LOTUS PANDAThreat actor
- atk1
- atk78
- bilbug
- billbug
- bronze elgin
- dragonfish
- g0030
- g0076
- Lotus Blossom
- radium
- raspberry typhoon
- red salamander
- spring dragon
- st group
- thrip
Lotus Blossom is a threat group that has targeted government and military organizations in Southeast Asia.From MISP Galaxy
Last reported 27 days ago, by CERT-EU2 reports
ATT&CK techniques
6 of 8 · each with the sentence it comes from- T1195Supply Chain Compromise
“Lotus Blossom executed a supply chain compromise of Notepad++ update infrastructure:”
- T1071.004DNS
“| Command & Control | DNS | T1071.004 |”
- T1195.002Compromise Software Supply Chain
“| Initial Access | Supply Chain Compromise | T1195.002 |”
- T1204.002Malicious File
“| Execution | User Execution | T1204.002 |”
- T1543.003Windows Service
“| Persistence | Windows Service | T1543.003 |”
- T1552.004Private Keys
“…t 341 malicious “skills” published to ClawHub and GitHub that deliver info-stealing malware targeting cryptocurrency API keys, wallet private keys, SSH credentials and browser passwords.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Cyber Brief 26-03 - February 2026“We noted several global China-linked campaigns, such as APT group Lotus Blossom's Notepad++ supply-chain compromise and UNC2814’s campaign targeting telecoms and government entities worldwide.”
-
Speeding APT Attack Confirmation with Attack Discovery, Workflows, and Agent Builder“9:15 AM: The Non-Event - A headline breaks: "Chrysalis Backdoor: A Deep Dive into Lotus Blossom." Your CISO sends a Slack message: "Are we affected?"”
Indicators in its reports
named in the reports above- create[.]casein 1 report
- create[.]channelin 1 report
- api.skycloudcenter[.]comin 1 report
- web[.]searchin 1 report
Copy these 4 indicators · defanged
Thanks — we review every report.