- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Sponsor
- State-sponsored
- Motivation
- Espionage; Information theft and espionage
- Seen
- 2012–2026
- Status
- Active
- ATT&CK
- G0030 · 21 techniques
- Sources
- 7 sources carry it
- Identifier
- GINC-APT-0219 · lotus-blossom
ChinaWhat it is
Lotus Blossom is a long-standing threat group largely targeting various entities in Asia since at least 2009. In addition to government and related targets, Lotus Blossom has also targeted entities such as digital certificate issuers.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- LOTUS PANDA
- Microsoft
- Raspberry Typhoon
- MITRE ATT&CK
- G0030
- PwC
- Red Salamander
- Secureworks
- CTG-8171
- Thales
- ATK1, ATK78
- Operations
- Operation “Lotus Blossom”
- Other names
- ATK 1, ATK 78, Bilbug, Billbug, Bronze Elgin, DRAGONFISH, Lotus Blossom, Spring Dragon, Thrip, RADIUM, Spring Dragon, ST Group, Thrip
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTChina
- MISP Galaxy (CFR tagging)China
- ThreatActor.info (Malpedia et al.)China · high
Targets
- Countries
- ASEAN, Brunei, Cambodia, Hong Kong, Indonesia, Japan, Laos, Macao, Malaysia, Myanmar, Philippines, Singapore, Taiwan, Thailand, United States, Vietnam
- Sectors
- Aerospace, Defense, Education, Government, Government, Administration, High-Tech, Military, Private sector, Satellites, Telecommunications
Tools
The tools and malware families the sources tie to it.
- AdFind
- Elise
- Emissary
- Hannotog
- Impacket
- NBTscan
- Ping
- Sagerunex
- certutil
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de