Lotus Panda Strikes SE Asia: State Secrets at Cyber Risk

Lotus Panda Strikes SE Asia: State Secrets at Cyber Risk

The short version

• Lotus Panda, a China-linked espionage group also called Billbug and Lotus Blossom, targeted organizations in Southeast Asia.
• Symantec said the campaign ran from August 2024 to February 2025.
• Targets included a government ministry and an air traffic control organization, plus a telecom operator and a construction company.
• The group used new tools, including credential stealers and an updated Sagerunex backdoor.
• There was no sign of zero-day exploits in Symantec’s report.

An old group with new tools

Lotus Panda is not new. The group, tracked by Symantec as Billbug, has spied on governments and companies in Southeast Asia since at least 2009. In April 2025, Symantec’s threat hunters described a campaign that hit several organizations in one Southeast Asian country between August 2024 and February 2025, as well as a news agency and an air freight company in neighboring countries.

How the group got in

The group relied on known techniques rather than zero-day vulnerabilities. It used legitimate executables from Trend Micro and Bitdefender to sideload malicious DLL files, which helps it hide from security tools. An earlier version of this article quoted a “Bruce Feist, a cybersecurity analyst at CyberSecure Solutions.” We could not find that person or company and have removed the quote.

What the attackers took

Symantec found two new tools, ChromeKatz and CredentialKatz, that steal passwords and cookies saved in Google Chrome, along with a reverse SSH tool and a new version of the group’s Sagerunex backdoor. A quote attributed to a “Lynda Zhang, Director of Threat Intelligence at GlobalCyberWatch” could not be traced and has been removed. Researchers have long linked Billbug to China.

How to defend against it

The techniques are familiar, which helps defenders. Watch for security products’ executables running from unusual folders, and for DLLs loaded next to them. Limit saved browser passwords on work machines. Monitor for outbound SSH from endpoints. A quote attributed to a “Jeroen Smits, CEO of SecureForward” could not be confirmed and has been removed.

Sharing what is known

Symantec published indicators of compromise with its report. Governments and critical infrastructure operators in the region can check their networks against them and share findings through national CERTs.

What to watch

Billbug has been active for more than 15 years and keeps changing its tools. Organizations in Southeast Asia, especially in government, aviation and telecoms, should assume they are still targets and hunt for the indicators Symantec released.

Fred Templeton, CISA, CASP, SEC+

Fred Templeton is a practicing Information Systems Auditor in the Washington DC area. Fred works as a government contractor and uses his skills in cyber security to make our country's information systems safer from cyber threats. Fred holds a master's degree in cybersecurity and is currently working on his PHD in Information Systems.