LOTUS PANDA
Also known as Spring Dragon, ST Group, DRAGONFISH, BRONZE ELGIN, ATK1, G0030, Red Salamander, Lotus BLossom, Billbug, RADIUM, Raspberry Typhoon, Bilbug, Thrip
0mentions, 7 days
0mentions, 30 days
nonelast mentioned
Lotus Blossom is a threat group that has targeted government and military organizations in Southeast Asia.
Targets: Military, Government, Japan, Philippines, Hong Kong, Indonesia, Taiwan, Vietnam
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
ATT&CK techniques
T1012 Query RegistryT1016 System Network Configuration DiscoveryT1016.001 Internet Connection DiscoveryT1018 Remote System DiscoveryT1046 Network Service DiscoveryT1047 Windows Management InstrumentationT1049 System Network Connections DiscoveryT1074.001 Local Data StagingT1083 File and Directory DiscoveryT1087.001 Local AccountT1087.002 Domain AccountT1090.001 Internal ProxyT1090.003 Multi-hop ProxyT1112 Modify RegistryT1134 Access Token ManipulationT1482 Domain Trust DiscoveryT1539 Steal Web Session CookieT1543.003 Windows ServiceT1560.001 Archive via UtilityT1560.003 Archive via Custom MethodT1588.002 Tool
Recent activity
No posts or advisories have named this actor recently.
References
- https://securelist.com/blog/research/70726/the-spring-dragon-apt/
- https://securelist.com/spring-dragon-updated-activity/79067/
- https://www.cfr.org/interactive/cyber-operations/lotus-blossom
- https://unit42.paloaltonetworks.com/operation-lotus-blossom/
- https://www.accenture.com/t00010101T000000Z__w__/gb-en/_acnmedia/PDF-46/Accenture-Security-Elise-Threat-Analysis.pdf
- https://unit42.paloaltonetworks.com/attack-on-french-diplomat-linked-to-operation-lotus-blossom/
- https://community.rsa.com/community/products/netwitness/blog/2018/02/13/lotus-blossom-continues-asean-targeting
- https://www.accenture.com/t20180127T003755Z_w_/us-en/_acnmedia/PDF-46/Accenture-Security-Dragonfish-Threat-Analysis.pdf
- https://attack.mitre.org/groups/G0030/
- https://www.secureworks.com/research/threat-profiles/bronze-elgin
- https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/cyber-year-in-retrospect/yir-cyber-threats-report-download.pdf
- https://fortiguard.fortinet.com/threat-signal-report/4879
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.