Trusted Design

The Spring Dragon APT

概要

Let’s examine a couple of interesting delivery techniques from an APT active for the past several years, the Spring Dragon APT. A paper released today by our colleagues at Palo Alto Networks presented a portion of data on this crew under the label “the Lotus Blossom Operation“, likely named for the debug string present in much of the "Elise" codebase since at least 2012: “d:\lstudio\projects\lotus\…”.

Created: 2026-02-23

Indicators

• CVE - CVE-2012-0158 -
• hostname - www.bkav2010.net -
• CVE - CVE-2010-2883 -
• URL - http://96.47.234.246/support/flashplayer/install_flashplayer -
• FileHash-MD5 - a42c966e26f3577534d03248551232f3 -
• URL - http://www.bkav2010.net/support/flashplayer/downloads.html -
• CVE - CVE-2014-6332 -

類似Pulses

• Emissary Trojan/ Operation Lotus Blossom Update (score: 0.52)
• Sofacy Recycles Carberp and Metasploit Code (score: 0.50)
• Attack on French Diplomat Linked to Operation Lotus Blossom (score: 0.48)
• Multiple Chinese APT Groups Quickly Use Flash Zero-Day (score: 0.46)
• Putter Panda activity (score: 0.46)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る