Skip to main content
Meet us at Black Hat USA 2026— Las Vegas, August 1–6Book a Meeting
Mallory
MalwareUsed by 2 actorsExploits 1 CVE

Chrysalis

Chrysalis is a previously undocumented custom backdoor associated with the China-linked espionage group Lotus Blossom (also tracked as Billbug, Spring Dragon, Raspberry Typhoon, Thrip, and KTA529). It was publicly identified in connection with the June-December 2025 compromise of Notepad++ hosting and update infrastructure, where attackers selectively redirected updater traffic and delivered a trojanized NSIS installer named update.exe to targeted users. Reporting states the campaign targeted a limited set of victims, including organizations in government, financial, telecommunications, IT services, and related sectors, with victims reported in Vietnam, the Philippines, El Salvador, Australia, and more broadly Southeast Asia, South America, the United States, and Europe.

In the documented infection chain, Lotus Blossom used DLL sideloading and multi-stage loaders to deploy Chrysalis. One observed chain dropped files into %appdata%\Bluetooth, including a legitimate renamed Bitdefender Submission Wizard binary (BluetoothService.exe), a malicious log.dll, and an encrypted payload file named BluetoothService. The malicious DLL exported LogInit and LogWrite and loaded, decrypted, and executed the Chrysalis payload. Public reporting also states the broader campaign used Microsoft Warbird obfuscation, custom API hashing, and in some cases delivered Cobalt Strike Beacon and Metasploit components alongside or instead of Chrysalis.

Chrysalis is described as an in-memory, espionage-oriented implant designed for persistent long-term access. Reported capabilities include persistence via registry-key modification or installation of new services, collection of host details, a fully interactive reverse shell, remote process execution, file read/write/upload operations, and a self-destruct or self-uninstallation function. Rapid7 reported that Chrysalis supports 16 commands. The malware’s command-and-control traffic was designed to resemble benign API traffic; one reported configuration used the HTTPS C2 URL https://api.skycloudcenter[.]com/a/chat/s/70521ddf-a2ef-4adf9cf0-6d8e24aaa821, and reporting noted DeepSeek-like API path mimicry. Additional campaign infrastructure mentioned in the content includes cdncheck[.]it[.]com, safe-dns[.]it[.]com, api.wiresguard.com, 45[.]76[.]155[.]202, 45[.]77[.]31[.]210, 95[.]179[.]213[.]0, 59.110.7.32:8880, and 124.222.137.114:9999.

High-confidence technical details in the content state that Chrysalis decrypted its main module using the XOR key "gQ2JR&9;" with arithmetic operations and decrypted its configuration using RC4 with key "qwhvb^435h&*7". The malware was delivered through the Notepad++ supply-chain compromise that abused weak verification in older WinGUp updater versions, including CVE-2025-15556, to replace legitimate updates with malicious installers.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES
CVE-2025-15556Notepad++ WinGUp updater download of code without integrity checkExploited in the wild

Lotus Blossom exploited CVE-2025-15556 to hijack Notepad++'s update channel and deliver a Cobalt Strike Beacon and the Chrysalis backdoor. | Lotus Blossom, a suspected China state-sponsored threat actor, exploited CVE-2025-15556 to hijack Notepad++'s update channel and deliver a Cobalt Strike Beacon and the Chrysalis backdoor.

via recorded future blogrecordedfuture.com
THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
Lotus Blossom

Rapid7 Labs attributed the Notepad++ supply chain compromise to the China-linked threat group Lotus Blossom ... Their report reveals that the attackers deployed a previously undocumented, sophisticated backdoor dubbed “Chrysalis,” which was delivered via a trojanized NSIS installer named update.exe after the Notepad++ users’ update traffic was selectively redirected.

via medium costin raiumedium.com
KTA529

Threat group KTA529 (also known as Lotus Blossom, Spring Dragon, Billbug and Thrip) compromised Notepad++ hosting infrastructure between June and December 2025, intercepting update traffic to deliver a previously undocumented backdoor named CHRYSALIS.

via securitysenses blogsecuritysenses.com
MITRE ATT&CK

Techniques & procedures

29 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

2 techniques
T1585Establish AccountsEvidence1

Threat actors routinely use this technique, known as brand impersonation or typosquatting, to serve malware, infostealers, or remote access trojans under the cover of a well-known application.

T1608.004Drive-by TargetEvidence1

"The attackers intercepted and selectively redirected update requests from certain users to malicious servers"

Initial Access

4 techniques
T1078Valid AccountsEvidence1

"as well as working credentials for internal services"

T1195Supply Chain CompromiseEvidence7

the attack was not a vulnerability in the Notepad++ code itself, but a supply chain compromise of the project’s hosting infrastructure, which allowed attackers to selectively redirect update traffic to serve malicious files to specific targets.

T1195.001Compromise Software Dependencies and Development ToolsEvidence1

state-sponsored Chinese hackers from the Lotus Blossom group compromised the official Notepad++ update infrastructure and delivered a malicious backdoor called Chrysalis to targeted users.

T1195.002Compromise Software Supply ChainEvidence4

"traffic tied to WinGUp, which updated the software, 'was occasionally redirected to malicious servers, resulting in the download of compromised executables'"

Execution

5 techniques
T1059Command and Scripting InterpreterEvidence2

Insikt Group created Sigma rules to detect update.exe's execution of reconnaissance commands (whoami, tasklist, systeminfo, and netstat -ano) and curl commands for system information exfiltration.

T1059.003Windows Command ShellEvidence1

The primary payload is a previously undocumented, feature-rich backdoor dubbed “Chrysalis.” It supports 16 distinct commands, including interactive shell access

T1059.005Visual BasicEvidence1

Description Lotus Blossom TinyCC shellcode execution simulation. Svchost.exe executed with TinyCC compiler flags (-nostdlib -run) to simulate Chrysalis backdoor's shellcode compilation technique.

T1204User ExecutionEvidence1

...Notepad++ ... intercept or redirect update traffic to download and execute an attacker-controlled installer and lead to arbitrary code execution with the privileges of the user.

T1574.001DLLEvidence1

"...C:\\Users\\*\\AppData\\Roaming\\Bluetooth\\log.dll,Malicious sideloaded DLL" and "...Adobe\\Scripts\\alien.dll,Malicious DLL"

Persistence

2 techniques
T1078Valid AccountsEvidence1

"as well as working credentials for internal services"

T1543.003Windows ServiceEvidence1

Lotus Blossom BluetoothService persistence test execution. Service created in user AppData directory for persistence.

Privilege Escalation

2 techniques
T1078Valid AccountsEvidence1

"as well as working credentials for internal services"

T1543.003Windows ServiceEvidence1

Lotus Blossom BluetoothService persistence test execution. Service created in user AppData directory for persistence.

Stealth

8 techniques
T1027Obfuscated Files or InformationEvidence4

Attackers used a sophisticated loader that leverages Microsoft Warbird, an undocumented internal Windows code-protection framework. This allowed them to execute malicious shellcode while masquerading as a legitimate, Microsoft-signed binary, effectively bypassing many security solutions.

T1036MasqueradingEvidence2

This allowed them to execute malicious shellcode while masquerading as a legitimate, Microsoft-signed binary

T1070Indicator RemovalEvidence2

It supports 16 distinct commands, including interactive shell access, file manipulation, and self-uninstallation to hide its tracks.

T1078Valid AccountsEvidence1

"as well as working credentials for internal services"

T1140Deobfuscate/Decode Files or InformationEvidence1

"...Bluetooth\\Bluetooth,Encrypted shellcode blob (no extension)"

T1218System Binary Proxy ExecutionEvidence1

"Detects payload bytes in first 0x490 bytes in clipc.dll Warbird technique... scope = 'Microsoft signed DLL - clipc.dll'"

T1574.001DLLEvidence1

"...C:\\Users\\*\\AppData\\Roaming\\Bluetooth\\log.dll,Malicious sideloaded DLL" and "...Adobe\\Scripts\\alien.dll,Malicious DLL"

T1620Reflective Code LoadingEvidence1

"Find Warbird clipc.dll shellcode loader strings" and YARA rules: "...Shellcode_Loader..." and "...Warbird... shellcode loader"

Credential Access

1 technique
T1557Adversary-in-the-MiddleEvidence1

"Unit 42 noted that the campaign was focused on long-term valuable intelligence, leveraging the adversary-in-the-middle (AitM) capability to dynamically fingerprint incoming update requests and filter only priority targets."

Discovery

4 techniques
T1033System Owner/User DiscoveryEvidence1

"...ProShow\\1.txt,Recon output (whoami/tasklist)"

T1057Process DiscoveryEvidence1

"...ProShow\\1.txt,Recon output (whoami/tasklist)"

T1082System Information DiscoveryEvidence1

The blog details a unique “heartbeat” mechanism where the malware exfiltrated system information (via tasklist and systeminfo ) by uploading it to the public file-sharing service temp[.]sh

T1083File and Directory DiscoveryEvidence1

It supports 16 distinct commands, including interactive shell access, file manipulation, and self-uninstallation to hide its tracks.

Collection

1 technique
T1557Adversary-in-the-MiddleEvidence1

"Unit 42 noted that the campaign was focused on long-term valuable intelligence, leveraging the adversary-in-the-middle (AitM) capability to dynamically fingerprint incoming update requests and filter only priority targets."

Command and Control

3 techniques
T1071Application Layer ProtocolEvidence2

C2 (Command and Control) traffic designed to mimic DeepSeek API endpoints to blend in with legitimate network traffic.

T1071.001Web ProtocolsEvidence2

YARA rule includes domains/paths such as "api.skycloudcenter.com" and URIs like "/api/update/v1", "/api/FileUpload/submit", "/api/getInfo/v1"

T1105Ingress Tool TransferEvidence4

The campaign rotated C2 servers across three attack chains to deliver a Metasploit loader, Cobalt Strike Beacon, and a custom backdoor called Chrysalis.

Exfiltration

2 techniques
T1041Exfiltration Over C2 ChannelEvidence1

Insikt Group created Sigma rules to detect update.exe's execution of reconnaissance commands (whoami, tasklist, systeminfo, and netstat -ano) and curl commands for system information exfiltration.

T1567Exfiltration Over Web ServiceEvidence2

the malware exfiltrated system information (via tasklist and systeminfo ) by uploading it to the public file-sharing service temp[.]sh , then passing the resulting URL to the attackers via the User-Agent header of a subsequent request.

Impact

1 technique
T1565.001Stored Data ManipulationEvidence1

"attackers... allowing them to maliciously redirect traffic until Dec. 2, 2025"

INDICATORS OF COMPROMISE

IOCs tracked for this family

11 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Network
10 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes
1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting
domain●●●●●●●●●●●●View more in app15 days ago
ip.v4●●●●●●●●●●●●View more in app4 months ago
ip.v4●●●●●●●●●●●●View more in app4 months ago
domain●●●●●●●●●●●●View more in app4 months ago
domain●●●●●●●●●●●●View more in app4 months ago
ip.v4●●●●●●●●●●●●View more in app4 months ago
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching11

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping29

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.