Home / Threat actors / Lotus Blossom
Lotus Blossom G0030
Also known as: DRAGONFISH, Spring Dragon, RADIUM, Raspberry Typhoon, Bilbug, Thrip
Updated at source on Jul 31, 2026 · View on MITRE ATT&CK
0
associated CVEs
24
Techniques
9
Malware and tools
Lotus Blossom is a long-standing threat group largely targeting various entities in Asia since at least 2009. In addition to government and related targets, Lotus Blossom has also targeted entities such as digital certificate issuers.
Exploited vulnerabilities
CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.
ATT&CK does not cite CVEs for this group.
Techniques by tactic
Resource Development
T1588.002 Tool Execution
T1047 Windows Management Instrumentation Persistence
T1112 Modify RegistryT1543.003 Windows Service Privilege Escalation
T1134 Access Token ManipulationT1543.003 Windows Service Stealth
T1134 Access Token Manipulation Defense Impairment
T1112 Modify Registry Credential Access
T1539 Steal Web Session Cookie Discovery
T1012 Query RegistryT1016 System Network Configuration DiscoveryT1016.001 Internet Connection DiscoveryT1018 Remote System DiscoveryT1046 Network Service DiscoveryT1049 System Network Connections DiscoveryT1083 File and Directory DiscoveryT1087.001 Local AccountT1087.002 Domain AccountT1482 Domain Trust Discovery Collection
T1074.001 Local Data StagingT1560.001 Archive via UtilityT1560.003 Archive via Custom Method Command and Control
T1090.001 Internal ProxyT1090.003 Multi-hop Proxy © The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.