← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
The Chrysalis Backdoor: A Deep Dive into Lotus Blossom’s toolkit
WHITE CyberHunter_NL 2026-02-04 Modified: 2026-03-06
61
IOCs
HIGH VOLUME
Chinese hackers used a previously undocumented custom backdoor to deliver shellcode to victims of a targeted espionage campaign, according to Rapid7 Labs and the Rapid 7 MDR team, who have uncovered a new type of malicious implant.
cybersecurity companymanaged detection and responseexposure managementmanaged security solutionsvulnerability managementexposure assessment platformchrysaliskhtmlgeckorapid7cobalt strikewizardapiscs beaconlotus blossomgetprocaddresswin64metasploitcrazyloadernsisconfigserviceshellcodeexecutionfebruarychinese
MITRE ATT&CK & Malware Families
MALWARE FAMILIES
Chinese Cobalt Strike Chrysalis
Indicators of Compromise (14 / 61 total)
All FileHash-MD5 FileHash-SHA1 FileHash-SHA256 URL hostname
TYPEINDICATORDESCRIPTIONCREATED
FileHash-MD5 869b85d8004b64fbef4d4ae9d4b20f00 MD5 of a511be5164dc1122fb5a7daa3eef9467e43d8458425b15a640235796006590c9 2026-02-04
FileHash-MD5 0a77eecbd9bf6aa33671d3f04ef94ad5 MD5 of 078a9e5c6c787e5532a7e728720cbafee9021bfec4a30e3c2be110748d7c43c5 2026-02-04
FileHash-MD5 170e8c92111a6234c3d663e9a35f7f86 MD5 of 831e1ea13a1bd405f5bda2b9d8f2265f7b1db6c668dd2165ccc8a9c4c15ea7dd 2026-02-04
FileHash-MD5 28cb7b261f4eb97e8a4b3b0d32f8def1 MD5 of 2da00de67720f5f13b17e9d985fe70f10f153da60c9ab1086fe58f069a156924 2026-02-04
FileHash-MD5 2dc895d5611a149bfcc0d17c4f02d863 MD5 of 4a52570eeaf9d27722377865df312e295a7a23c3b6eb991944c2ecd707cc9906 2026-02-04
FileHash-MD5 32f3c40b0ed1c5cf23430be7f9eb7b06 MD5 of 3bdc4c0637591533f1d4198a72a33426c01f69bd2e15ceee547866f65e26b7ad 2026-02-04
FileHash-MD5 55921689bddd723f95f1a1e9b8f782e2 MD5 of 77bfea78def679aa1117f569a35e8fd1542df21f7e00e27f192c907e61d63a2e 2026-02-04
FileHash-MD5 6aed7e49bd6c10c4eaee34f8c0eaa055 MD5 of e7cd605568c38bd6e0aba31045e1633205d0598c607a855e2e1bca4cca1c6eda 2026-02-04
FileHash-MD5 b524722db5a0f45718394b1217f02138 MD5 of 4c2ea8193f4a5db63b897a2d3ce127cc5d89687f380b97a1d91e0c8db542e4f8 2026-02-04
FileHash-MD5 b528771daa269af307e87f73016d6d49 MD5 of 8ea8b83645fba6e23d48075a0d3fc73ad2ba515b4536710cda4f1f232718f53e 2026-02-04
FileHash-MD5 c1b1cad9e7afabfacd8988c2a6182a20 MD5 of b4169a831292e245ebdffedd5820584d73b129411546e7d3eccf4663d5fc5be3 2026-02-04
FileHash-MD5 cf51dbe3926ba5e288fee3f17ef73aa7 MD5 of 7add554a98d3a99b319f2127688356c1283ed073a084805f14e33b4f6a6126fd 2026-02-04
FileHash-MD5 e776de5a5ab104ba814d6a70c27ecc42 MD5 of fcc2765305bcd213b7558025b2039df2265c3e0b6401e4833123c461df2de51a 2026-02-04
FileHash-MD5 f82649cd2916cf2f28cf450a7c1ca51f MD5 of 0a9b8df968df41920b6ff07785cbfebe8bda29e6b512c94a3b2a83d10014d2fd 2026-02-04
References (1)
↗ https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/