Loading malware…
Sagerunex is a Windows backdoor/RAT used for espionage and strongly associated with the Lotus Blossom threat actor, also tracked as Lotus Panda, Billbug, Spring Dragon, Thrip, Red Salamander, and Raspberry Typhoon. Reporting in the provided content describes it as one of the group’s defining and primary backdoor frameworks for nearly a decade, with Cisco Talos assessing it is used exclusively by Lotus Blossom and observed in intrusions targeting government, manufacturing, telecommunications, media, defense, and digital certificate authority victims, particularly in the Philippines, Vietnam, Hong Kong, Taiwan, and other Asian countries.
Its documented capabilities include modifying its configuration, executing remote commands, running arbitrary shell commands via cmd.exe, executing EXE files, loading DLLs and invoking exported functions, downloading additional files, uploading or sending files to command-and-control servers, gathering host and system information, selecting file paths, listing proxies, and stealing local files. It has been described as modular and resilient, with multiple communication methods and proxy-aware connectivity logic. Sagerunex uses WinHTTP and HTTPS for C2, and supports several proxy modes including configured proxy, WPAD, Internet Explorer proxy, Firefox proxy, WinHTTP auto-proxy, and direct connection. It also attempts to read proxy configuration from the registry. Some variants used VPS infrastructure, while newer variants used legitimate third-party services including Dropbox, Twitter, and Zimbra for C2 tunneling.
The malware is designed for stealth and persistence. The content states Lotus Blossom has configured Sagerunex to run as a Windows service, including via Windows Registry service configuration. Talos described it as DLL-injected and executed directly in memory. It uses Explorer token impersonation to mimic the logged-in user for proxy access, registry visibility, filesystem permissions, and more reliable C2 communications without spawning a new process. It also supports configurable operating time windows so activity can be limited to selected hours such as office hours. Additional evasion noted in the content includes VMProtect obfuscation in some variants.
For local staging and storage, Sagerunex gathers host information and stages it locally as a RAR archive prior to exfiltration, and archived collected materials in RAR format. It encrypts collected system data before exfiltration over existing C2 channels. Reported file artifacts include encrypted logs at %TEMP%/TS_FB56.tmp during execution, and encrypted configuration/state stored at %appdata%/microsoft/protect/windows/DMI%X.DAT with the file modification year altered to 2011. One analyzed sample required configuration passed through the exported function MainEntry and decrypted it with a simple XOR operation; another sample did not contain a hardcoded configuration and instead received configuration as an argument and created a local file to store that configuration. Symantec reported AES-256-CBC with 8192 rounds of SHA-256 for log and network communication encryption, and HTTPS C2 using the user agent Mozilla/5.0 (compatible; MSIE 7.0; Win32).
The content also notes development overlap with the Chrysalis backdoor used in the 2025-2026 Notepad++ supply-chain campaign: Chrysalis shares a rare API hashing algorithm with Sagerunex, indicating a shared development lineage.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Main Features: Sagerunex is shipped with several features, including modifying its configuration, executing commands remotely, downloading further files, or sending files to the C2. This piece of malware therefore appears as an efficient backdoor for espionage purposes.
Main Features: Sagerunex is shipped with several features, including modifying its configuration, executing commands remotely, downloading further files, or sending files to the C2. This piece of malware therefore appears as an efficient backdoor for espionage purposes.
31 distinct techniques documented for this family, organized by ATT&CK tactic.
Attackers used a sophisticated loader that leverages Microsoft Warbird, an undocumented internal Windows code-protection framework. This allowed them to execute malicious shellcode while masquerading as a legitimate, Microsoft-signed binary, effectively bypassing many security solutions.
Examples throughout the content include 'encrypted payloads decrypted and executed in memory,' 'encrypts its configuration file,' 'AES-encrypted resource,' 'RC4 encrypted embedded scripts,' and 'payload includes an encrypted main component.'
The sample stores configuration and state in the following file: %appdata%/microsoft/protect/windows/DMI%X.DAT
The config file modification date will always be in the year 2011 – the “file last edit” year is changed by the malware to 2011.
Sagerunex leverage Explorer token impersonation. It can then behave exactly like the logged-in user
The content repeatedly describes malware and threat actors decoding, decrypting, or deobfuscating payloads, strings, configuration data, commands, and C2 traffic prior to execution or use, e.g., 'APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload' and 'Action RAT can use Base64 to decode actor-controlled C2 server communications.'
The content repeatedly describes malware and threat actors obtaining lists of running processes, using utilities such as tasklist, ps, WMI, Get-Process, CreateToolhelp32Snapshot, EnumProcesses, and similar APIs/commands to enumerate active processes on victim systems.
The content repeatedly describes malware and threat actors collecting host details such as OS version, hostname, architecture, CPU, memory, BIOS, domain, language, and other configuration data; e.g., "APT41 uses multiple built-in commands such as systeminfo and net config Workstation to enumerate victim system basic configuration information."
The content repeatedly describes adversaries and malware storing collected data, command output, credentials, archives, or files in local temporary folders, working directories, hidden directories, registry locations, recycle bins, or specific files prior to exfiltration.
Multiple actors and tools are described as using 7-Zip/WinRAR/zip/tar/gzip/makecab/PowerShell Compress-Archive to compress (often password-protect/encrypt) collected data prior to exfiltration (e.g., “used 7zip to archive extracted data in preparation for exfiltration”, “created password-protected RAR archives prior to exfiltration”, “used built-in PowerShell capabilities (Compress-Archive cmdlet) to compress collected data”).
To communicate with its command and control server (C2), Sagerunex uses the following user-agent ... The malware uses WinHTTP for C2 communications.
AuditCred can utilize proxy for communications... FunnyDream can identify and use configured proxies in a compromised network for C2 communication... Kapeka can identify system proxy settings via WinHttpGetIEProxyConfigForCurrentUser() during initialization and utilize these settings for subsequent command and control operations... PoshC2 contains modules that allow for use of proxies in command and control.
the sample will try all the following supported connection modes... HTTPS with configured proxy ... use proxy provided by WPAD mechanism ... Use proxy from ... Internet Settings\ProxyServer ... get proxy from \Mozilla\Firefox\profiles.ini ... use proxy obtained from WinHttpGetIEProxyConfigForCurrentUser
It initially attempts to connect using the system’s default WinHTTP configuration... If this attempt fails, it seems to fall back to multiple explicit proxy discovery mechanisms including WPAD, Internet Explorer, Firefox, auto-proxy, and preconfigured proxy settings.
Cisco Talos’ findings, according to which Sagerunex also leverages legitimate services such as Dropbox, Twitter, and Zimbra for C2 purposes.
Sagerunex is shipped with several features, including modifying its configuration, executing commands remotely, downloading further files
In all cases, HTTPS is used... The network packet is composed of two parts: the header and the payload. Both are encrypted separately.
Multiple malware families and intrusion sets are described as encrypting C2 traffic using SSL/TLS/HTTPS (e.g., "used HTTPS for command and control", "encrypts C2 communications with TLS", "uses SSL for encrypting C2 communications", "TLS-encrypted WebSocket Protocol (WSS) for C2").
24 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
30 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Primary modular backdoor framework for Lotus Blossom; commonly installed as a Windows service; newer variants use legitimate cloud/email services for C2 to increase stealth.
Backdoor family described as a defining toolset element for Lotus Blossom operations for nearly a decade.
Backdoor used by Lotus Panda/Lotus Blossom since at least 2016; updated variants used against government and other sectors in parts of Asia.
A long-running backdoor family associated with Lotus Blossom, used for persistent access and espionage across multiple variants over years.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.