Lotus Blossom Chrysalis Backdoor Activity

Navdeep Sharma@navvi24

•updated Feb 3, 2026•97•1•22,584

This query hunts for indicators of compromise associated with the Notepad++ hosting breach attributed to the Lotus Blossom (aka Billbug) threat actor. It detects the Chrysalis backdoor execution chain, specific DLL side-loading techniques, and network connections to known malicious infrastructure.