Sagerunex

Malware & Tools · Sagerunex

· MalwareS1210 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

Sagerunex is a malware family exclusively associated with Lotus Blossom operations, with variants existing since at least 2016. Variations of Sagerunex leverage non-traditional command and control mechanisms such as various web services.(Citation: Symantec Bilbug 2022)(Citation: Cisco LotusBlossom 2025)

Tactic Coverage

stealth (6)command and control (5)discovery (3)privilege escalation (2)collection (2)exfiltration (1)execution (1)

Used By (1 groups)

G0030Lotus BlossomDRAGONFISH, Spring Dragon

Techniques (18)

T1016System Network Configuration Discovery

discovery

T1027.002Software Packing

stealth

T1027.013Encrypted/Encoded File

stealth

T1041Exfiltration Over C2 Channel

exfiltration

T1055.001Dynamic-link Library Injection

stealthprivilege escalation

T1057Process Discovery

discovery

References

https://attack.mitre.org/software/S1210 https://blog.talosintelligence.com/lotus-blossom-espionage-group/https://www.security.com/threat-intelligence/espionage-asia-governments-cert-authority