Lotus Blossom
- ID
- G0030
- Associated names
- DRAGONFISH, Spring Dragon, RADIUM, Raspberry Typhoon, Bilbug, Thrip
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
Lotus Blossom is a long-standing threat group largely targeting various entities in Asia since at least 2009. In addition to government and related targets, Lotus Blossom has also targeted entities such as digital certificate issuers.[1][2][3]
Techniques used (21)
- T1012 Query Registry
- T1016 System Network Configuration Discovery
- T1016.001 Internet Connection Discovery
- T1018 Remote System Discovery
- T1046 Network Service Discovery
- T1047 Windows Management Instrumentation
- T1049 System Network Connections Discovery
- T1074.001 Local Data Staging
- T1083 File and Directory Discovery
- T1087.001 Local Account
- T1087.002 Domain Account
- T1090.001 Internal Proxy
- T1090.003 Multi-hop Proxy
- T1112 Modify Registry
- T1134 Access Token Manipulation
- T1482 Domain Trust Discovery
- T1539 Steal Web Session Cookie
- T1543.003 Windows Service
- T1560.001 Archive via Utility
- T1560.003 Archive via Custom Method
- T1588.002 Tool
Software used (9)
- S0081 Elise
- S0082 Emissary
- S0097 Ping
- S0160 certutil
- S0357 Impacket
- S0552 AdFind
- S0590 NBTscan
- S1210 Sagerunex
- S1211 Hannotog