Sagerunex

Description

Sagerunex is a malware family exclusively associated with the Lotus Blossom intrusion set, with variants existing since at least 2016. Its variations use non-traditional command and control mechanisms, including various web services.

Stats

First seen: May 2022
Last seen: September 2026

MITRE ATT&CK techniques

18 techniques across 6 tactics.

TA0002 Execution

T1106Native API

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.013Encrypted/Encoded File
- T1027.002Software Packing
T1055Process Injection
- T1055.001Dynamic-link Library Injection
T1134Access Token Manipulation
T1140Deobfuscate/Decode Files or Information
T1480Execution Guardrails

TA0007 Discovery

T1016System Network Configuration Discovery
T1057Process Discovery
T1082System Information Discovery

TA0009 Collection

T1074Data Staged
- T1074.001Local Data Staging
T1560Archive Collected Data
- T1560.001Archive via Utility

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.001Web Protocols
T1090Proxy
T1102Web Service
- T1102.003One-Way Communication
- T1102.002Bidirectional Communication
T1573Encrypted Channel
- T1573.002Asymmetric Cryptography

TA0010 Exfiltration

T1041Exfiltration Over C2 Channel

Associated groups

G0030Lotus Blossom

Alert name variants

Alert Name	Engine
Win32.Backdoor.Sagerunex	ATP Sandbox Adv. Heuristics
Win64.Backdoor.Sagerunex	ATP Sandbox Adv. Heuristics

Related families

Metamorfo Bisonal Grandoreiro Bazar Empire