Trusted Design

Lotus Blossom

アクターID: G0030

· MITRE Pageへのリンク

脅威アクターの詳細

Lotus Blossom is a long-standing threat group largely targeting various entities in Asia since at least 2009. In addition to government and related targets, Lotus Blossom has also targeted entities such as digital certificate issuers.(Citation: Lotus Blossom Jun 2015)(Citation: Symantec Bilbug 2022)(Citation: Cisco LotusBlossom 2025)

脅威アクターの別名・別称

Lotus Blossom
DRAGONFISH
Spring Dragon
RADIUM
Raspberry Typhoon
Bilbug
Thrip

利用した攻撃手法

• T1560.001 - Archive via Utility
• T1047 - Windows Management Instrumentation
• T1109 - Component Firmware
• T1099 - Timestomp
• T1016.001 - Internet Connection Discovery
• T1116 - Code Signing
• T1587.001 - Malware
• T1592.001 - Hardware
• T1176.001 - Browser Extensions
• T1059.009 - Cloud API
• T1590.006 - Network Security Appliances
• T1504 - PowerShell Profile
• T1219.001 - IDE Tunneling
• T1055.004 - Asynchronous Procedure Call
• T1199 - Trusted Relationship
• T1056.002 - GUI Input Capture
• T1570 - Lateral Tool Transfer
• T1505 - Server Software Component
• T1134 - Access Token Manipulation
• T1209 - Time Providers
• T1569.002 - Service Execution

関連するCVE (攻撃手法に関連)

• CVE-2015-4495 (T1219.001)
• CVE-2015-5749 (T1560.001)
• CVE-2016-1898 (T1560.001)
• CVE-2016-1897 (T1560.001)
• CVE-2015-7261 (T1560.001)
• CVE-2015-6036 (T1560.001)
• CVE-2015-7262 (T1560.001)
• CVE-2015-0932 (T1560.001)
• CVE-2010-3081 (T1209)
• CVE-2017-16929 (T1219.001)
• CVE-2025-31125 (T1219.001)
• CVE-2025-68645 (T1209)
• CVE-2014-4114 (T1219.001)
• CVE-2017-0143 (T1219.001)
• CVE-2015-2546 (T1219.001)
• CVE-2014-4113 (T1505)
• CVE-2015-1701 (T1505)
• CVE-2017-0263 (T1219.001)
• CVE-2015-0057 (T1219.001)
• CVE-2015-2360 (T1505)
• CVE-2014-4148 (T1219.001)
• CVE-2015-1770 (T1199)
• CVE-2012-1856 (T1219.001)
• CVE-2015-2545 (T1219.001)
• CVE-2014-6332 (T1219.001)
• CVE-2017-0199 (T1219.001)
• CVE-2012-0158 (T1570)
• CVE-2014-6352 (T1199)
• CVE-2015-0016 (T1219.001)
• CVE-2012-4792 (T1219.001)
• CVE-2014-0322 (T1219.001)
• CVE-2014-4322 (T1219.001)
• CVE-2013-7331 (T1569.002)
• CVE-2010-4398 (T1209)
• CVE-2013-2595 (T1059.009)
• CVE-2015-5122 (T1134)
• CVE-2015-3043 (T1134)
• CVE-2015-3456 (T1590.006)
• CVE-2015-3090 (T1219.001)
• CVE-2016-0984 (T1219.001)
• CVE-2015-0313 (T1219.001)
• CVE-2014-0329 (T1219.001)
• CVE-2015-5134 (T1219.001)
• CVE-2015-5539 (T1219.001)
• CVE-2015-5557 (T1219.001)
• CVE-2015-5563 (T1219.001)
• CVE-2015-5559 (T1219.001)
• CVE-2015-5540 (T1219.001)
• CVE-2015-5561 (T1219.001)
• CVE-2015-5551 (T1219.001)
• CVE-2015-5564 (T1219.001)
• CVE-2015-5565 (T1219.001)
• CVE-2015-5550 (T1219.001)
• CVE-2015-5566 (T1219.001)
• CVE-2015-5127 (T1219.001)
• CVE-2015-5556 (T1219.001)
• CVE-2015-3628 (T1219.001)
• CVE-2016-1287 (T1055.004)
• CVE-2015-8287 (T1590.006)
• CVE-2016-2342 (T1209)
• CVE-2012-0507 (T1219.001)
• CVE-2014-8439 (T1209)
• CVE-2013-2551 (T1219.001)
• CVE-2014-0569 (T1219.001)
• CVE-2023-1389 (T1134)
• CVE-2025-34026 (T1055.004)
• CVE-2026-20127 (T1219.001)
• CVE-2014-6324 (T1219.001)
• CVE-2015-5119 (T1219.001)
• CVE-2015-3785 (T1219.001)
• CVE-2015-5897 (T1219.001)
• CVE-2015-3113 (T1219.001)
• CVE-2015-2590 (T1219.001)
• CVE-2015-2424 (T1219.001)
• CVE-2015-0097 (T1219.001)
• CVE-2015-2502 (T1219.001)
• CVE-2014-6271 (T1209)
• CVE-2016-1990 (T1219.001)
• CVE-2016-1991 (T1219.001)
• CVE-2016-1010 (T1219.001)
• CVE-2016-1019 (T1219.001)
• CVE-2016-1001 (T1219.001)
• CVE-2016-0998 (T1219.001)
• CVE-2015-1641 (T1219.001)
• CVE-2015-0359 (T1134)
• CVE-2015-5130 (T1219.001)
• CVE-2015-2852 (T1219.001)
• CVE-2015-2854 (T1219.001)
• CVE-2015-2853 (T1219.001)
• CVE-2012-4969 (T1219.001)
• CVE-2015-6022 (T1219.001)
• CVE-2017-0261 (T1134)
• CVE-2017-0262 (T1134)
• CVE-2025-55182 (T1055.004)
• CVE-2015-0311 (T1219.001)
• CVE-2010-3333 (T1209)
• CVE-2012-3213 (T1219.001)
• CVE-2012-1258 (T1209)
• CVE-2015-0336 (T1219.001)
• CVE-2011-3544 (T1219.001)
• CVE-2014-3153 (T1219.001)
• CVE-2015-3636 (T1055.004)
• CVE-2013-6282 (T1219.001)
• CVE-2015-3105 (T1219.001)
• CVE-2014-0497 (T1219.001)
• CVE-2017-17215 (T1219.001)
• CVE-2013-0074 (T1219.001)
• CVE-2013-2465 (T1219.001)
• CVE-2010-0188 (T1219.001)
• CVE-2014-0515 (T1219.001)
• CVE-2015-0310 (T1219.001)
• CVE-2014-1776 (T1219.001)
• CVE-2014-0556 (T1219.001)
• CVE-2012-1876 (T1219.001)
• CVE-2015-5560 (T1219.001)
• CVE-2012-2539 (T1055.004)
• CVE-2015-0071 (T1219.001)
• CVE-2014-9163 (T1209)
• CVE-2012-1723 (T1219.001)
• CVE-2015-1761 (T1219.001)
• CVE-2014-8440 (T1134)
• CVE-2013-3660 (T1055.004)
• CVE-2010-0806 (T1209)
• CVE-2010-2884 (T1219.001)
• CVE-2011-3402 (T1219.001)
• CVE-2014-7247 (T1219.001)
• CVE-2013-2678 (T1219.001)
• CVE-2015-2426 (T1219.001)
• CVE-2008-1436 (T1505)
• CVE-2010-0232 (T1219.001)
• CVE-2014-3393 (T1055.004)
• CVE-2014-2273 (T1219.001)
• CVE-2015-4902 (T1219.001)
• CVE-2014-3897 (T1219.001)
• CVE-2015-2387 (T1219.001)
• CVE-2009-3129 (T1209)
• CVE-2010-2572 (T1219.001)
• CVE-2011-1255 (T1219.001)
• CVE-2013-5990 (T1219.001)
• CVE-2017-8570 (T1219.001)
• CVE-2012-0611 (T1055.004)
• CVE-2015-2419 (T1219.001)
• CVE-2016-0189 (T1219.001)
• CVE-2016-4117 (T1219.001)
• CVE-2017-0001 (T1219.001)
• CVE-2025-24893 (T1219.001)
• CVE-2025-55183 (T1219.001)
• CVE-2025-55184 (T1055.004)
• CVE-2025-66478 (T1219.001)
• CVE-2026-0723 (T1219.001)
• CVE-2015-6034 (T1055.004)
• CVE-2012-0056 (T1055.004)
• CVE-2012-6422 (T1055.004)
• CVE-2025-13928 (T1055.004)
• CVE-2017-7255 (T1134)
• CVE-2010-1553 (T1209)
• CVE-2010-2883 (T1209)

Actor – Pulse グラフ

---

← 脅威アクター一覧に戻る