Malware
Chrysalis
- First Reported
- Feb 17, 2026
- Latest Reported
- Feb 20, 2026
Reported Context (3)
- compromises and targeted espionage using custom implants like Elise, Sagerunex, Hannotog, and Chrysalis. Lotus Blossom Profile Traces Shift From Phishing to Supply-Chain Espionage
- Discovery, Workflows, and Agent Builder were combined to automatically detect, confirm, and triage a Chrysalis backdoor campaign delivered via a Notepad++ update supply-chain compromise, collapsing dozens of alerts Elastic Shows Automated Triage Workflow for Chrysalis Backdoor Alerts
- The change follows a six-month compromise attributed to the Lotus Blossom group that used the Chrysalis backdoor, and users are urged to upgrade to 8.9.2 and download installers only from the official domain. Notepad++ 8.9.2 Adds Dual Verification to Secure Updates
CVE (10)
Malware (4)
Threat Actors (5)
MITRE ATT&CK (19)
Vendors (4)
Products (13)
Tools (7)
Industries (9)
Countries (10)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.