Malware: Hannotog

Description

[Hannotog](https://attack.mitre.org/software/S1211) is a type of backdoor malware uniquely assoicated with [Lotus Blossom](https://attack.mitre.org/groups/G0030) operations since at least 2022.(Citation: Symantec Bilbug 2022)

External References

• mitre-attack
• Symantec Bilbug 2022

Techniques Used by This Malware

• T1020 — Automated Exfiltration
• T1059.003 — Windows Command Shell
• T1105 — Ingress Tool Transfer
• T1489 — Service Stop
• T1543.003 — Windows Service
• T1562.004 — Disable or Modify System Firewall
• T1571 — Non-Standard Port

APT Groups Using This Malware

• Lotus Blossom