H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Sagerunex](https://attack.mitre.org/software/S1210) is a malware family exclusively associated with [Lotus Blossom](https://attack.mitre.org/groups/G0030) operations, with variants existing since at least 2016. Variations of [Sagerunex](https://attack.mitre.org/software/S1210) leverage non-traditional command and control mechanisms such as various web services.(Citation: Symantec Bilbug 2022)(Citation: Cisco LotusBlossom 2025)

Labels

malware

19 recorded

Relationships

uses

from Lotus Blossom

Group

uses

to Access Token Manipulation

Technique

uses

to Archive via Utility

Technique

uses

to Asymmetric Cryptography

Technique

uses

to Bidirectional Communication

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Dynamic-link Library Injection

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Execution Guardrails

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to Local Data Staging

Technique

uses

Technique

uses

to One-Way Communication

Technique

uses

to Process Discovery

Technique

uses

Technique

uses

to Software Packing

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to Web Protocols

Technique

3 external

References

mitre-attack

S1210

Cisco LotusBlossom 2025

https://blog.talosintelligence.com/lotus-blossom-espionage-group/

Symantec Bilbug 2022

https://www.security.com/threat-intelligence/espionage-asia-governments-cert-authority