Threat Actor Characterization
Thrip
ID: 3679225d7813542c3da5765e9b2088b705661| Billbug | Lotus Blossom | — | — |
Actor Network Graph
Open Network GraphMITRE ATT&CK®
Thrip (G0076) is an espionage group targeting satellite, telecom, geospatial-imaging, and defense organizations in the U.S. and Southeast Asia, using living-off-the-land tools (PowerShell, PsExec, WinSCP, LogMeIn) alongside custom backdoors (Catchamas, Hannotog, Sagerunex); Symantec later tracks the activity as Billbug.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1059.001 | PowerShell | TA0002 |
|
| T1048.003 | Exfiltration Over Unencrypted Non-C2 Protocol | TA0010 |
|
| T1588.002 | Tool | TA0042 |
|
| T1219.002 | Remote Desktop Software | TA0011 |
|
| T1021.002 | SMB/Windows Admin Shares | TA0008 |
|
CLASSIFICATION: Unclassified / Open Source
Executive Summary
Thrip (MITRE G0076) is an espionage group active since at least 2017–2018, publicly exposed by Symantec for operations against satellite communications, telecommunications, geospatial-imaging, and defense organizations in the United States and Southeast Asia. Thrip relies heavily on living-off-the-land tooling (PowerShell, PsExec, WinSCP, LogMeIn) alongside custom malware including Infostealer.Catchamas, and later Hannotog and Sagerunex. Activity included targeting systems that monitor and control satellites, indicating potential interest in operational disruption as well as collection. Symantec’s 2019 follow-up found continued campaigns across Hong Kong, Macau, Indonesia, Malaysia, the Philippines, and Vietnam; later analysis concluded Thrip overlaps with/equals “Billbug (aka Lotus Blossom)” and is tracked under that name going forward. Overall confidence in these core facts is high.
- Industries/Sectors: Satellite communications; Telecommunications; Geospatial-imaging; Defense; (also military and maritime communications noted in 2019).
- Geography (Region): United States and Southeast Asia.
- Countries (if available): U.S.; targets observed across Hong Kong, Macau, Indonesia, Malaysia, the Philippines, Vietnam (2019).
- Timeframe: 2017–2025 (first public exposure 2018-06-19; continued activity noted 2019-09-09; MITRE page last modified 2025-04-25).