- The group hit government, air control and telco companies in Southeast Asia
- Victims were not named
- Lotus Panda never used before seen infosteals and loaders
Lotus Panda, a Chinese state -sponsored threat actor, managed to compromise more organizations in a number of Southeast Asian countries, in a campaign that took place between mid -mid -2024 and early 2025.
CyberSecurity scientists from the Symantec Threat Hunter team said the organizations included government agencies, air traffic management organizations, telecom operators and a construction company in a country, a news agency in another and an air freight organization in another. The sacrificial countries or organizations were not named.
In the attack, the group never used to see malware, loaders, identification star and reverse SSH tools.
Chinese cyber spies
Lotus Panda allegedly abused legitimate executives from antivirus companies trend micro and bitdefender using them to side-facing malicious DLL files that fell and decrypt utility steps. The threat actor also reportedly updated Sagerunex, a group-exclusive tool that can steal sensitive information and exfilter it, encrypted, to a third-party server. However, we do not know how the group did the first violation.
Other notable tools used in this campaign are Infosteals Chromekatz and Credentialkatz.
“The attackers issued the publicly available Zrok-peer-to-peer tool using the tool’s sharing function to provide remote access to services exposed internally,” Symantec said. “Another legitimate tool was called ‘DateChanger.exe.’ It is capable of changing timestamps for files, presumably to muddy waters for event analysts.
Lotus Panda is a well -known state -sponsored group, sometimes reported as Billbug, Lotus Blossom, Thrip, Spring Dragon and Bronze Elgin. The group has reportedly been active since 2009 and is primarily focused on cyber-espionage. Its usual goals are public agencies, defense organizations, Telcos and the media in Southeast Asia.
There were also reports of Lotus Panda attacks in the US and Australia, which might suggest that the group is seeking to expand the range.
Via Hacker the news
