Emissary

MITRE ATT&CK: S0082 View on attack.mitre.org

Aliases: Emissary

First seen
2015-05-01 00:00:00
Malware type
trojan
Family
Malware family
Operating systems
windows
Last IoC activity
2026-04-27 06:18:25
Profile updated
2026-07-07 14:59:51

Targeted industries: government-and-public-sector defense-and-aerospace energy-and-utilities

Targeted regions: country_code:cn country_code:ph country_code:vn

Context

Emissary is a Trojan that has been used by Lotus Blossom. It shares code with Elise, with both Trojans being part of a malware group referred to as LStudio.

Detection coverage

  • 301 Sigma rules

Malware & tools used

  • Dynamic-link Library Injection (attack-pattern)
  • Rundll32 (attack-pattern)
  • System Network Configuration Discovery (attack-pattern)
  • Windows Command Shell (attack-pattern)
  • System Information Discovery (attack-pattern)
  • Symmetric Cryptography (attack-pattern)
  • Web Protocols (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • Group Policy Discovery (attack-pattern)
  • Local Groups (attack-pattern)
  • System Service Discovery (attack-pattern)
  • Binary Padding (attack-pattern)
  • Windows Service (attack-pattern)
  • Encrypted/Encoded File (attack-pattern)
  • Registry Run Keys / Startup Folder (attack-pattern)

Used by threat actors

Reports & references

  • malpedia.caad.fkie.fraunhofer.de — Win.Emissary (report)
  • Palo Alto Unit 42 — Emissary Trojan Changelog Did Operation Lotus Blossom Cause It To Evolve (report)
  • researchcenter.paloaltonetworks.com — Attack On French Diplomat Linked To Operation Lotus Blossom (report)
  • MITRE ATT&CK — S0082 (report)

External references