Dark Web Profile: Lotus Blossom

**Lotus Blossom** is a Chinese state-sponsored APT active since at least 2009 that performs long-term, intelligence-driven espionage against government, military, telecommunications, maritime, and supply-chain targets worldwide; the report details its evolution from spear-phishing and watering holes to sophisticated supply-chain compromises (including the 2025–2026 Notepad++ trojanized updates), lists key malware families (Elise, Sagerunex, Chrysalis, Hannotog), enumerates exploited CVEs, outlines TTPs and notable campaigns, and provides mitigation recommendations.