LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0082: Emissary

Emissary is a Trojan that has been used by Lotus Blossom. It shares code with Elise, with both Trojans being part of a malware group referred to as LStudio.[1]

EnterpriseS0082MalwareObject v1.3Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

Emissary matters because it represents a Windows Trojan with documented links in ATT&CK to Lotus Blossom and a broad set of behaviors defenders should be ready to validate: discovery, persistence, command execution, DLL-based evasion, web-based command-and-control, encrypted communications, and tool transfer. For leaders, the practical issue is not just this malware name; it is whether the organization can prove it would see a Windows host being profiled, persisted, remotely controlled, and modified in ways that often precede broader intrusion activity.

Executive priority

Prioritize Emissary as a coverage-validation use case for Windows endpoint visibility, identity and Active Directory readiness, and SOC/IR evidence quality. The ATT&CK relationships point to behaviors that can affect business continuity if they enable persistence, privilege escalation, command-and-control, or follow-on tooling. Security leaders should ask whether teams can produce audit-ready evidence for service creation, Run key persistence, suspicious rundll32/DLL activity, command shell use, local group and Group Policy discovery, and unusual web-based outbound traffic from endpoints.

Technical view

ATT&CK lists Emissary as Windows malware and relates it to techniques including System Service Discovery, System Network Configuration Discovery, Binary Padding, Encrypted/Encoded File, DLL Injection, Windows Command Shell, Local Groups discovery, Web Protocols for C2, System Information Discovery, Ingress Tool Transfer, Rundll32, Windows Service persistence, Registry Run Keys/Startup Folder, Symmetric Cryptography, and Group Policy Discovery. SOC and IR teams should validate Windows endpoint detections around discovery commands, service and registry persistence, rundll32 execution of DLLs, process injection indicators, and command shell activity. Network teams should validate visibility into outbound HTTP/S-like traffic patterns and file transfer indicators, while recognizing that encryption or encoding may limit content inspection.

Likely telemetry

  • Windows process creation events, including cmd.exe, rundll32.exe, service-control utilities, and discovery commands
  • Windows service creation or modification events and related registry changes
  • Registry Run key and Startup Folder modification telemetry
  • Endpoint detection telemetry for DLL loading, suspicious module activity, and possible process injection
  • Local group, system information, network configuration, and Group Policy discovery command evidence

Detection direction

  • Use the related ATT&CK techniques as a behavior chain rather than relying on the Emissary name or file hashes alone.
  • Correlate Windows discovery activity with later persistence, rundll32/DLL execution, outbound web traffic, or tool transfer events to reduce false positives from legitimate administration.
  • Tune carefully for administrative tools such as cmd.exe, service utilities, registry modification, and rundll32.exe because these have legitimate uses but become higher risk when chained with unusual parent processes, paths, users, or network destinations.
  • Validate that endpoint tooling can handle large or padded binaries and does not depend solely on static signatures or hashes.
  • Confirm that encrypted or encoded files and encrypted C2 reduce content-based detection, making endpoint behavior, proxy metadata, and correlation more important.

Mitigation priorities

  • Start with Windows endpoint hardening and monitoring for persistence paths: services, Run keys, Startup Folder entries, and DLL execution patterns.
  • Limit unnecessary local administrative rights and review local group membership visibility because related behavior includes local group discovery and potential privilege-escalation paths.
  • Strengthen egress monitoring and proxy controls for endpoint web traffic, especially where unusual destinations or transfer patterns appear after host discovery activity.
  • Ensure incident response playbooks collect process, registry, service, file, and network artifacts needed to reconstruct this behavior chain.
  • Use application control or execution control where feasible for high-risk script, shell, rundll32, and DLL-loading patterns, while testing for operational impact.
Additional notes and limits

The supplied ATT&CK object identifies Emissary as a Windows Trojan used by Lotus Blossom and notes code overlap with Elise as part of LStudio. The most useful defensive value comes from the related techniques: they describe what to validate across endpoint, identity, and network telemetry. This take intentionally avoids asserting current activity, specific victims, or guaranteed detection coverage beyond the supplied fields.

Official detection guidance is not provided for this malware object. ATT&CK tactics are not specified directly on the malware object, so tactic framing is derived only from related technique context. The source material supports Windows as the malware platform; broader platforms listed on some related techniques should not be interpreted as Emissary platform support without additional evidence. Local logs, baselines, and control configuration are required to determine actual exposure and coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Emissary

Emissary is a Trojan that has been used by Lotus Blossom. It shares code with Elise, with both Trojans being part of a malware group referred to as LStudio.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

15 rows
DomainIDNameRelationship / procedure
EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

Variants of Emissary have added Run Registry keys to establish persistence.[2]

EnterpriseT1027.013Encrypted/Encoded FileSub-technique

Variants of Emissary encrypt payloads using various XOR ciphers, as well as a custom algorithm that uses the "srand" and "rand" functions.[1][2]

EnterpriseT1055.001Dynamic-link Library InjectionSub-technique

Emissary injects its DLL file into a newly spawned Internet Explorer process.[1]

EnterpriseT1218.011Rundll32Sub-technique

Variants of Emissary have used rundll32.exe in Registry values added to establish persistence.[2]

EnterpriseT1016System Network Configuration Discovery

Emissary has the capability to execute the command ipconfig /all.[2]

EnterpriseT1059.003Windows Command ShellSub-technique

Emissary has the capability to create a remote shell and execute specified commands.[1]

EnterpriseT1082System Information Discovery

Emissary has the capability to execute ver and systeminfo commands.[2]

EnterpriseT1573.001Symmetric CryptographySub-technique

The C2 server response to a beacon sent by a variant of Emissary contains a 36-character GUID value that is used as an encryption key for subsequent network communications. Some variants of Emissary use various XOR operations to encrypt C2 data.[1]

EnterpriseT1071.001Web ProtocolsSub-technique

Emissary uses HTTP or HTTPS for C2.[1]

EnterpriseT1105Ingress Tool Transfer

Emissary has the capability to download files from the C2 server.[1]

EnterpriseT1615Group Policy Discovery

Emissary has the capability to execute gpresult.[2]

EnterpriseT1069.001Local GroupsSub-technique

Emissary has the capability to execute the command net localgroup administrators.[2]

EnterpriseT1007System Service Discovery

Emissary has the capability to execute the command net start to interact with services.[2]

EnterpriseT1027.001Binary PaddingSub-technique

A variant of Emissary appends junk data to the end of its DLL file to create a large file that may exceed the maximum size that anti-virus programs can scan.[2]

EnterpriseT1543.003Windows ServiceSub-technique

Emissary is capable of configuring itself as a service.[2]

Associated objects

Groups, software, and campaigns

Relationship explorer

All related ATT&CK context

uses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · TechniqueT1027.013: Encrypted/Encoded FileEnterpriseuses · TechniqueT1055.001: Dynamic-link Library InjectionEnterpriseuses · TechniqueT1218.011: Rundll32Enterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1573.001: Symmetric CryptographyEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · GroupG0030: Lotus BlossomEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1615: Group Policy DiscoveryEnterpriseuses · TechniqueT1069.001: Local GroupsEnterpriseuses · TechniqueT1007: System Service DiscoveryEnterpriseuses · TechniqueT1027.001: Binary PaddingEnterpriseuses · TechniqueT1543.003: Windows ServiceEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.3
Created
Modified
Raw hash
2e3b46d583f94e03...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.3Current bundle2e3b46d583f9…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Lotus Blossom Dec 2015

    Falcone, R. and Miller-Osborn, J.. (2015, December 18). Attack on French Diplomat Linked to Operation Lotus Blossom. Retrieved February 15, 2016.

  2. [2]
    Emissary Trojan Feb 2016

    Falcone, R. and Miller-Osborn, J. (2016, February 3). Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It to Evolve?. Retrieved February 15, 2016.

  3. [3]
    Emissary

    (Citation: Lotus Blossom Dec 2015)

  4. [4]
    Emissary

    (Citation: Lotus Blossom Dec 2015)

  5. [5]
    Emissary

    (Citation: Lotus Blossom Dec 2015)

  6. [6]
    Lotus Blossom Dec 2015

    Falcone, R. and Miller-Osborn, J.. (2015, December 18). Attack on French Diplomat Linked to Operation Lotus Blossom. Retrieved February 15, 2016.

  7. [7]
    Lotus Blossom Dec 2015

    Falcone, R. and Miller-Osborn, J.. (2015, December 18). Attack on French Diplomat Linked to Operation Lotus Blossom. Retrieved February 15, 2016.

  8. [8]
    mitre-attackS0082
    Open source URL
  9. [9]
    mitre-attackS0082
    Open source URL
  10. [10]
    mitre-attackS0082
    Open source URL
  11. [11]
    Emissary Trojan Feb 2016

    Falcone, R. and Miller-Osborn, J. (2016, February 3). Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It to Evolve?. Retrieved February 15, 2016.

  12. [12]
    Emissary Trojan Feb 2016

    Falcone, R. and Miller-Osborn, J. (2016, February 3). Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It to Evolve?. Retrieved February 15, 2016.

  13. [13]
    Emissary Trojan Feb 2016

    Falcone, R. and Miller-Osborn, J. (2016, February 3). Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It to Evolve?. Retrieved February 15, 2016.

  14. [14]
    Lotus Blossom Dec 2015

    Falcone, R. and Miller-Osborn, J.. (2015, December 18). Attack on French Diplomat Linked to Operation Lotus Blossom. Retrieved February 15, 2016.

  15. [15]
    Lotus Blossom Dec 2015

    Falcone, R. and Miller-Osborn, J.. (2015, December 18). Attack on French Diplomat Linked to Operation Lotus Blossom. Retrieved February 15, 2016.

  16. [16]
    Lotus Blossom Dec 2015

    Falcone, R. and Miller-Osborn, J.. (2015, December 18). Attack on French Diplomat Linked to Operation Lotus Blossom. Retrieved February 15, 2016.

  17. [17]
    Lotus Blossom Dec 2015

    Falcone, R. and Miller-Osborn, J.. (2015, December 18). Attack on French Diplomat Linked to Operation Lotus Blossom. Retrieved February 15, 2016.

  18. [18]
    Emissary Trojan Feb 2016

    Falcone, R. and Miller-Osborn, J. (2016, February 3). Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It to Evolve?. Retrieved February 15, 2016.

  19. [19]
    Emissary Trojan Feb 2016

    Falcone, R. and Miller-Osborn, J. (2016, February 3). Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It to Evolve?. Retrieved February 15, 2016.

  20. [20]
    Emissary Trojan Feb 2016

    Falcone, R. and Miller-Osborn, J. (2016, February 3). Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It to Evolve?. Retrieved February 15, 2016.

  21. [21]
    Emissary Trojan Feb 2016

    Falcone, R. and Miller-Osborn, J. (2016, February 3). Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It to Evolve?. Retrieved February 15, 2016.

  22. [22]
    Lotus Blossom Dec 2015

    Falcone, R. and Miller-Osborn, J.. (2015, December 18). Attack on French Diplomat Linked to Operation Lotus Blossom. Retrieved February 15, 2016.

  23. [23]
    Lotus Blossom Dec 2015

    Falcone, R. and Miller-Osborn, J.. (2015, December 18). Attack on French Diplomat Linked to Operation Lotus Blossom. Retrieved February 15, 2016.

  24. [24]
    Emissary Trojan Feb 2016

    Falcone, R. and Miller-Osborn, J. (2016, February 3). Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It to Evolve?. Retrieved February 15, 2016.

  25. [25]
    Emissary Trojan Feb 2016

    Falcone, R. and Miller-Osborn, J. (2016, February 3). Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It to Evolve?. Retrieved February 15, 2016.

  26. [26]
    Lotus Blossom Dec 2015

    Falcone, R. and Miller-Osborn, J.. (2015, December 18). Attack on French Diplomat Linked to Operation Lotus Blossom. Retrieved February 15, 2016.

  27. [27]
    Lotus Blossom Dec 2015

    Falcone, R. and Miller-Osborn, J.. (2015, December 18). Attack on French Diplomat Linked to Operation Lotus Blossom. Retrieved February 15, 2016.

  28. [28]
    Lotus Blossom Dec 2015

    Falcone, R. and Miller-Osborn, J.. (2015, December 18). Attack on French Diplomat Linked to Operation Lotus Blossom. Retrieved February 15, 2016.

  29. [29]
    Lotus Blossom Dec 2015

    Falcone, R. and Miller-Osborn, J.. (2015, December 18). Attack on French Diplomat Linked to Operation Lotus Blossom. Retrieved February 15, 2016.

  30. [30]
    Emissary Trojan Feb 2016

    Falcone, R. and Miller-Osborn, J. (2016, February 3). Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It to Evolve?. Retrieved February 15, 2016.

  31. [31]
    Emissary Trojan Feb 2016

    Falcone, R. and Miller-Osborn, J. (2016, February 3). Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It to Evolve?. Retrieved February 15, 2016.

  32. [32]
    Lotus Blossom Dec 2015

    Falcone, R. and Miller-Osborn, J.. (2015, December 18). Attack on French Diplomat Linked to Operation Lotus Blossom. Retrieved February 15, 2016.

  33. [33]
    Lotus Blossom Dec 2015

    Falcone, R. and Miller-Osborn, J.. (2015, December 18). Attack on French Diplomat Linked to Operation Lotus Blossom. Retrieved February 15, 2016.

  34. [34]
    Lotus Blossom Dec 2015

    Falcone, R. and Miller-Osborn, J.. (2015, December 18). Attack on French Diplomat Linked to Operation Lotus Blossom. Retrieved February 15, 2016.

  35. [35]
    Lotus Blossom Dec 2015

    Falcone, R. and Miller-Osborn, J.. (2015, December 18). Attack on French Diplomat Linked to Operation Lotus Blossom. Retrieved February 15, 2016.

  36. [36]
    Emissary Trojan Feb 2016

    Falcone, R. and Miller-Osborn, J. (2016, February 3). Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It to Evolve?. Retrieved February 15, 2016.

  37. [37]
    Emissary Trojan Feb 2016

    Falcone, R. and Miller-Osborn, J. (2016, February 3). Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It to Evolve?. Retrieved February 15, 2016.

  38. [38]
    Emissary Trojan Feb 2016

    Falcone, R. and Miller-Osborn, J. (2016, February 3). Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It to Evolve?. Retrieved February 15, 2016.

  39. [39]
    Emissary Trojan Feb 2016

    Falcone, R. and Miller-Osborn, J. (2016, February 3). Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It to Evolve?. Retrieved February 15, 2016.

  40. [40]
    Emissary Trojan Feb 2016

    Falcone, R. and Miller-Osborn, J. (2016, February 3). Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It to Evolve?. Retrieved February 15, 2016.

  41. [41]
    Emissary Trojan Feb 2016

    Falcone, R. and Miller-Osborn, J. (2016, February 3). Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It to Evolve?. Retrieved February 15, 2016.

  42. [42]
    Emissary Trojan Feb 2016

    Falcone, R. and Miller-Osborn, J. (2016, February 3). Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It to Evolve?. Retrieved February 15, 2016.

  43. [43]
    Emissary Trojan Feb 2016

    Falcone, R. and Miller-Osborn, J. (2016, February 3). Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It to Evolve?. Retrieved February 15, 2016.

  44. [44]
    Emissary Trojan Feb 2016

    Falcone, R. and Miller-Osborn, J. (2016, February 3). Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It to Evolve?. Retrieved February 15, 2016.

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use