Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It to Evolve? - Palo Alto Networks Blog

Unit 42 analyzes the Emissary Trojan (2009–2015), documenting its evolution across multiple versions, functionality (file exfiltration, remote shell, payload updates), targeting (Taiwan and Hong Kong government, military, academia, high-tech), TTP shifts after public disclosure of Operation Lotus Blossom (use of compromised legitimate domains, faster development cadence), and provides extensive IOCs (SHA256 hashes, C2 URLs, campaign codes) to track the campaign.