Lotus Blossom
Lotus Blossom is a long-standing threat group largely targeting various entities in Asia since at least 2009. In addition to government and related targets, Lotus Blossom has also targeted entities such as digital certificate issuers.
- ATT&CK ID
- G0030
- Weather family
- Typhoon
- Techniques
- 17
- Tools
- 9
Also tracked as DRAGONFISH · Spring Dragon · RADIUM · Raspberry Typhoon · Bilbug · Thrip
Techniques
Resource Development
Execution
Windows Management Instrumentation
Persistence
Modify RegistryCreate or Modify System Process
Privilege Escalation
Access Token ManipulationCreate or Modify System Process
Stealth
Defense Impairment
Credential Access
Discovery
Query RegistrySystem Network Configuration DiscoveryRemote System DiscoveryNetwork Service DiscoverySystem Network Connections DiscoveryFile and Directory DiscoveryAccount DiscoveryDomain Trust Discovery
Collection
Data StagedArchive Collected Data
Command and Control
Software
AdFind · Elise · Emissary · Hannotog · Impacket · NBTscan · Ping · Sagerunex · certutil