ATT&CK

Threat actorsMITRE ATT&CK intrusion sets Malware & toolsSoftware families & tooling TechniquesTactics & techniques

ReportsPublished APT reporting SourcesEvery feed behind the archive

Developers

JSON APIFree CORS-enabled endpoints MCP serverModel Context Protocol access Source codeThis project on GitHub

Loading the archive…

Open Threat Intel Archive

Indicators are treated as facts and kept with their source_vendor, source URL, and dates; every feed is credited and redistribution-restricted feeds are flagged, not dropped. ATT&CK content is © MITRE, used under its terms. See NOTICE. The archive reports intelligence; it does not editorialize threat.

Indicators Actors Sources API GitHub

Open Threat Intel Archive

← Threat actors

G0030threat actor

Lotus Blossom

a.k.a. DRAGONFISH, Spring Dragon, RADIUM, Raspberry Typhoon, Bilbug, Thrip

Lotus Blossom is a long-standing threat group largely targeting various entities in Asia since at least 2009. In addition to government and related targets, Lotus Blossom has also targeted entities such as digital certificate issuers.

MITRE ATT&CK ↗

Linked entities · 24

usesS0552AdFind usesT1016System Network Configuration Disc…usesT1543.003Windows Service usesT1087.002Domain Account usesS0097Ping usesT1074.001Local Data Staging usesT1134Access Token Manipulation usesT1087.001Local Account usesS0357Impacket usesT1090.001Internal Proxy usesT1539Steal Web Session Cookie usesT1112Modify Registry usesT1049System Network Connections Discov…usesT1047Windows Management Instrumentation usesS0082Emissary usesT1482Domain Trust Discovery usesS0081Elise usesS1211Hannotog usesT1016.001Internet Connection Discovery usesT1090.003Multi-hop Proxy usesT1588.002Tool usesT1018Remote System Discovery usesT1083File and Directory Discovery usesS0590NBTscan