The Lotus Blossom APT group’s sophisticated use of WMI, legitimate cloud platforms, and stealthy persistence mechanisms underscores the need for robust cybersecurity measures tailored to counter advanced threat actors. The Lotus Blossom Advanced Persistent Threat (APT) group, also known as Lotus Panda, Billbug, and Spring Dragon, has intensified its cyberespionage efforts with new variants of the Sagerunex backdoor. These developments highlight the group’s evolving tactics, including leveraging Windows Management Instrumentation (WMI) for post-exploitation activities and employing legitimate cloud services for command-and-control (C2) communications. Endpoint Detection and Response (EDR): Deploy behavior-based EDR tools capable of identifying suspicious activities such as registry modifications and encrypted communications with cloud services. On compromised machines, the attackers deploy a suite of tools, including RAR archivers for data compression, custom proxy utilities like Venom for traffic relaying, and Chrome cookie stealers for credential harvesting. The Sagerunex backdoor demonstrates advanced evasion techniques by utilizing legitimate platforms such as Dropbox, Twitter (X), and Zimbra for C2 communications. Security Validation: Use Breach and Attack Simulation (BAS) platforms to test defenses against Lotus Blossom’s tactics. According to Picus Security, these platforms allow attackers to blend malicious traffic with normal user activity. Lotus Blossom’s attack chain begins with initial access achieved through spear-phishing, watering hole attacks, or exploiting vulnerabilities in public-facing applications. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. If direct internet access is unavailable, the group uses proxy configurations or deploys Venom to route traffic through other infected hosts. This technique enables attackers to execute commands on remote systems without deploying additional malware, making detection more challenging.
This Cyber News was published on cybersecuritynews.com. Publication date: Sat, 29 Mar 2025 16:50:17 +0000