Loading story…
Researchers linked the Operation Lotus Blossom espionage campaign to the long-running Emissary and Elise malware families, tracing Emissary samples back to 2009 and tying the activity to intrusions against organizations in Taiwan, Hong Kong, and at least one French diplomat. The targeting and lures focused on government, military, higher education, and high-tech entities, often using decoy documents in Traditional Chinese. Infrastructure overlap between Emissary and Elise, including shared command-and-control hosting, reinforced the connection between the malware families and the broader campaign.
Analysis showed Emissary evolving rapidly across versions 1.0 through 5.4, adding new persistence methods, configuration changes, DLL injection, service hijacking, redesigned command handling, and anti-detection techniques such as recompilation and junk-data padding. After public reporting on Lotus Blossom, the operators appeared to accelerate development and shifted delivery tactics to compromised legitimate Taiwanese websites, including the Democratic Progressive Party site. More recent Elise samples were delivered through malicious RTF documents exploiting CVE-2018-0802, then injected into Internet Explorer and used sandbox-evasion checks, proxy modification, host reconnaissance, file transfer, and remote command execution to sustain espionage operations.
TTPs, infrastructure, and targeting history in one profile.
16 events from the most recent confirmed update back to the earliest known activity.
According to the Joe Security content, Microsoft patched the Equation Editor vulnerability CVE-2017-11882 in November 2017.
The Joe Security analysis states that Embedi detected an exploit in Microsoft Office Equation Editor in November 2017, later identified as CVE-2017-11882.
Unit 42 published a December 2015 report on cyber-espionage attacks using the Emissary Trojan as a payload, linking the malware to broader espionage activity.
Between August and November 2015, the malware author rapidly produced Emissary versions 5.0, 5.1, 5.3, and 5.4, indicating accelerated iteration to adapt and evade detection.
An out-of-sequence Emissary version 3.0 sample compiled on June 25, 2015 introduced DLL injection into Internet Explorer and switched from GUID-based to numeric commands, appearing to be an early variant of version 5.0.
Emissary version 4.0 was created in March 2015, combining installation, loading, and functional code in a single file and supporting persistence via service hijacking or Run keys.
Emissary version 3.0 was released in December 2014, marking another documented stage in the malware's evolution.
An updated Emissary 2.0 sample compiled in October 2013 added the ability to run as a service, expanding its persistence and execution options.
Emissary version 2.0 was created in September 2011 as a significant rewrite, including changes such as new configuration storage and debug logging.
A follow-on Emissary version 1.1 sample was created in June 2009, showing continued early development of the malware family.
Researchers identified the earliest known Emissary Trojan sample as having been created in May 2009, indicating the malware family had been active earlier than previously documented for related tooling.
Joe Security published an analysis of a recent Elise malware sample delivered via a malicious RTF document that exploited CVE-2018-0802, injected code into Internet Explorer, and used multiple sandbox-evasion checks before executing.
The Joe Security content says a second Equation Editor exploit, CVE-2018-0802, was detected in late December and was used by the analyzed Elise sample instead of CVE-2017-11882.
Unit 42 published a detailed changelog analysis of the Emissary Trojan, tracing its development from 2009 through late 2015 and linking it to Operation Lotus Blossom and Elise infrastructure.
Palo Alto Networks published research linking an attack on a French diplomat to Operation Lotus Blossom.
Palo Alto Networks published research on Operation Lotus Blossom, publicly documenting the campaign and its tooling.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 103 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
joesecurity.org
Open sourceresearchcenter.paloaltonetworks.com
Open sourceunit42.paloaltonetworks.com
Open sourceblog.paloaltonetworks.com
Open sourceblog.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks Unit 42 reported that **Operation Lotus Blossom** actors used a conference invitation as a social-engineering lure to target victims in a likely espionage-focused campaign. The activity relied on a themed decoy document to entice recipients into opening malicious content, continuing the group's pattern of using tailored documents and trusted-looking communications to gain an initial foothold. The report links the lure to the broader **Operation Lotus Blossom** intrusion set, a threat actor associated with targeted attacks against organizations in Asia. The use of a conference-themed invitation highlights the group's emphasis on believable, context-specific phishing material designed to deliver malware and support long-term access to victim environments.
Jul 12, 2026
ESET reported that the **OceanLotus** threat group, also tracked as **APT32** and **APT-C-00**, deployed an updated backdoor against company and government networks in East Asia. The intrusion chain relied on social-engineering lures, including double-extension decoy files and fake software installers such as `RobototFontUpdate.exe`, to deliver a multi-stage dropper and backdoor. The malware used layered obfuscation, encrypted payloads, and shellcode-based PE loading to hinder analysis and detection. The campaign also abused **DLL side-loading** through legitimate signed executables, including Symantec’s `rastlsc.exe`, to execute malicious components while appearing trustworthy. After installation, the backdoor established persistence through a Windows service or `Run` registry key, then communicated with command-and-control servers over TCP port `25123` with fallback HTTP/HTTPS channels. ESET said the malware gave operators broad post-compromise access, including host fingerprinting, file and registry manipulation, process execution, and the ability to load additional payloads.
Aug 14, 2026
Researchers linked multiple malware families to **OceanLotus**/**APT32** activity, showing the group used evolving backdoors and loaders in targeted intrusions against organizations in Vietnam and the automotive sector. Earlier analysis described **JEShell**, a Java-based second-stage backdoor deployed alongside **KerrDown**, with both malware families decoding layered shellcode to install or download a **Cobalt Strike Beacon** implant and, in some cases, sharing command-and-control infrastructure for redundancy. JEShell used an XOR-encrypted resource to unpack shellcode and inject it either into the current Java process on 32-bit systems or into a hardcoded `SysWOW64` process on 64-bit hosts. Later reporting tied a newer intrusion set to the same actor with moderate confidence, identifying a coordinated toolchain built around the **SPECTRALVIPER** backdoor, **P8LOADER**, and the **POWERSEAL** PowerShell runner. In observed attacks, a malicious DLL was dropped over SMB and launched through a renamed ProcDump binary, after which DONUTLOADER injected into `sessionmsg.exe` to deploy SPECTRALVIPER and then conditionally execute P8LOADER or POWERSEAL. SPECTRALVIPER supported HTTP and named-pipe C2, PE loading and injection, token impersonation, file transfer, and file-system manipulation, while POWERSEAL included AMSI and ETW bypasses; identified victims included large public companies in Vietnam, including agribusiness and financial services firms.
Aug 14, 2026