Cisco LotusBlossom 2025

Lotus Blossom has run commands such as `reg query HKLM\SYSTEM\CurrentControlSet\Services\[service name]\Parameters` to verify if installed implants are running as a service.

Lotus Blossom has used commands such as `ipconfig` and `netstat` to gather network information on compromised hosts.

Sagerunex will gather system information such as MAC and IP addresses.

Lotus Blossom has performed checks to determine if a victim machine is able to access the Internet.

Sagerunex has used VMProtect to pack and obscure itself.

Sagerunex encrypts collected system data then exfiltrates via existing command and control channels.

Lotus Blossom has used WMI to enable lateral movement.

Lotus Blossom has used commands such as `netstat` to identify system network connections.

Sagerunex is designed to be dynamic link library (DLL) injected into an infected endpoint and executed directly in memory.

Lotus Blossom has locally staged compressed and archived data for follow-on exfiltration.

Sagerunex gathers host information and stages it locally as a RAR file prior to exfiltration. Sagerunex stores logged data in an encrypted file located at `%TEMP%/TS_FB56.tmp` during execution.

Sagerunex gathers information from the infected system such as hostname.

Lotus Blossom has used commands such as `dir` to examine the local filesystem of victim machines.

Lotus Blossom has used commands such as `net` to profile local system users.

Lotus Blossom has used `net` commands and tools such as AdFind to profile domain accounts associated with victim machines and make Active Directory queries.

Sagerunex uses several proxy configuration settings to ensure connectivity.

Lotus Blossom has used publicly available tools such as the Venom proxy tool to proxy traffic out of victim environments.

Lotus Blossom has used tools such as the publicly available HTran tool for proxying traffic in victim environments.

Sagerunex has used virtual private servers (VPS) for command and control traffic as well as third-party cloud services in more recent variants.

Sagerunex has used web services such as Twitter for command and control purposes.

Sagerunex calls the `WaitForSingleObject` API function as part of time-check logic.

Lotus Blossom has installed tools such as Sagerunex by writing them to the Windows registry.

Lotus Blossom has retrieved process tokens for processes to adjust the privileges of the launch process or other items.

Sagerunex uses a custom decryption routine to unpack itself during installation.

Sagerunex uses a "servicemain" function to verify its environment to ensure it can only be executed as a service, as well as the existence of a configuration file in a specified directory.

Lotus Blossom has used publicly-available tools to steal cookies from browsers such as Chrome.

Lotus Blossom has configured tools such as Sagerunex to run as Windows services.

Lotus Blossom has used WinRAR for compressing data in RAR format.

Sagerunex has archived collected materials in RAR format.

Lotus Blossom has used custom tools to compress and archive data on victim systems.

Lotus Blossom has used publicly-available tools such as a Python-based cookie stealer for Chrome browsers, Impacket, and the Venom proxy tool.