S1210: Sagerunex

Sagerunex is a malware family exclusively associated with Lotus Blossom operations, with variants existing since at least 2016. Variations of Sagerunex leverage non-traditional command and control mechanisms such as various web services.[1][2]

EnterpriseS1210MalwareObject v1.0ModifiedMar 16, 2025, 09:54 UTC (UTC+00:00)

Glexia publishes ATT&CK takes only after source-hash and schema validation. Until then, use the official MITRE definition below and the defensive relationship context on this page.

Official MITRE ATT&CK definition

Sagerunex

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques18 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1090	Proxy	Sagerunex uses several proxy configuration settings to ensure connectivity.[2]
Enterprise	T1041	Exfiltration Over C2 Channel	Sagerunex encrypts collected system data then exfiltrates via existing command and control channels.[2]
Enterprise	T1016	System Network Configuration Discovery	Sagerunex will gather system information such as MAC and IP addresses.[2]
Enterprise	T1071.001	Web ProtocolsSub-technique	Sagerunex communicates via HTTPS, at times using a hard-coded User Agent of `Mozilla/5.0 (compatible; MSIE 7.0; Win32)`.[1]
Enterprise	T1027.013	Encrypted/Encoded FileSub-technique	Sagerunex can be passed a reference to an XOR-encrypted configuration file at runtime.[1]
Enterprise	T1106	Native API	Sagerunex calls the `WaitForSingleObject` API function as part of time-check logic.[2]
Enterprise	T1055.001	Dynamic-link Library InjectionSub-technique	Sagerunex is designed to be dynamic link library (DLL) injected into an infected endpoint and executed directly in memory.[2]
Enterprise	T1057	Process Discovery	Sagerunex identifies the `explorer.exe` process on the executing system.[1]
Enterprise	T1027.002	Software PackingSub-technique	Sagerunex has used VMProtect to pack and obscure itself.[2]
Enterprise	T1102.003	One-Way CommunicationSub-technique	Sagerunex has used web services such as Twitter for command and control purposes.[2]
Enterprise	T1140	Deobfuscate/Decode Files or Information	Sagerunex uses a custom decryption routine to unpack itself during installation.[2]
Enterprise	T1082	System Information Discovery	Sagerunex gathers information from the infected system such as hostname.[2]
Enterprise	T1134	Access Token Manipulation	Sagerunex finds the `explorer.exe` process after execution and uses it to change the token of its executing thread.[1]
Enterprise	T1573.002	Asymmetric CryptographySub-technique	Sagerunex uses HTTPS for command and control communication.[1]
Enterprise	T1074.001	Local Data StagingSub-technique	Sagerunex gathers host information and stages it locally as a RAR file prior to exfiltration.[2] Sagerunex stores logged data in an encrypted file located at `%TEMP%/TS_FB56.tmp` during execution.[1]
Enterprise	T1480	Execution Guardrails	Sagerunex uses a "servicemain" function to verify its environment to ensure it can only be executed as a service, as well as the existence of a configuration file in a specified directory.[2]
Enterprise	T1560.001	Archive via UtilitySub-technique	Sagerunex has archived collected materials in RAR format.[2]
Enterprise	T1102.002	Bidirectional CommunicationSub-technique	Sagerunex has used virtual private servers (VPS) for command and control traffic as well as third-party cloud services in more recent variants.[2]

Associated objects

Groups, software, and campaigns

G0030: Lotus Blossom

Lotus Blossom is a long-standing threat group largely targeting various entities in Asia since at least 2009. In addition to government and related targets, Lotus Blossom has also targeted entities such as digital certificate issuers.[1][2][3]

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 20.0
Object version: 1.0
Created: Mar 15, 2025, 15:28 UTC (UTC+00:00)
Modified: Mar 16, 2025, 09:54 UTC (UTC+00:00)
Raw hash: 627020cf9b5bda0e...

Imported snapshots across ATT&CK releases(3)

Release	Bundle imported	Object version	Modified	Status	Raw hash
20.0	Oct 18, 2026, 20:39 UTC (UTC+00:00)	1.0	Mar 16, 2025, 09:54 UTC (UTC+00:00)	Current bundle	`627020cf9b5b…`
19.2	Aug 6, 2026, 02:58 UTC (UTC+00:00)	1.0	Mar 16, 2025, 09:54 UTC (UTC+00:00)	Older bundle	`627020cf9b5b…`
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	1.0	Mar 16, 2025, 09:54 UTC (UTC+00:00)	Older bundle	`627020cf9b5b…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
Symantec Bilbug 2022
Symntec Threat Hunter Team. (2022, November 12). Billbug: State-sponsored Actor Targets Cert Authority, Government Agencies in Multiple Asian Countries. Retrieved March 15, 2025.
Open source URL
[2]
Cisco LotusBlossom 2025
Joey Chen, Cisco Talos. (2025, February 27). Lotus Blossom espionage group targets multiple industries with different versions of Sagerunex and hacking tools. Retrieved March 15, 2025.
Open source URL
[3]
mitre-attackS1210
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use