Lotus Blossom
Threat actorNames and who uses them
- Lotus BlossomOur name
- DRAGONFISHAccenture
- RADIUMMicrosoft
- Raspberry TyphoonMicrosoft
- Spring DragonMITRE ATT&CK
- ThripMITRE ATT&CK
- BilbugSymantec
Targets
Sectors: Government
Source: MITRE ATT&CKKnown techniques
- T1012Query Registry
- T1016System Network Configuration Discovery
- T1016.001Internet Connection Discovery
- T1018Remote System Discovery
- T1046Network Service Discovery
- T1047Windows Management Instrumentation
- T1049System Network Connections Discovery
- T1074.001Local Data Staging
- T1083File and Directory Discovery
- T1087.001Local Account
- T1087.002Domain Account
- T1090.001Internal Proxy
- T1090.003Multi-hop Proxy
- T1112Modify Registry
- T1134Access Token Manipulation
- T1482Domain Trust Discovery
- T1539Steal Web Session Cookie
- T1543.003Windows Service
- T1560.001Archive via Utility
- T1560.003Archive via Custom Method
- T1588.002Tool
Malware and tools used
Source: MITRE ATT&CKRecent news
No stories yet.