Lotus Blossom is a long-standing threat group largely targeting various entities in Asia since at least 2009. In addition to government and related targets, Lotus Blossom has also targeted entities such as digital certificate issuers.123
- Lotus Blossom Jun 2015
- Symantec Bilbug 2022
- Cisco LotusBlossom 2025
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| also_known_as | Lotus Blossom | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | DRAGONFISH | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Spring Dragon | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | RADIUM | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Raspberry Typhoon | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Bilbug | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Thrip | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1543.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1134 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1539 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1112 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1049 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1047 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1482 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1018 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1046 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1012 | 2017 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1012 | Query Registry | — |
| T1016 | System Network Configuration Discovery | — |
| T1016.001 | Internet Connection Discovery | — |
| T1018 | Remote System Discovery | — |
| T1046 | Network Service Discovery | — |
| T1047 | Windows Management Instrumentation | — |
| T1049 | System Network Connections Discovery | — |
| T1074.001 | Local Data Staging | — |
| T1083 | File and Directory Discovery | — |
| T1087.001 | Local Account | — |
| T1087.002 | Domain Account | — |
| T1090.001 | Internal Proxy | — |
| T1090.003 | Multi-hop Proxy | — |
| T1112 | Modify Registry | — |
| T1134 | Access Token Manipulation | — |
| T1482 | Domain Trust Discovery | — |
| T1539 | Steal Web Session Cookie | — |
| T1543.003 | Windows Service | — |
| T1560.001 | Archive via Utility | — |
| T1560.003 | Archive via Custom Method | — |
| T1588.002 | Tool | — |
Aliases
Bilbug · DRAGONFISH · Lotus Blossom · RADIUM · Raspberry Typhoon · Spring Dragon · Thrip
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.