Trusted Design

Emissary Trojan/ Operation Lotus Blossom Update

概要

In December 2015, Unit 42 published a blog about a cyber espionage attack using the Emissary Trojan as a payload. Emissary is related to the Elise Trojan and the Operation Lotus Blossom attack campaign, which prompted us to start collecting additional samples of Emissary. The oldest sample we found was created in 2009, indicating this tool has been in use for almost seven years. Of note, this is three years earlier than the oldest Elise sample we have found, suggesting this group has been active longer than previously documented. In addition, Emissary appears to only be used against Taiwanese or Hong Kong based targets, all of the decoys are written in Traditional Chinese, and they use themes related to the government or military.

Created: 2026-02-23

Indicators

類似Pulses

Attack on French Diplomat Linked to Operation Lotus Blossom (score: 0.69)
OPERATION LOTUS BLOSSOM (score: 0.68)
Chinese Actors attacks on US Government and EU Media (score: 0.65)
New Sofacy Attacks Against US Government Agency (score: 0.56)
Operation Iron Tiger (score: 0.55)

このPulseに関連する脅威アクター (事実ベース)

Medusa Group

Score: 6.47

Matched TTPs:

T1218.003 - CMSTP
T1548.006 - TCC Manipulation

MITREへのリンク →

Threat Group-3390

Score: 4.13

Matched TTPs:

T1218.003 - CMSTP

MITREへのリンク →

Fox Kitten

Score: 5.63

Matched TTPs:

T1491 - Defacement
T1548.006 - TCC Manipulation

MITREへのリンク →

Volt Typhoon

Score: 5.63

Matched TTPs:

T1491 - Defacement
T1548.006 - TCC Manipulation

MITREへのリンク →

APT38

Score: 3.29

Matched TTPs:

T1491 - Defacement

MITREへのリンク →

Scattered Spider

Score: 18.14

Matched TTPs:

T1491 - Defacement
T1090.004 - Domain Fronting
T1498 - Network Denial of Service
T1027.002 - Software Packing
T1548.006 - TCC Manipulation

MITREへのリンク →

Moonstone Sleet

Score: 5.81

Matched TTPs:

T1491 - Defacement
T1547.008 - LSASS Driver

MITREへのリンク →

Chimera

Score: 5.63

Matched TTPs:

T1491 - Defacement
T1548.006 - TCC Manipulation

MITREへのリンク →

APT29

Score: 6.37

Matched TTPs:

T1592.004 - Client Configurations
T1547.008 - LSASS Driver

MITREへのリンク →

APT32

Score: 3.84

Matched TTPs:

T1592.004 - Client Configurations

MITREへのリンク →

BRONZE BUTLER

Score: 3.84

Matched TTPs:

T1592.004 - Client Configurations

MITREへのリンク →

Contagious Interview

Score: 6.37

Matched TTPs:

T1562.010 - Downgrade Attack
T1547.008 - LSASS Driver

MITREへのリンク →

BlackByte

Score: 3.84

Matched TTPs:

T1562.010 - Downgrade Attack

MITREへのリンク →

Gamaredon Group

Score: 7.00

Matched TTPs:

T1562.010 - Downgrade Attack
T1200 - Hardware Additions

MITREへのリンク →

APT33

Score: 4.13

Matched TTPs:

T1567.001 - Exfiltration to Code Repository

MITREへのリンク →

Wizard Spider

Score: 6.47

Matched TTPs:

T1567.001 - Exfiltration to Code Repository
T1548.006 - TCC Manipulation

MITREへのリンク →

RedCurl

Score: 4.13

Matched TTPs:

T1574.010 - Services File Permissions Weakness

MITREへのリンク →

FIN4

Score: 4.13

Matched TTPs:

T1574.010 - Services File Permissions Weakness

MITREへのリンク →

Storm-0501

Score: 4.13

Matched TTPs:

T1090.004 - Domain Fronting

MITREへのリンク →

Dragonfly

Score: 5.49

Matched TTPs:

T1200 - Hardware Additions
T1548.006 - TCC Manipulation

MITREへのリンク →

Confucius

Score: 3.15

Matched TTPs:

T1200 - Hardware Additions

MITREへのリンク →

Tropic Trooper

Score: 3.15

Matched TTPs:

T1200 - Hardware Additions

MITREへのリンク →

APT28

Score: 5.49

Matched TTPs:

T1200 - Hardware Additions
T1548.006 - TCC Manipulation

MITREへのリンク →

Inception

Score: 3.15

Matched TTPs:

T1200 - Hardware Additions

MITREへのリンク →

DarkHydrus

Score: 3.15

Matched TTPs:

T1200 - Hardware Additions

MITREへのリンク →

Indrik Spider

Score: 3.84

Matched TTPs:

T1498 - Network Denial of Service

MITREへのリンク →

Salt Typhoon

Score: 3.84

Matched TTPs:

T1498 - Network Denial of Service

MITREへのリンク →

FIN6

Score: 4.86

Matched TTPs:

T1548.006 - TCC Manipulation
T1547.008 - LSASS Driver

MITREへのリンク →

Axiom

Score: 4.54

Matched TTPs:

T1160 - Launch Daemon

MITREへのリンク →

このPulseに関連する脅威アクター (推論ベース)

Scattered Spider

Score: 0.82

Matched TTPs:

T1027.002 - Software Packing
T1498 - Network Denial of Service
T1548.006 - TCC Manipulation
T1090.004 - Domain Fronting
T1491 - Defacement

MITREへのリンク →

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクターグラフ

← Pulse一覧に戻る