Lotus Blossom espionage group targets multiple industries with different versions of Sagerunex and hacking tools
Summary: Cisco Talos assesses with high confidence that the Lotus Blossom espionage group, active since 2012, has used the Sagerunex backdoor since at least 2016 against government, manufacturing, telecommunications and media organizations in the Philippines, Vietnam, Hong Kong and Taiwan. Talos found two new Sagerunex variants that abandoned the original VPS command-and-control servers for third-party services including Dropbox, Twitter and Zimbra webmail, and observed the actor installing the backdoor as a service through registry keys such as tapisrv, swprv and appmgmt.
Why it matters: An espionage group that has operated since 2012 and kept Sagerunex in use since at least 2016 is now tunneling command-and-control through services like Dropbox and Twitter, so blocking a known VPS address list no longer covers the channel. Talos reports the actor often stays undetected for several months, which is the window in which this persistence would have to be caught.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026