Operation Lotus Blossom: A New Nation-State Cyberthreat?
Summary: Unit 42 identified a cyber espionage campaign it named Lotus Blossom, linking more than 50 attacks over the past three years against government and military organizations in Hong Kong, Taiwan, Vietnam, the Philippines, and Indonesia. The group relies on spearphishing emails with legitimate-looking decoy documents, typically personnel rosters for specific military or government offices, to deliver the custom Elise malware, of which three variants appeared across 50 samples.
What you should know: Unit 42 assesses the actors are likely state-sponsored, from a country with interests in Southeast Asian government and military affairs, and the campaign has run for years - a well-resourced adversary operating on a timeline your incident response cycle was not built for.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026