type: intrusion-set
spec_version: 2.1
id: intrusion-set--88b7dbc2-32d3-4e31-af2f-3fc24e1582d7
created: 2017-05-31T21:32:01.092Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0030
external_id: G0030
source_name: DRAGONFISH
description: (Citation: Accenture Dragonfish Jan 2018)
source_name: Thrip
description: (Citation: Cisco LotusBlossom 2025)
source_name: Lotus Blossom
description: (Citation: Lotus Blossom Jun 2015)(Citation: Accenture Dragonfish Jan 2018)
source_name: RADIUM
description: (Citation: Microsoft Threat Actor Naming July 2023)
source_name: Raspberry Typhoon
description: (Citation: Microsoft Threat Actor Naming July 2023)
source_name: Spring Dragon
description: (Citation: Spring Dragon Jun 2015)(Citation: Accenture Dragonfish Jan 2018)
source_name: Bilbug
description: (Citation: Symantec Bilbug 2022)
source_name: Accenture Dragonfish Jan 2018
description: Accenture Security. (2018, January 27). DRAGONFISH DELIVERS NEW FORM OF ELISE MALWARE TARGETING ASEAN DEFENCE MINISTERS’ MEETING AND ASSOCIATES. Retrieved November 17, 2024.
url: https://web.archive.org/web/20190508165226/https://www.accenture.com/t20180127T003755Z_w_/us-en/_acnmedia/PDF-46/Accenture-Security-Dragonfish-Threat-Analysis.pdf
source_name: Spring Dragon Jun 2015
description: Baumgartner, K.. (2015, June 17). The Spring Dragon APT. Retrieved February 15, 2016.
url: https://securelist.com/the-spring-dragon-apt/70726/
source_name: Lotus Blossom Jun 2015
description: Falcone, R., et al.. (2015, June 16). Operation Lotus Blossom. Retrieved February 15, 2016.
url: https://www.paloaltonetworks.com/resources/research/unit42-operation-lotus-blossom.html
source_name: Cisco LotusBlossom 2025
description: Joey Chen, Cisco Talos. (2025, February 27). Lotus Blossom espionage group targets multiple industries with different versions of Sagerunex and hacking tools. Retrieved March 15, 2025.
url: https://blog.talosintelligence.com/lotus-blossom-espionage-group/
source_name: Microsoft Threat Actor Naming July 2023
description: Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.
url: https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide
source_name: Symantec Bilbug 2022
description: Symntec Threat Hunter Team. (2022, November 12). Billbug: State-sponsored Actor Targets Cert Authority, Government Agencies in Multiple Asian Countries. Retrieved March 15, 2025.
url: https://www.security.com/threat-intelligence/espionage-asia-governments-cert-authority
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-23T21:20:58.367Z
name: Lotus Blossom
description: [Lotus Blossom](https://attack.mitre.org/groups/G0030) is a long-standing threat group largely targeting various entities in Asia since at least 2009. In addition to government and related targets, [Lotus Blossom](https://attack.mitre.org/groups/G0030) has also targeted entities such as digital certificate issuers.(Citation: Lotus Blossom Jun 2015)(Citation: Symantec Bilbug 2022)(Citation: Cisco LotusBlossom 2025)
aliases: Lotus Blossom
DRAGONFISH
Spring Dragon
RADIUM
Raspberry Typhoon
Bilbug
Thrip
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_version: 4.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Prinesha Dobariya
x_mitre_domains: enterprise-attack