Loading story…
Palo Alto Networks Unit 42 reported that Operation Lotus Blossom actors used a conference invitation as a social-engineering lure to target victims in a likely espionage-focused campaign. The activity relied on a themed decoy document to entice recipients into opening malicious content, continuing the group's pattern of using tailored documents and trusted-looking communications to gain an initial foothold.
The report links the lure to the broader Operation Lotus Blossom intrusion set, a threat actor associated with targeted attacks against organizations in Asia. The use of a conference-themed invitation highlights the group's emphasis on believable, context-specific phishing material designed to deliver malware and support long-term access to victim environments.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Palo Alto Networks Unit 42 published a public security advisory reporting that Operation Lotus Blossom actors were using a conference invitation as a lure in their activity. The reference provides no additional dated milestones beyond the advisory itself.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers linked the **Operation Lotus Blossom** espionage campaign to the long-running **Emissary** and **Elise** malware families, tracing Emissary samples back to **2009** and tying the activity to intrusions against organizations in **Taiwan**, **Hong Kong**, and at least one **French diplomat**. The targeting and lures focused on government, military, higher education, and high-tech entities, often using decoy documents in **Traditional Chinese**. Infrastructure overlap between Emissary and Elise, including shared command-and-control hosting, reinforced the connection between the malware families and the broader campaign. Analysis showed Emissary evolving rapidly across versions **1.0** through **5.4**, adding new persistence methods, configuration changes, DLL injection, service hijacking, redesigned command handling, and anti-detection techniques such as recompilation and junk-data padding. After public reporting on Lotus Blossom, the operators appeared to accelerate development and shifted delivery tactics to compromised legitimate Taiwanese websites, including the **Democratic Progressive Party** site. More recent Elise samples were delivered through malicious **RTF** documents exploiting `CVE-2018-0802`, then injected into Internet Explorer and used sandbox-evasion checks, proxy modification, host reconnaissance, file transfer, and remote command execution to sustain espionage operations.
Aug 15, 2026
ESET reported that the **OceanLotus** threat group, also tracked as **APT32** and **APT-C-00**, deployed an updated backdoor against company and government networks in East Asia. The intrusion chain relied on social-engineering lures, including double-extension decoy files and fake software installers such as `RobototFontUpdate.exe`, to deliver a multi-stage dropper and backdoor. The malware used layered obfuscation, encrypted payloads, and shellcode-based PE loading to hinder analysis and detection. The campaign also abused **DLL side-loading** through legitimate signed executables, including Symantec’s `rastlsc.exe`, to execute malicious components while appearing trustworthy. After installation, the backdoor established persistence through a Windows service or `Run` registry key, then communicated with command-and-control servers over TCP port `25123` with fallback HTTP/HTTPS channels. ESET said the malware gave operators broad post-compromise access, including host fingerprinting, file and registry manipulation, process execution, and the ability to load additional payloads.
Aug 14, 2026
Palo Alto Networks Unit 42 reported a sustained spearphishing campaign linked to the **Lazarus group** that targeted Korean-speaking individuals and later people associated with U.S. defense contractors. The attackers used weaponized Microsoft Office documents with malicious VBA macros, first relying on Korean-language decoys and later shifting to English-language job descriptions and internal policy material tied to defense firms. Researchers said the activity remained active through mid-2017 and showed little operational change despite earlier public exposure. The malware and delivery chain shared multiple traits with **Operation Blockbuster** and the later **Blockbuster Sequel**, including packed payloads, fake TLS-like communications, hard-coded command-and-control infrastructure, encoded strings, cleanup batch scripts, direct IP beaconing, and overlapping macros, XOR keys, and infrastructure. Unit 42 also found reused compromised hosts serving lure files, metadata such as the author name `ISkyISea`, and evidence of an automated document weaponization process, leading researchers to assess that the operators were either the same Lazarus-linked actors or closely cooperating with them.
Aug 15, 2026