File · LOTUS PANDA · Nation-state · assessed origin China · misp-galaxy + mitre-attack · refreshed 2026-10-06
LOTUS PANDA
- Spring Dragon
- ST Group
- DRAGONFISH
- BRONZE ELGIN
- ATK1
- G0030
- Red Salamander
- Lotus BLossom
state sponsor · ChinaMITRE G0030 ↗
attack rose · 21 techniques across 9 tactics
What changed
ledger · newest first- —todaynew CVE2 new CVEs: CVE-2012-0158, CVE-2014-6332
Analyst brief
misp-galaxy + mitre-attackLotus Blossom is a threat group that has targeted government and military organizations in Southeast Asia.
Observed targets (as stated by the sources)
6 countries · 3 sectorsassessed origin · Chinaobserved targets · 6
countries · 6
- Japan
- Philippines
- Hong Kong
- Indonesia
- Taiwan
- Vietnam
sectors · 3
- Military
- Government
- Government, Administration
as stated by MISP galaxy / ransomware.live — not inferred
Kill chain
MITRE ATT&CK Enterprise · tap a technique21 techniques · 9 of 15 tactics
Resource development
1 techniqueExecution
1 techniquePersistence
1 techniqueStealth
1 techniqueDefense impairment
1 techniqueCredential access
1 techniqueDiscovery
10 techniquesCollection
3 techniquesCommand and control
2 techniques
select a technique
Arsenal
4 malware · 5 toolsas stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id
CVEs LOTUS PANDA is cited as exploiting
none on KEV- CVE-2012-01582026-10-17
“While this particular actor effectively used their almost worn out CVE-2012-0158 exploits in the past, Spring Dragon employs more involved and creative intrusive activity as well.”
cited as exploiting · source: securelist.com ↗ · 2026-10-17
“The group’s spearphish toolset includes PDF exploits, Adobe Flash Player exploits, and the common CVE-2012-0158 Word exploits including those generated from the infamous “Tran Duy Linh” kit.”
cited as exploiting · named nearby · source: securelist.com ↗ · 2026-10-17
- CVE-2014-63322026-10-17
“The actors attempted to exploit CVE-2014-6332 using a slightly modified version of the proof-of-concept (POC) code to install a Trojan called Emissary, which is related to the Operation Lotus Blossom campaign.”
cited as exploiting · source: unit42.paloaltonetworks.com ↗ · 2026-10-17
Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.
Primary-source reports
via APTnotes · linked, never re-hostedTake it with you
keyless · no signupReferences
20 sources- 1.securelist.com/blog/research/70726/the-spring-dragon-apt
- 2.securelist.com/spring-dragon-updated-activity/79067
- 3.cfr.org/interactive/cyber-operations/lotus-blossom
- 4.unit42.paloaltonetworks.com/operation-lotus-blossom
- 5.accenture.com/t00010101T000000Z__w__/gb-en/_acnmedia/PDF-46/Accentur…
- 6.unit42.paloaltonetworks.com/attack-on-french-diplomat-linked-to-operation-lotus-bl…
- 7.community.rsa.com/community/products/netwitness/blog/2018/02/13/lotus-bl…
- 8.accenture.com/t20180127T003755Z_w_/us-en/_acnmedia/PDF-46/Accenture-…
- 9.attack.mitre.org/groups/G0030
- 10.secureworks.com/research/threat-profiles/bronze-elgin
- +10 more in the JSON record
Track LOTUS PANDA on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.