Gold Open Source
ExplorePackagesVulnerabilitiesMCP Servers
Login
Gold Open Source

The authoritative source for production-ready open-source components. Every package, container image, AI model, and MCP server undergoes rigorous verification for security, malware, and license compliance.

Explore Gold

  • Explore Everything
  • Packages
  • Gold Packages
  • Container Images
  • AI Models
  • MCP Servers
  • Agent Skills
  • Chip Manufacturers

Security Data & Tools

  • Scan Your Dependencies
  • Trending Threats
  • Threat RSS Feeds
  • CVE Database
  • Actively Exploited (KEV)
  • SGZ Zero-Days
  • CWE Index
  • MITRE ATT&CK
  • Malicious Packages
  • Security Glossary
  • Supply-Chain Report
  • Developers (API & Badge)
  • Chrome Extension
  • Credits & Data Sources

Products

  • The Platform
  • ESSCM
  • Portal
  • TPRM
  • OSM
  • Cowork
  • Code / Runner
  • Guard

Use Cases

  • Know Your Software
  • Auto-Fix Vulnerabilities
  • Asset Discovery
  • AI Governance
  • MCP Server Security
  • Supply Chain Compliance
  • Zero-Day Discovery
  • All Use Cases

Company

  • About
  • Pricing
  • Blog
  • Documentation
  • Safeguard Academy
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 Gold Open Source. All rights reserved.

Built with care bySafeguard
Home/ATT&CK/Groups/G0030
MITRE ATT&CK Group

Lotus Blossom (G0030)

DRAGONFISHSpring DragonRADIUMRaspberry TyphoonBilbugThrip
ShareXLinkedInRedditHN

[Lotus Blossom](https://attack.mitre.org/groups/G0030) is a long-standing threat group largely targeting various entities in Asia since at least 2009. In addition to government and related targets, [Lotus Blossom](https://attack.mitre.org/groups/G0030) has also targeted entities such as digital certificate issuers.(Citation: Lotus Blossom Jun 2015)(Citation: Symantec Bilbug 2022)(Citation: Cisco LotusBlossom 2025)

▪Techniques used (21)

T1016System Network Configuration DiscoveryT1543.003Windows ServiceT1087.002Domain Account

▪Software used (9)

S0552AdFindtoolS0097Pingtool
G0030 on MITRE ATT&CK →
T1074.001Local Data Staging
T1134Access Token Manipulation
T1087.001Local Account
T1090.001Internal Proxy
T1539Steal Web Session Cookie
T1112Modify Registry
T1049System Network Connections Discovery
T1047Windows Management Instrumentation
T1482Domain Trust Discovery
T1016.001Internet Connection Discovery
T1090.003Multi-hop Proxy
T1588.002Tool
T1018Remote System Discovery
T1083File and Directory Discovery
T1560.003Archive via Custom Method
T1560.001Archive via Utility
T1046Network Service Discovery
T1012Query Registry
S0357Impackettool
S0082Emissarymalware
S0081Elisemalware
S1211Hannotogmalware
S0590NBTscantool
S1210Sagerunexmalware
S0160certutiltool

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.