defection.io

group

Lotus Blossom G0030

Created: 31 May 2017
Last modified: 31 July 2026
Aliases: Lotus Blossom · DRAGONFISH · Spring Dragon · RADIUM · Raspberry Typhoon · Bilbug · Thrip

Lotus Blossom is a long-standing threat group largely targeting various entities in Asia since at least 2009. In addition to government and related targets, Lotus Blossom has also targeted entities such as digital certificate issuers.[1][2][3]

Techniques55th pct

Tactics59th pct

Tools & malwareTop 19%

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

defection.io

group

Lotus Blossom G0030

Created: 31 May 2017
Last modified: 31 July 2026
Aliases: Lotus Blossom · DRAGONFISH · Spring Dragon · RADIUM · Raspberry Typhoon · Bilbug · Thrip

Techniques55th pct

Tactics59th pct

Tools & malwareTop 19%

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Lotus Blossom MITRE reference G0030

Query Registry T1012 ↗

Lotus Blossom has run commands such as reg query HKLM\SYSTEM\CurrentControlSet\Services\[service name]\Parameters to verify if installed implants are running as a service.4

Discovery27 detection rules

System Network Configuration Discovery T1016 ↗

Lotus Blossom has used commands such as ipconfig and netstat to gather network information on compromised hosts.5

Discovery25 detection rules

Internet Connection Discovery T1016.001 ↗

Lotus Blossom has performed checks to determine if a victim machine is able to access the Internet.6

Discovery1 detection rules

Remote System Discovery T1018 ↗

Lotus Blossom has used Ping to identify remote systems.7

Discovery39 detection rules

Network Service Discovery T1046 ↗

Lotus Blossom has used port scanners to enumerate services on remote hosts.8

Discovery33 detection rules

Windows Management Instrumentation T1047 ↗

Lotus Blossom has used WMI to enable lateral movement.9

Execution71 detection rules

Standing G0030

Reach is how much of ATT&CK this group touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 176 ATT&CK groups only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques2155th pct

55th percentile · 55% of 176 ATT&CK groups have this many Enterprise techniques or fewer.

Tactics1059th pct

59th percentile · 59% of 176 ATT&CK groups have this many tactics spanned or fewer.

Tools & malware9Top 19%

81st percentile · 81% of 176 ATT&CK groups have this many tools and malware or fewer.

Campaigns089% tie · 4 values

89% of the population shares a single value across only 4 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique25med64th pct

64th percentile · 64% of 176 ATT&CK groups have this many detection rules per technique or fewer.

Tests / technique7medTop 12%

88th percentile · 88% of 176 ATT&CK groups have this many atomic tests per technique or fewer.

Data comps / technique4med65% tie · 12 values

65% of the population shares a single value across only 12 distinct values, so a percentile here would rank the tie, not the entity.

Mitigations / technique1med43% tie · 11 values

43% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.

5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this group’s 21 Enterprise techniques.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 361Splunk ESCU (cumulative) · 235