← Back to Actors
Lotus Blossom
Lotus BlossomDRAGONFISHSpring DragonRADIUMRaspberry TyphoonBilbugThrip
[Lotus Blossom](https://attack.mitre.org/groups/G0030) is a long-standing threat group largely targeting various entities in Asia since at least 2009. In addition to government and related targets, [Lotus Blossom](https://attack.mitre.org/groups/G0030) has also targeted entities such as digital certificate issuers.(Citation: Lotus Blossom Jun 2015)(Citation: Symantec Bilbug 2022)(Citation: Cisco LotusBlossom 2025)
21
Techniques
20
Covered
1
Gaps
95%
Coverage
Coverage20/21
COVERED (20)
T1012Query Registry25 det.T1016System Network Configuration Discovery41 det.T1016.001Internet Connection Discovery6 det.T1018Remote System Discovery51 det.T1046Network Service Discovery52 det.T1047Windows Management Instrumentation88 det.T1049System Network Connections Discovery23 det.T1074.001Local Data Staging10 det.T1083File and Directory Discovery48 det.T1087.001Local Account34 det.T1087.002Domain Account58 det.T1090.001Internal Proxy10 det.T1090.003Multi-hop Proxy9 det.T1112Modify Registry205 det.T1134Access Token Manipulation31 det.T1482Domain Trust Discovery41 det.T1539Steal Web Session Cookie16 det.T1543.003Windows Service80 det.T1560.001Archive via Utility27 det.T1588.002Tool13 det.