ChinaAssessedChina-basedEspionageActive 2009 – 2025Lotus Blossom
Also known asSpring Dragon · DRAGONFISH · Billbug · Thrip · RADIUM · Raspberry Typhoon · Lotus Panda · BRONZE ELGIN
Summary
Long-standing espionage group (MITRE G0030; Microsoft: Raspberry Typhoon, China; Symantec: Billbug / Thrip; Kaspersky: Spring Dragon) active since at least 2009 and focused on Asia. Cisco Talos (Feb 2025) attributes, with high confidence, multi-year campaigns against government, manufacturing, telecommunications and media organisations in the Philippines, Vietnam, Hong Kong and Taiwan to it. They deliver the group's exclusive Sagerunex backdoor, which it has used since at least 2016, installed in the registry and run as a Windows service (T1112, T1543.003). Newer variants tunnel C2 through Dropbox, Twitter and Zimbra webmail (T1102), with HTran-derived relays, port scanners and browser-cookie stealers for post-compromise work (T1090.003, T1046, T1539). In 2022 Symantec linked to it a campaign that compromised a digital certificate authority in an Asian country and targeted government and defence agencies. Rapid7 attributes, at moderate confidence, the 2025 hijack of Notepad++'s update hosting to the group; that hijack delivered the new Chrysalis backdoor. Microsoft also folds APT30 into Raspberry Typhoon, but MITRE tracks APT30 separately, so it is not an alias here.
Attribution
No service publicly named
Assessed by security researchers or MITRE ATT&CK; no government attribution on record.
Campaigns 3
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Notepad++ update-hosting hijack delivering the Chrysalis backdoorASSESSED | 2025-06 – 2025-11 | Undisclosed | Software | Rapid7 (2026-02-02) — moderate confidence |
| Certificate-authority compromise and government and defence targeting in Asia (Billbug) | 2022-03 – 2022-11 | Asia | Certificate Authorities, Government, Defense | Symantec (2022-11-15) — "ongoing since at least March 2022": ongoing at publication |
| Sagerunex espionage against government, manufacturing, telecom and media organisations in the Philippines, Vietnam, Hong Kong and Taiwan | 2016 – 2025-02 | Philippines, Vietnam, Hong Kong, Taiwan | Government, Manufacturing, Telecommunications, Media | Cisco Talos (2025-02-27) — high confidence; "continues to operate today": ongoing at publication |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 6
| Persistence2 | T1543.003Windows ServiceT1112Modify Registry |
|---|---|
| Credential Access1 | T1539Steal Web Session Cookie |
| Discovery1 | T1046Network Service Discovery |
| Command and Control2 | T1102Web ServiceT1090.003Multi-hop Proxy |
Malware and tools 3
| Name | Description | Platform |
|---|---|---|
| Sagerunex | Backdoor (exclusive; cloud-service C2 variants) | Windows |
| Elise | Backdoor | Windows |
| Emissary | Trojan | Windows |
Infrastructure patterns
- Sagerunex variants tunnel C2 through Dropbox, Twitter and Zimbra webmail instead of actor VPS (Talos 2025)
- HTran-derived port relay ("mtrain") and Venom proxy to move traffic out of victim networks (Talos 2025)
Reporting and advisories 4
- MITRE ATT&CK
G0030 — Lotus Blossom - Cisco Talos
Lotus Blossom espionage group targets multiple industries with different versions of Sagerunex (27 Feb 2025) - Symantec
Billbug: State-sponsored Actor Targets Cert Authority, Government Agencies in Multiple Asian Countries (15 Nov 2022) - Rapid7
The Chrysalis Backdoor: A Deep Dive into Lotus Blossom's toolkit (2 Feb 2026)