Ultimate Lotus Blossom and Chrysalis IOC Hunt

Ethan Andrews@eandrews

•updated Feb 20, 2026•2•0•67

This is a broad hunting query to find Indicators of Compromise (IOCs) associated with the Notepad++ supply-chain attack attributed to the Lotus Blossom actor and the Chrysalis backdoor. It searches for known file hashes, file paths, network indicators (IPs, domains, URLs), and user-agents across multiple event types.