Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It to Evolve?

Summary: Unit 42 traced the Emissary Trojan, related to the Elise Trojan and Operation Lotus Blossom, to a sample compiled in May 2009, three years earlier than the oldest known Elise sample, and documented versions 1.0 through 5.4 with a marked increase in development after its June 2015 Operation Lotus Blossom report. All collected Emissary decoys are written in Traditional Chinese and target government, higher education, and high tech organizations in Taiwan and Hong Kong, with the actors moving to compromised legitimate Taiwanese websites, including the Democratic Progressive Party's official site, to serve malware.

What you should know: The out-of-sequence version 3.0 sample appeared ten days after Unit 42 published its Operation Lotus Blossom research, and the group shifted to compromised legitimate domains for delivery - a reminder that publishing threat intelligence can prompt an adversary to retool rather than retreat.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related