Lotus Blossom
IntrusionSet · ATTACK:enterprise:G0030
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G0030",
"title": "Lotus Blossom",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G0030",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--88b7dbc2-32d3-4e31-af2f-3fc24e1582d7",
"external_id": "G0030",
"domain": "enterprise",
"created": "2017-05-31T21:32:01.092Z",
"modified": "2026-07-31T18:48:06.109Z",
"version": "4.0",
"aliases": [
"Lotus Blossom",
"DRAGONFISH",
"Spring Dragon",
"RADIUM",
"Raspberry Typhoon",
"Bilbug",
"Thrip"
],
"tactics": [
],
"source_references": [
{
"source_name": "DRAGONFISH"
},
{
"source_name": "Thrip"
},
{
"source_name": "Lotus Blossom"
},
{
"source_name": "RADIUM"
},
{
"source_name": "Raspberry Typhoon"
},
{
"source_name": "Spring Dragon"
},
{
"source_name": "Bilbug"
},
{
"source_name": "Accenture Dragonfish Jan 2018",
"url": "https://web.archive.org/web/20190508165226/https://www.accenture.com/t20180127T003755Z_w_/us-en/_acnmedia/PDF-46/Accenture-Security-Dragonfish-Threat-Analysis.pdf"
},
{
"source_name": "Spring Dragon Jun 2015",
"url": "https://securelist.com/the-spring-dragon-apt/70726/"
},
{
"source_name": "Lotus Blossom Jun 2015",
"url": "https://www.paloaltonetworks.com/resources/research/unit42-operation-lotus-blossom.html"
},
{
"source_name": "Cisco LotusBlossom 2025",
"url": "https://blog.talosintelligence.com/lotus-blossom-espionage-group/"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Symantec Bilbug 2022",
"url": "https://www.security.com/threat-intelligence/espionage-asia-governments-cert-authority"
}
]
}Explicit source assertions (30)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:S0552
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1539a3a4-389a-4be2-a14f-db916a47020f
Symantec Bilbug 2022ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--207dbd97-1a2d-4bf2-aa90-62748a83979e
Cisco LotusBlossom 2025ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:T1543.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2593bdc1-d284-4269-a959-2741baeb9f04
Cisco LotusBlossom 2025ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:T1087.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3bad8943-4d47-4967-b2f4-c159c42a1eac
Cisco LotusBlossom 2025 · Symantec Bilbug 2022ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:S0097
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3fcefdbe-87b9-4434-87ea-996425650be0
Symantec Bilbug 2022ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:T1074.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4e956278-89d6-45b5-a7e3-2ad13ae07e01
Cisco LotusBlossom 2025ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:T1134
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4fc87cbb-73ac-448a-9e81-3f2346de0d42
Cisco LotusBlossom 2025ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:T1087.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4fefb2ee-376a-43bf-abd7-9e856653e874
Cisco LotusBlossom 2025ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:S0357
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--529664ab-4c44-4608-91e9-65dde54d0865
Cisco LotusBlossom 2025ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:T1090.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5aa77e01-e63e-4be1-9f7e-1792d45a138a
Cisco LotusBlossom 2025ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:T1539
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5b252d63-e2a1-4ad3-aadd-96bc8dee78da
Cisco LotusBlossom 2025ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5c89cacf-96fc-40e2-a6ed-b4d4f107cec3
Cisco LotusBlossom 2025ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--61151171-f03e-45f3-af06-8e6d5019dca0
Cisco LotusBlossom 2025ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:T1047
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6e05703b-26a3-4429-8d91-3c32053ca662
Cisco LotusBlossom 2025ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:S0082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--764b5d56-83a1-4c8d-824a-2021c7fe8052
Emissary Trojan Feb 2016 · Lotus Blossom Dec 2015ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:T1482
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--780e0d90-1fe6-4f93-b507-efc1813e0ccb
Symantec Bilbug 2022ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:S0081
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8859897c-66f5-4754-8cb8-2c6e6b8b8e2e
Accenture Dragonfish Jan 2018 · Spring Dragon Jun 2015ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:S1211
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8b719f79-6efe-47dd-912e-bd6b09a20278
Symantec Bilbug 2022ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:T1016.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8d557d2a-6d39-491f-bafc-c256910a59a2
Cisco LotusBlossom 2025ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:T1090.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8ec91b01-924a-491c-8b1c-ff1ec49c0ce9
Cisco LotusBlossom 2025ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8ff5abd9-8bbe-4fab-8001-23b2973c0764
Cisco LotusBlossom 2025ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:T1018
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--93a7d544-bed2-4d8c-abda-ab0b82ffa3a9
Symantec Bilbug 2022ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--941c2dbc-ca93-4206-b023-fabc7476ac16
Cisco LotusBlossom 2025ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:S0590
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a20e2809-ec0d-4378-8ee2-0691b651236c
Symantec Bilbug 2022ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:S1210
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a8f467d6-0299-4739-9038-a028784a264c
Cisco LotusBlossom 2025 · Symantec Bilbug 2022ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:T1560.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c4741ab7-7e20-4e4a-a0f6-189984c564cd
Cisco LotusBlossom 2025ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:T1560.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cc58b10e-0fb0-4ee3-95b6-ae2bbaedcdea
Cisco LotusBlossom 2025 · Symantec Bilbug 2022ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:T1046
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d4afacec-3b00-49b0-9c37-06f8a6c07526
Symantec Bilbug 2022ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:S0160
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e4afc655-77c8-4d76-b115-6da92455fd74
Symantec Bilbug 2022ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:T1012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--feef4e0f-c65b-42ed-9fdf-e5fe38a6adaa
Cisco LotusBlossom 2025