Espionage Actor 'Lotus Blossom' Targets Southeast Asia

Cisco Talos researchers detail Lotus Blossom, an espionage-focused APT active since 2012 targeting governments and industries around the South China Sea; the group deploys a DLL-injected RAT named Sagerunex (and related tools such as cookie stealers, privilege escalators and proxy relays), uses WMI for discovery, and has evolved variants that abuse Dropbox, Twitter and Zimbra APIs for covert C2 and exfiltration.