Search threats, CVEs… ⌘K
← Back to all threat actors

Lotus Blossom

Also known as DRAGONFISH, Spring Dragon, RADIUM, Raspberry Typhoon, Bilbug, Thrip
Tracked as G0030

Lotus Blossom is a long-standing threat group largely targeting various entities in Asia since at least 2009. In addition to government and related targets, Lotus Blossom has also targeted entities such as digital certificate issuers.

How we source and review actor profiles
Status
Active

Activity timeline

A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.

Cataloged
RelationshipOverlaps relationship with Thrip

MITRE lists Thrip as an associated name for Lotus Blossom while retaining Thrip as a separate group record.

Medium
Cataloged
IdentityAlias: DRAGONFISH

Reviewed identity mapping approved on this date.

Cataloged
IdentityAlias: Spring Dragon

Reviewed identity mapping approved on this date.

Cataloged
IdentityAlias: RADIUM

Reviewed identity mapping approved on this date.

Cataloged
IdentityAlias: Raspberry Typhoon

Reviewed identity mapping approved on this date.

Cataloged
IdentityAlias: Bilbug

Reviewed identity mapping approved on this date.

Cataloged
IdentityAlias: Thrip

Reviewed identity mapping approved on this date.

Cataloged
IdentityTracking identifier: G0030

Reviewed identity mapping approved on this date.

Identity and attribution

Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.

Name map

Lotus BlossomCanonical Name
BilbugAlias
DRAGONFISHAlias
RADIUMAlias
Raspberry TyphoonAlias
Spring DragonAlias
ThripAlias
G0030Tracking Id

Shared-name reviews

Every exact-name collision is reviewed. Same-actor decisions select a preferred profile while distinct and unresolved clusters remain separate.

Identity remains unresolved medium
Lotus Blossom Thrip

MITRE lists Thrip as an associated name for Lotus Blossom while retaining Thrip as a separate group record. The catalog preserves both records and does not infer exact equivalence.

Overlaps: Thrip

Loading CVEs, techniques, indicators, malware, victims, and activity...