Lotus Blossom's New Attack Campaign: Domain Fronting and Abusing Centralized Domain Management (Part 2)

Published

2025-03-20 03:43

Collected

2026-09-02 08:25

---
id: 7301
title: "Lotus Blossom's New Attack Campaign: Domain Fronting and Abusing Centralized Domain Management (Part 2)"
source_domain: blog.viettelcybersecurity.com
source_url: "https://blog.viettelcybersecurity.com/lotus-blossoms-new-attack-campaign-domain-fronting-and-abusing-centralized-domain-management-part-2/"
published_at: "2025-03-20T03:43:00Z"
tags: ["apt", "c2", "cdn", "lotus-blossom", "domain-fronting"]
phying_url: "https://phying.com/item/7301"
lang: en
---

# Lotus Blossom's New Attack Campaign: Domain Fronting and Abusing Centralized Domain Management (Part 2)

## Summary

English Part 2 of the Lotus Blossom series explains Domain Fronting: how abusing CDN behavior and mismatching TLS SNI with the Host header lets C2 traffic look like legitimate connections.

## Intelligence Metadata

- **Sources:** blog.viettelcybersecurity.com
- **Published:** 2025-03-20T03:43:00Z
- **Original:** https://blog.viettelcybersecurity.com/lotus-blossoms-new-attack-campaign-domain-fronting-and-abusing-centralized-domain-management-part-2/
- **Phying News:** https://phying.com/item/7301