The campaign likely has support from a country with interests in Southeast Asia.

THE ATTACK USES A UNIQUE TROJAN, DEVELOPED BY LOTUS BLOSSOM, CALLED ELISE.

MORE THAN 50 INDIVIDUAL ATTACKS OVER THREE YEARS

This unique characteristic suggests a high degree of sophistication, resources, and time spent to develop a custom toolkit.

OPERATION LOTUS BLOSSOM: A NEW NATION STATE CYBERTHREAT?

VIEW THE FULL REPORT

Unit 42 discovered this attack using the Palo Alto Networks AutoFocus service. Palo Alto Networks customers are protected from the malware used in Operation Lotus Blossom via WildFire and Threat Prevention tools (IPS signature 14358).

VIETNAM

HONG KONG

INDONESIA

PHILIPPINES

TAIWAN

THE ACTOR IS LIKELY STATE-SPONSORED AND MAY BE SEEKING A POLITICAL AND MILITARY ADVANTAGE.