Lotus Blossom espionage group targets multiple industries with different versions of Sagerunex and hacking tools

Cisco Talos documents multi-year espionage operations by the Lotus Blossom APT that deploy the Sagerunex backdoor and supporting tooling to target government, telecommunications, manufacturing and media organizations across Southeast Asia; notable findings include multiple Sagerunex variants that use third‑party cloud services (Dropbox, Twitter, Zimbra) as C2 channels, detailed persistence techniques (service/registry install), auxiliary tools (cookie stealer, proxy/relay, archiver), and a list of campaign identifiers and IOCs.