Lotus Blossom's New Attack Campaign: Domain Fronting and Abusing Centralized Domain Management (Part 1)

I. OverviewThe Lotus Blossom group (also known as DRAGONFISH, Spring Dragon, Lotus Panda) is one of the Advanced Persistent Threats (APTs) operating in Southeast Asia. The group has been active since 2012, carrying out attacks on authorities, military agencies, and large businesses in Southeast Asia (including Vietnam and the Philippines)