Full Report
Researchers from Cisco Talos have discovered multiple cyber espionage campaigns that target various sectors, including government, manufacturing, telecommunications,... The post Cisco Talos exposes Lotus Blossom cyber espionage campaigns targeting governments, telecom, media appeared first on Industrial Cyber.
Analysis Summary
# Threat Actor: Lotus Blossom
## Attribution & Identity
**Threat Actor:** Lotus Blossom
**Aliases and Associated Groups:** Spring Dragon, Billbug, Thrip
**Attribution Basis:** High confidence attribution by Cisco Talos based on consistent TTPs, and exclusive use of the Sagerunex backdoor family.
## Activity Summary
Lotus Blossom has been conducting cyber espionage operations since at least 2012 and remains active. Recent campaigns exposed by Cisco Talos target governments, manufacturing, telecommunications, and media sectors, delivering Sagerunex and other hacking tools for post-compromise activities.
## Tactics, Techniques & Procedures
- **Initial Access/Delivery:** Delivering Sagerunex and other hacking tools.
- **Persistence:** Gaining persistence by using specific commands to install the Sagerunex backdoor within the system registry and configuring it to run as a service on infected endpoints.
- **Malware Use:** Exclusive use and development of new variants of the Sagerunex backdoor family.
- **Command and Control (C2):** Utilizing C2 servers, and increasingly leveraging legitimate, third-party cloud services (Dropbox, Twitter, Zimbra open-source webmail) as C2 tunnels.
- **General:** Employing long-term persistence command shells.
## Targeting
- **Sectors:** Government, Manufacturing, Telecommunications, Media, Critical Infrastructure.
- **Geography:** Targeted organizations noted in areas including the Philippines (specific country mentioned).
- **Victims:** Specific organizations were not detailed in the summary, only targeted sectors.
## Tools & Infrastructure
- **Malware Families Used:** Sagerunex (backdoor).
- **Infrastructure (C2, Domains, IPs):** Command and control utilized traditional C2 servers, and legitimate third-party cloud services including Dropbox, Twitter, and the Zimbra open-source webmail as C2 tunnels.
## Implications
Lotus Blossom is a persistent, mature cyber espionage group demonstrating adaptability by shifting C2 traffic to third-party cloud services. Their long-term focus on critical sectors, including government and telecommunications, suggests objectives related to intelligence gathering over extended periods.
## Mitigations
- Implement advanced endpoint security capable of detecting registry modification for service creation used for persistence via the Sagerunex backdoor.
- Monitor network egress traffic for anomalous activity or unusually high volumes of data transfer to common cloud services (Dropbox, Twitter, Zimbra) that could indicate C2 communications.
- Review system configurations for persistence mechanisms established as services via registry manipulation associated with malware installation.