MalwarePublished 3 Feb 2026Updated 5 Mar 2026

The Chrysalis Backdoor: A Deep Dive into Lotus Blossom's toolkit

Source AlienVault OTX General

Description

Rapid7 Labs has uncovered a sophisticated campaign attributed to the Chinese APT group Lotus Blossom, involving a new custom backdoor named Chrysalis. The attack compromised Notepad++ infrastructure to deliver the backdoor. Analysis revealed multiple custom loaders, including one using Microsoft Warbird for obfuscation. The Chrysalis backdoor has extensive capabilities for information gathering, file operations, and remote command execution. Additional artifacts found include Cobalt Strike beacons and Metasploit payloads. The campaign shows Lotus Blossom evolving its tactics, mixing custom and off-the-shelf tools with advanced obfuscation techniques to evade detection.

Impact

For European organizations, the Chrysalis backdoor campaign presents significant risks, particularly for entities relying on Notepad++ or related software infrastructure. The backdoor’s capabilities for information gathering and remote command execution could lead to unauthorized access to sensitive data, intellectual property theft, and disruption of operations. Given the integration of Cobalt Strike and Metasploit payloads, attackers could escalate privileges, move laterally within networks, and establish persistent footholds, complicating incident response efforts. The stealthy obfuscation techniques increase the likelihood of prolonged undetected presence, amplifying potential damage. Critical sectors such as government, technology, telecommunications, and manufacturing in Europe could be targeted due to their strategic importance and potential geopolitical interest from Chinese APT groups. Supply chain compromise of widely used software like Notepad++ could also indirectly affect numerous organizations, increasing the attack surface. The medium severity rating reflects the balance between the sophistication and stealth of the threat and the current lack of widespread exploitation, but the potential impact on confidentiality, integrity, and availability remains substantial.

Defensive guidance

European organizations should implement a multi-layered defense strategy tailored to this threat. First, conduct thorough supply chain security assessments focusing on software dependencies like Notepad++, ensuring software integrity through cryptographic verification and trusted update channels. Deploy advanced endpoint detection and response (EDR) solutions capable of identifying obfuscated loaders and unusual process behaviors associated with Microsoft Warbird and Cobalt Strike. Enhance network monitoring to detect anomalous command and control traffic, especially patterns consistent with Cobalt Strike beacons and Metasploit activity. Regularly update and patch all software components, even if no direct patches exist for Chrysalis, to reduce exposure to related vulnerabilities. Conduct threat hunting exercises using indicators of compromise (IOCs) and behavioral analytics targeting the specific tactics described, such as file operations and remote command execution. Train security teams to recognize signs of sophisticated APT activity and obfuscation techniques. Implement strict access controls and network segmentation to limit lateral movement in case of compromise. Finally, collaborate with national cybersecurity centers and share threat intelligence to stay informed about evolving tactics from Lotus Blossom and similar groups.

Indicators of compromise

Domains 2

api.skycloudcenter.com
api.wiresguard.com

URLs 15

http://124.222.137.114:9999/3yZR31VK
http://124.222.137.114:9999/api/Info/submit
http://124.222.137.114:9999/api/updateStatus/v1
http://134.0.0.0
http://59.110.7.32:8880/api/Metadata/submit
http://59.110.7.32:8880/api/getBasicInfo/v1
http://59.110.7.32:8880/uffhxpSy
http://95.179.213.0
http://api.wiresguard.com/api/FileUpload/submit
http://api.wiresguard.com/update/v1

IP addresses 3

124.222.137.114
59.110.7.32
61.4.102.97

Hashes 24

28cb7b261f4eb97e8a4b3b0d32f8def1
2dc895d5611a149bfcc0d17c4f02d863
32f3c40b0ed1c5cf23430be7f9eb7b06
6aed7e49bd6c10c4eaee34f8c0eaa055
21a942273c14e4b9d3faa58e4de1fd4d5014a1ed
73d9d0139eaf89b7df34ceeb60e5f8c7cd2463bf
9fbf2195dee991b1e5a727fd51391dcc2d7a4b16
f7910d943a013eede24ac89d6388c1b98f8b3717
078a9e5c6c787e5532a7e728720cbafee9021bfec4a30e3c2be110748d7c43c5
0a9b8df968df41920b6ff07785cbfebe8bda29e6b512c94a3b2a83d10014d2fd

Community reviews

Loading reviews…