicode keyboard instructions.CVE-2012-0158Microsoft · Biztalk server; Microsoft · Commerce server; +8 more[CVE ] Exploited vulnerabilities used as initial access vectors – CVE-2025-15556, CVE-2012-0158, and 7 more CVEs (e.g., CVE-2018-0802, CVE-2017-11882).CVE-2014-4114Microsoft · Windows 7; Microsoft · Windows 8; +6 moreCVE-2014-4114: A Windows OLE package manager vulnerability (known as the “Sandworm” flaw) integrated into the group’s “Operation Lotus Blossom” spear-phishing campaigns targeting regional government and military officesCVE-2014-6332Microsoft · Windows 7; Microsoft · Windows 8; +7 moreCVE-2014-6332: A Windows OLE Automation Array remote code execution vulnerability used in targeted spear-phishing.CVE-2016-1019Adobe · Air desktop runtime; Adobe · Air sdk; +3 moreCVE-2016-1019: A critical Adobe Flash Player vulnerability exploited through watering hole attacks and spoofed Flash installer sites to deliver the Elise backdoor to government targets in the Asia-Pacific region.CVE-2017-11882Microsoft Corporation · Microsoft Office[CVE ] Exploited vulnerabilities used as initial access vectors – CVE-2025-15556, CVE-2012-0158, and 7 more CVEs (e.g., CVE-2018-0802, CVE-2017-11882).CVE-2018-0802Microsoft Corporation · Equation Editor[CVE ] Exploited vulnerabilities used as initial access vectors – CVE-2025-15556, CVE-2012-0158, and 7 more CVEs (e.g., CVE-2018-0802, CVE-2017-11882).CVE-2025-15556notepad-plus-plus · notepad-plus-plus[CVE ] Exploited vulnerabilities used as initial access vectors – CVE-2025-15556, CVE-2012-0158, and 7 more CVEs (e.g., CVE-2018-0802, CVE-2017-11882).
Threat Actors
Bronze ElginThe article lists Bronze Elgin as a tracking name for Lotus Blossom, the group it links to long-term espionage activity.Lotus BlossomThe article identifies Lotus Blossom as a China-attributed, state-linked espionage group active since at least 2009, and links it to long-term intelligence collection, targeted intrusions, and the Notepad++ update-channel compromise.Lotus PandaThe article lists Lotus Panda as a tracking name for Lotus Blossom, the group it links to long-term espionage activity.Raspberry TyphoonThe article lists Raspberry Typhoon as a tracking name for Lotus Blossom, the group it links to long-term espionage activity.Red SalamanderThe article lists Red Salamander as a tracking name for Lotus Blossom, the group it links to long-term espionage activity.
Malware
Chrysaliscompromises and targeted espionage using custom implants like Elise, Sagerunex, Hannotog, and Chrysalis.Elisecampaigns into sophisticated supply-chain compromises and targeted espionage using custom implants like Elise, Sagerunex, Hannotog, and Chrysalis.EmissaryCustom implants—Elise, Emissary, Sagerunex, Hannotog, and the Chrysalis backdoor—are central to the actor’s persistence and modular C2 capabilities, often delivered via DLL sideloading or service-based installers.Hannotogsupply-chain compromises and targeted espionage using custom implants like Elise, Sagerunex, Hannotog, and Chrysalis.Sagerunexinto sophisticated supply-chain compromises and targeted espionage using custom implants like Elise, Sagerunex, Hannotog, and Chrysalis.
Vendors
AdobeCVE-2016-1019: A critical Adobe Flash Player vulnerability exploited through watering hole attacks and spoofed Flash installer sites to deliver the Elise backdoor to government targets in the Asia-Pacific region.MicrosoftInitially recognized for spear-phishing campaigns exploiting Microsoft Office vulnerabilities like CVE-2012-0158, the group transitioned toward “Living-off-the-Land” techniques and complex supply chain exploitations.
Products
Adobe AcrobatCVE-2010-2883: An Adobe Acrobat and Reader font processing flaw exploited in 2012 to target organizations in Myanmar via malicious PDF files masquerading as Unicode keyboard instructions.Adobe Acrobat ReaderCVE-2009-4324 and CVE-2010-0188: Legacy Adobe Reader and Acrobat vulnerabilities exploited during the group’s initial detection phase to establish long-term persistence in regional government and military networks.Adobe Flash PlayerCVE-2016-1019: A critical Adobe Flash Player vulnerability exploited through watering hole attacks and spoofed Flash installer sites to deliver the Elise backdoor to government targets in the Asia-Pacific region.Microsoft OfficeInitially recognized for spear-phishing campaigns exploiting Microsoft Office vulnerabilities like CVE-2012-0158, the group transitioned toward “Living-off-the-Land” techniques and complex supply chain exploitations.Microsoft Windows[T1543.003] Create or Modify System Process: Windows Service – Persistence and loaders were deployed as services: ‘Installed as a service… persistence is typically achieved through Windows services.’Notepad++The group’s Notepad++ update-channel compromise and prior attacks against diplomatic, military, and maritime infrastructure demonstrate a “low-and-slow” intelligence collection approach emphasizing DLL sideloading,
Tools
AdFindLotus Blossom extensively abuses legitimate administrative utilities (PowerShell, WMI, PsExec, AdFind, Mimikatz) to move laterally, harvest credentials, and blend activity into normal enterprise behavior.certutilBeyond custom malware, Lotus Blossom relies heavily on dual-use tools such as AdFind, PsExec, PowerShell, Mimikatz, WinRAR, and certutil.MimikatzLotus Blossom extensively abuses legitimate administrative utilities (PowerShell, WMI, PsExec, AdFind, Mimikatz) to move laterally, harvest credentials, and blend activity into normal enterprise behavior.PowerShellLotus Blossom extensively abuses legitimate administrative utilities (PowerShell, WMI, PsExec, AdFind, Mimikatz) to move laterally, harvest credentials, and blend activity into normal enterprise behavior.PsExecLotus Blossom extensively abuses legitimate administrative utilities (PowerShell, WMI, PsExec, AdFind, Mimikatz) to move laterally, harvest credentials, and blend activity into normal enterprise behavior.Rundll32[T1218.011] Signed Binary Proxy Execution: rundll32.exe – Legitimate binaries like rundll32 were used to execute malicious modules: ‘Emissary… was often executed through legitimate Windows binaries such as rundll32.’Windows Management InstrumentationLotus Blossom extensively abuses legitimate administrative utilities (PowerShell, WMI, PsExec, AdFind, Mimikatz) to move laterally, harvest credentials, and blend activity into normal enterprise behavior.
Countries
ChinaLotus Blossom is a long-running, China-attributed APT that evolved from spear-phishing and watering-hole campaigns into sophisticated supply-chain compromises and targeted espionage using custom implants like Elise,DjiboutiTargets include government, military, telecommunications, manufacturing, critical infrastructure, and maritime/logistics entities across Southeast Asia and increasingly globally (Djibouti, Europe, Americas, USA).IndonesiaHistorically, the group’s focus was almost exclusively on Southeast Asian (SEA) government and military entities, particularly those in the Philippines, Vietnam, and Indonesia.MyanmarOne documented case involved a compromised Myanmar forum that delivered malware through a fake font installer.PhilippinesHistorically, the group’s focus was almost exclusively on Southeast Asian (SEA) government and military entities, particularly those in the Philippines, Vietnam, and Indonesia.South KoreaProviders in Hong Kong, Taiwan, Thailand, and South Korea.TaiwanRegional strategic espionage (SEA, Taiwan, Hong Kong).ThailandProviders in Hong Kong, Taiwan, Thailand, and South Korea.United StatesTargets include government, military, telecommunications, manufacturing, critical infrastructure, and maritime/logistics entities across Southeast Asia and increasingly globally (Djibouti, Europe, Americas, USA).VietnamHistorically, the group’s focus was almost exclusively on Southeast Asian (SEA) government and military entities, particularly those in the Philippines, Vietnam, and Indonesia.
Industries
Critical infrastructureTargets include government, military, telecommunications, manufacturing, critical infrastructure, and maritime/logistics entities across Southeast Asia and increasingly globally (Djibouti, Europe, Americas, USA).Geospatial imagingOperators infiltrated satellite communications providers, telecom firms, geospatial imaging companies, and defense contractors.ManufacturingTargets include government, military, telecommunications, manufacturing, critical infrastructure, and maritime/logistics entities across Southeast Asia and increasingly globally (Djibouti, Europe, Americas, USA).Satellite communicationsIn campaigns involving satellite communications and certificate authority environments, this reconnaissance phase preceded targeted movement toward sensitive infrastructure.TelecommunicationsTargets include government, military, telecommunications, manufacturing, critical infrastructure, and maritime/logistics entities across Southeast Asia and increasingly globally (Djibouti, Europe, Americas, USA).