H3XA — Operational Evidence

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Lotus Blossom](https://attack.mitre.org/groups/G0030) is a long-standing threat group largely targeting various entities in Asia since at least 2009. In addition to government and related targets, [Lotus Blossom](https://attack.mitre.org/groups/G0030) has also targeted entities such as digital certificate issuers.(Citation: Lotus Blossom Jun 2015)(Citation: Symantec Bilbug 2022)(Citation: Cisco LotusBlossom 2025)

30 recorded

Relationships

uses

to Access Token Manipulation

Technique

uses

to AdFind

Tool

uses

to Archive via Custom Method

Technique

uses

to Archive via Utility

Technique

uses

to certutil

Tool

uses

to Domain Account

Technique

uses

to Domain Trust Discovery

Technique

uses

to Elise

Malware

uses

to Emissary

Malware

uses

to File and Directory Discovery

Technique

uses

to Hannotog

Malware

uses

to Impacket

Tool

uses

to Internal Proxy

Technique

uses

to Internet Connection Discovery

Technique

uses

to Local Account

Technique

uses

to Local Data Staging

Technique

uses

to Modify Registry

Technique

uses

to Multi-hop Proxy

Technique

uses

to NBTscan

Tool

uses

to Network Service Discovery

Technique

uses

to Ping

Tool

uses

to Query Registry

Technique

uses

to Remote System Discovery

Technique

uses

to Sagerunex

Malware

uses

to Steal Web Session Cookie

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Network Connections Discovery

Technique

uses

to Tool

Technique

uses

to Windows Management Instrumentation

Technique

uses

to Windows Service

Technique

14 external

References

mitre-attack

G0030

open

DRAGONFISH

—

Thrip

—

Lotus Blossom

—

RADIUM

—

Raspberry Typhoon

—

Spring Dragon

—

Bilbug

—

Accenture Dragonfish Jan 2018

https://web.archive.org/web/20190508165226/https://www.accenture.com/t20180127T003755Z_w_/us-en/_acnmedia/PDF-46/Accenture-Security-Dragonfish-Threat-Analysis.pdf

open

Spring Dragon Jun 2015

https://securelist.com/the-spring-dragon-apt/70726/

open

Lotus Blossom Jun 2015

https://www.paloaltonetworks.com/resources/research/unit42-operation-lotus-blossom.html

open

Cisco LotusBlossom 2025

https://blog.talosintelligence.com/lotus-blossom-espionage-group/

open

Microsoft Threat Actor Naming July 2023

https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide

open

Symantec Bilbug 2022

https://www.security.com/threat-intelligence/espionage-asia-governments-cert-authority

open