Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It to Evolve? - Palo Alto Networks BlogPalo Alto Networks Blog

Unit 42 analyzes the Emissary Trojan — a long-running espionage RAT used primarily against Taiwan and Hong Kong targets — documenting its development timeline, technical capabilities (file exfiltration, remote shell, DLL/service persistence, DLL injection), changes in delivery and infrastructure (compromised legitimate sites, DDNS), multiple version-specific changelog items, and extensive IOCs (hashes, C2 URLs, campaign codes) to support detection and tracking.