---
id: 7300
title: "Lotus Blossom's New Attack Campaign: Domain Fronting and Abusing Centralized Domain Management (Part 3)"
source_domain: blog.viettelcybersecurity.com
source_url: "https://blog.viettelcybersecurity.com/lotus-blossoms/"
published_at: "2025-03-20T04:06:16Z"
tags: ["apt", "malware-analysis", "api-hashing", "lotus-blossom", "signloader", "dll-sideloading"]
phying_url: "https://phying.com/item/7300"
lang: en
---

# Lotus Blossom's New Attack Campaign: Domain Fronting and Abusing Centralized Domain Management (Part 3)

## Summary

Part 3 of Viettel's Lotus Blossom series dissects SignLoader: DLL sideloading via a Bitdefender module, anti-analysis (junk code, exception abuse, Carbanak API hashing), and payload decryption.

## Intelligence Metadata

- **Sources:** blog.viettelcybersecurity.com
- **Published:** 2025-03-20T04:06:16Z
- **Original:** https://blog.viettelcybersecurity.com/lotus-blossoms/
- **Phying News:** https://phying.com/item/7300