← Back to Actors
Lotus Blossom
Lotus BlossomDRAGONFISHSpring DragonRADIUMRaspberry TyphoonBilbugThrip
[Lotus Blossom](https://attack.mitre.org/groups/G0030) is a long-standing threat group largely targeting various entities in Asia since at least 2009. In addition to government and related targets, [Lotus Blossom](https://attack.mitre.org/groups/G0030) has also targeted entities such as digital certificate issuers.(Citation: Lotus Blossom Jun 2015)(Citation: Symantec Bilbug 2022)(Citation: Cisco LotusBlossom 2025)
21
Techniques
20
Covered
1
Gaps
95%
Coverage
Coverage20/21
COVERED (20)
T1012Query Registry25 det.T1016System Network Configuration Discovery41 det.T1016.001Internet Connection Discovery6 det.T1018Remote System Discovery52 det.T1046Network Service Discovery53 det.T1047Windows Management Instrumentation88 det.T1049System Network Connections Discovery23 det.T1074.001Local Data Staging10 det.T1083File and Directory Discovery49 det.T1087.001Local Account35 det.T1087.002Domain Account58 det.T1090.001Internal Proxy10 det.T1090.003Multi-hop Proxy9 det.T1112Modify Registry208 det.T1134Access Token Manipulation31 det.T1482Domain Trust Discovery41 det.T1539Steal Web Session Cookie21 det.T1543.003Windows Service80 det.T1560.001Archive via Utility27 det.T1588.002Tool13 det.