LOTUS PANDA

🇨🇳China-attributed

aliases

Last seen:May 20, 2026

Intelligence Profile

Lotus Blossom is a threat group that has targeted government and military organizations in Southeast Asia.

Threat Analysis

LOTUS PANDA is a known-sophistication threat actor attributed to China, engaged in cyber operations with a primary motivation of espionage.

The group's espionage-oriented operations suggest a state-sponsored or state-aligned mandate, typically focused on stealing intellectual property, government secrets, or military intelligence. Targets are usually selected for strategic value rather than financial gain.

External References

→https://securelist.com/blog/research/70726/the-spring-dragon-apt/

→https://securelist.com/spring-dragon-updated-activity/79067/

→https://www.cfr.org/interactive/cyber-operations/lotus-blossom

→https://unit42.paloaltonetworks.com/operation-lotus-blossom/

→https://www.accenture.com/t00010101T000000Z__w__/gb-en/_acnmedia/PDF-46/Accenture-Security-Elise-Threat-Analysis.pdf

→https://unit42.paloaltonetworks.com/attack-on-french-diplomat-linked-to-operation-lotus-blossom/

→https://community.rsa.com/community/products/netwitness/blog/2018/02/13/lotus-blossom-continues-asean-targeting

→https://www.accenture.com/t20180127T003755Z_w_/us-en/_acnmedia/PDF-46/Accenture-Security-Dragonfish-Threat-Analysis.pdf

→https://attack.mitre.org/groups/G0030/

→https://www.secureworks.com/research/threat-profiles/bronze-elgin

Quick Facts

TypeAPT / Threat Group

Motivation🕵️ espionage

Origin🇨🇳 China

Aliases11

SourceMalpedia

Also Known As

BillbugST GroupDRAGONFISHATK1Spring DragonG0030Lotus BLossomRed SalamanderBRONZE ELGINLotus BlossomLOTUS PANDA

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search LOTUS PANDA