{
  "id": "lotus-blossom",
  "name": "Lotus Blossom",
  "aliases": [
    "DRAGONFISH",
    "Spring Dragon",
    "RADIUM",
    "Raspberry Typhoon",
    "Bilbug",
    "Thrip"
  ],
  "domain": "cyber",
  "country": "UNK",
  "category": "Unattributed cyber threat group",
  "status": "tracked",
  "fielded": null,
  "operators": [],
  "summary": "Lotus Blossom is a long-standing threat group largely targeting various entities in Asia since at least 2009. In addition to government and related targets, Lotus Blossom has also targeted entities such as digital certificate issuers.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Not attributed by ATT&CK",
      "src": [
        "mitre-g0030"
      ],
      "conf": "low"
    },
    {
      "k": "active_since",
      "v": 2009,
      "src": [
        "mitre-g0030"
      ],
      "conf": "medium",
      "note": "At least 2009"
    },
    {
      "k": "attack_id",
      "v": "G0030",
      "src": [
        "mitre-g0030"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "Lotus Blossom is a long-standing threat group largely targeting various entities in Asia since at least 2009.",
      "src": [
        "mitre-g0030"
      ],
      "conf": "medium"
    },
    {
      "k": "techniques_count",
      "v": 21,
      "src": [
        "mitre-g0030"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "AdFind, certutil, Elise, Emissary, Hannotog, Impacket, NBTscan, Ping, Sagerunex",
      "src": [
        "mitre-g0030"
      ],
      "conf": "high",
      "note": "9 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "Lotus Blossom is a long-standing threat group largely targeting various entities in Asia since at least 2009. In addition to government and related targets, Lotus Blossom has also targeted entities such as digital certificate issuers. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G0030)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/lotus-blossom.html",
  "sources": {
    "mitre-g0030": {
      "title": "Lotus Blossom, Group G0030",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G0030/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}