Chrysalis
Chrysalis is a previously undocumented custom backdoor associated with the China-linked espionage group Lotus Blossom (also tracked as Billbug, Spring Dragon, Raspberry Typhoon, Thrip, and KTA529). It was publicly identified in connection with the June-December 2025 compromise of Notepad++ hosting and update infrastructure, where attackers selectively redirected updater traffic and delivered a trojanized NSIS installer named update.exe to targeted users. Reporting states the campaign targeted a limited set of victims, including organizations in government, financial, telecommunications, IT services, and related sectors, with victims reported in Vietnam, the Philippines, El Salvador, Australia, and more broadly Southeast Asia, South America, the United States, and Europe.
In the documented infection chain, Lotus Blossom used DLL sideloading and multi-stage loaders to deploy Chrysalis. One observed chain dropped files into %appdata%\Bluetooth, including a legitimate renamed Bitdefender Submission Wizard binary (BluetoothService.exe), a malicious log.dll, and an encrypted payload file named BluetoothService. The malicious DLL exported LogInit and LogWrite and loaded, decrypted, and executed the Chrysalis payload. Public reporting also states the broader campaign used Microsoft Warbird obfuscation, custom API hashing, and in some cases delivered Cobalt Strike Beacon and Metasploit components alongside or instead of Chrysalis.
Chrysalis is described as an in-memory, espionage-oriented implant designed for persistent long-term access. Reported capabilities include persistence via registry-key modification or installation of new services, collection of host details, a fully interactive reverse shell, remote process execution, file read/write/upload operations, and a self-destruct or self-uninstallation function. Rapid7 reported that Chrysalis supports 16 commands. The malware’s command-and-control traffic was designed to resemble benign API traffic; one reported configuration used the HTTPS C2 URL https://api.skycloudcenter[.]com/a/chat/s/70521ddf-a2ef-4adf9cf0-6d8e24aaa821, and reporting noted DeepSeek-like API path mimicry. Additional campaign infrastructure mentioned in the content includes cdncheck[.]it[.]com, safe-dns[.]it[.]com, api.wiresguard.com, 45[.]76[.]155[.]202, 45[.]77[.]31[.]210, 95[.]179[.]213[.]0, 59.110.7.32:8880, and 124.222.137.114:9999.
High-confidence technical details in the content state that Chrysalis decrypted its main module using the XOR key "gQ2JR&9;" with arithmetic operations and decrypted its configuration using RC4 with key "qwhvb^435h&*7". The malware was delivered through the Notepad++ supply-chain compromise that abused weak verification in older WinGUp updater versions, including CVE-2025-15556, to replace legitimate updates with malicious installers.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Lotus Blossom exploited CVE-2025-15556 to hijack Notepad++'s update channel and deliver a Cobalt Strike Beacon and the Chrysalis backdoor. | Lotus Blossom, a suspected China state-sponsored threat actor, exploited CVE-2025-15556 to hijack Notepad++'s update channel and deliver a Cobalt Strike Beacon and the Chrysalis backdoor.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Rapid7 Labs attributed the Notepad++ supply chain compromise to the China-linked threat group Lotus Blossom ... Their report reveals that the attackers deployed a previously undocumented, sophisticated backdoor dubbed “Chrysalis,” which was delivered via a trojanized NSIS installer named update.exe after the Notepad++ users’ update traffic was selectively redirected.
Threat group KTA529 (also known as Lotus Blossom, Spring Dragon, Billbug and Thrip) compromised Notepad++ hosting infrastructure between June and December 2025, intercepting update traffic to deliver a previously undocumented backdoor named CHRYSALIS.
Techniques & procedures
29 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
2 techniques
Resource Development
Initial Access
4 techniques
Initial Access
the attack was not a vulnerability in the Notepad++ code itself, but a supply chain compromise of the project’s hosting infrastructure, which allowed attackers to selectively redirect update traffic to serve malicious files to specific targets.
Execution
5 techniques
Execution
Insikt Group created Sigma rules to detect update.exe's execution of reconnaissance commands (whoami, tasklist, systeminfo, and netstat -ano) and curl commands for system information exfiltration.
The primary payload is a previously undocumented, feature-rich backdoor dubbed “Chrysalis.” It supports 16 distinct commands, including interactive shell access
Description Lotus Blossom TinyCC shellcode execution simulation. Svchost.exe executed with TinyCC compiler flags (-nostdlib -run) to simulate Chrysalis backdoor's shellcode compilation technique.
Persistence
2 techniques
Persistence
Privilege Escalation
2 techniques
Privilege Escalation
Stealth
8 techniques
Stealth
Attackers used a sophisticated loader that leverages Microsoft Warbird, an undocumented internal Windows code-protection framework. This allowed them to execute malicious shellcode while masquerading as a legitimate, Microsoft-signed binary, effectively bypassing many security solutions.
This allowed them to execute malicious shellcode while masquerading as a legitimate, Microsoft-signed binary
It supports 16 distinct commands, including interactive shell access, file manipulation, and self-uninstallation to hide its tracks.
"...Bluetooth\\Bluetooth,Encrypted shellcode blob (no extension)"
"Detects payload bytes in first 0x490 bytes in clipc.dll Warbird technique... scope = 'Microsoft signed DLL - clipc.dll'"
Credential Access
1 technique
Credential Access
Discovery
4 techniques
Discovery
Collection
1 technique
Collection
Command and Control
3 techniques
Command and Control
C2 (Command and Control) traffic designed to mimic DeepSeek API endpoints to blend in with legitimate network traffic.
IOCs tracked for this family
11 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
45 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A malicious backdoor delivered via a supply chain compromise of the official Notepad++ update infrastructure to targeted users.
A custom backdoor delivered through the compromised Notepad++ update mechanism during Lotus Blossom's campaign.
공급망 침해 과정에서 배포된 백도어로, 감염 후 시스템 정보 수집, 원격 명령 실행, 파일 유출을 가능하게 한다.
Backdoor deployed via a Notepad++ supply chain compromise, enabling system information collection, remote command execution, and file exfiltration.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.