TrendLabs Security Intelligence BlogThe State of the ESILE/Lotus Blossom Campaign - TrendLabs Security Intelligence Blog

Trend Micro's TrendLabs analyzes the ESILE/Lotus Blossom targeted attack campaign, detailing its spear-phishing delivery, the SetElise dropper and EliseDLL loader, persistence via services and registry entries, and a distinctive C2 URL pattern tied to the infected host's MAC address, attributing the activity to a nation-state actor and noting historical usage dating back to 2007–2012.