H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Hannotog](https://attack.mitre.org/software/S1211) is a type of backdoor malware uniquely assoicated with [Lotus Blossom](https://attack.mitre.org/groups/G0030) operations since at least 2022.(Citation: Symantec Bilbug 2022)

Labels

malware

8 recorded

Relationships

uses

to Automated Exfiltration

Technique

uses

to Disable or Modify System Firewall

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Non-Standard Port

Technique

uses

to Service Stop

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Service

Technique

uses

from Lotus Blossom

Group

2 external

References

mitre-attack

S1211

open

Symantec Bilbug 2022

https://www.security.com/threat-intelligence/espionage-asia-governments-cert-authority

open