Lotus Blossom Hacker Group Uses Dropbox, Twitter, and Zimbra for C2 Communications

Lotus Blossom (aka Spring Dragon/Billbug/Thrip) is a long‑running cyber-espionage APT using the Sagerunex backdoor and evolving variants that abuse legitimate cloud services (Dropbox, Twitter, Zimbra) for covert command-and-control and data exfiltration; Cisco Talos attributes multiple active campaigns targeting government, manufacturing, telecommunications and media in the Philippines, Vietnam, Hong Kong and Taiwan, and documents techniques including memory-injected backdoors, registry persistence, credential theft, proxy/relay tools and encrypted archiving to maintain long-term access.