Warbird
Warbird is a loader associated with the Chinese espionage actor Lotus Blossom (also known as Lotus Panda and Billbug). Public reporting referenced in the provided content states Lotus Blossom is suspected of deploying the Chrysalis backdoor together with the Warbird loader in a Notepad++ supply-chain compromise. The available content ties Warbird to Windows-focused activity and specifically to a clipc.dll shellcode-loading technique. Detection content includes a YARA rule named "APT_LotusBlossom_Chrysalis_Loader_Warbird" designed to identify payload bytes in the first 0x490 bytes of clipc.dll memory mappings, including markers "EF BE AD DE" and "FE AF FE CA" within offsets 0..1167, and a query that scans VAD mappings for clipc.dll with execute/read protection. The artifact context indicates Warbird-related hunting is intended to scope IOCs from the publicly disclosed Notepad++ compromise. High-confidence related infrastructure and network indicators in the same Chrysalis/Notepad++ detection package include domains api.skycloudcenter.com, api.wiresguard.com, self-dns.it.com, cdncheck.it.com, and safe-dns.it.com; IPs 95.179.213.0, 59.110.7.32, 124.222.137.114, 45.76.155.202, 45.32.144.255, and 45.77.31.210; ports :8880 and :9999; and URI paths such as /update/v1, /api/update/v1, /api/FileUpload/submit, /api/getInfo/v1, /api/getBasicInfo/v1, /api/Metadata/submit, /api/Info/submit, /api/updateStatus/v1, /resolve, /dns-query, /a/chat/s/, /uffhxpSy, /3yZR31VK, and /list. The content does not provide further confirmed details on Warbird’s standalone infection vector, persistence, or payload functionality beyond its role as a loader in the Lotus Blossom/Chrysalis intrusion set.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Recent activity
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Loader reportedly used by Lotus Blossom in operations targeting Notepad++-related infrastructure, likely to stage or deliver additional payloads (including backdoors) and support exfiltration objectives.
Loader referenced as used alongside the Chrysalis backdoor in suspected Lotus Blossom activity to establish/extend compromise and deliver payloads.
Loader reportedly used alongside the Chrysalis backdoor by Lotus Blossom to facilitate compromise and payload delivery on targeted infrastructure.
Loader referenced as being used alongside the Chrysalis backdoor in suspected Lotus Blossom activity to compromise infrastructure and support follow-on capability deployment/exfiltration.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.