Unearthing the DNS Roots of the Latest Lotus Blossom Attack

Lotus Blossom launched several cyber espionage campaigns targeting government, manufacturing, telecommunications, and media organizations using Sagerunex and other hacking tools.¹

Cisco Talos identified several indicators of compromise (IoCs), including 10 domains and 28 IP addresses, which WhoisXML API expanded through a DNS deep dive.² Our analysis led to the discovery of:

• 90 email-connected domains
• Four additional IP addresses, two of which turned out to be malicious
• 106 IP-connected domains, two of which have already been weaponized for attacks
• 12 string-connected domains

Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

—

• [1] https://blog.talosintelligence.com/lotus-blossom-espionage-group/
• [2] https://github.com/Cisco-Talos/IOCs/blob/main/2025/02/lotus-blossom-espionage-group.txt