POISON CARP

POISON CARP is a China-aligned cyber-espionage threat actor associated with surveillance and intrusion activity targeting Tibetan and Uyghur communities, including diaspora organizations, activists, journalists, and institutions linked to these populations. The actor has been tied to campaigns consistent with Chinese state security interests and has been linked in multiple analyses to the Chinese contractor ecosystem, including reporting that tracks i-SOON as POISON CARP or identifies operational and organizational ties between i-SOON and POISON CARP activity. POISON CARP is best known for a 2018-2019 campaign against senior members of Tibetan organizations conducted through highly tailored WhatsApp social engineering. Operators posed as NGO workers, journalists, volunteers, and other trusted personas to deliver malicious links for one-click mobile exploitation. This activity is notable as the first publicly documented use of one-click mobile browser exploits against Tibetan groups. The campaign used both iOS and Android exploit chains and, in at least one case, combined exploit delivery with malicious Google OAuth consent phishing to obtain access to Gmail data. On Android, POISON CARP was associated with the MOONSHINE exploit-and-spyware framework. MOONSHINE used multiple Chromium and Android browser exploits, including n-day vulnerabilities and exploit code adapted from public research, to compromise devices through malicious links often delivered over messaging platforms. Successful exploitation installed Android surveillance tooling referred to by researchers as Scotch, supported by modular plugins that enabled collection of SMS messages, contacts, call logs, GPS location, camera images, microphone audio, screenshots, notifications, files, and shell command execution. Later reporting described MOONSHINE as an evolving Android surveillance platform still under active development and used against Tibetan and Uyghur targets, with delivery frequently relying on social engineering and links disguised as legitimate content. Some research indicates MOONSHINE may be shared across multiple Chinese-aligned intrusion sets, so not every MOONSHINE deployment can be attributed exclusively to POISON CARP. POISON CARP has also been linked to iOS exploitation and spyware deployment. Observed iOS activity used browser and privilege-escalation exploit chains against older iPhone versions and delivered spyware capable of exfiltrating device and application data, including location information, contacts, call history, SMS history, and data from communications applications. Researchers assessed overlaps between POISON CARP’s iOS tooling and campaigns previously reported against the Uyghur community, suggesting either the same operator or a closely coordinated group. Victimology strongly centers on ethnic minority and dissident communities viewed as sensitive by the Chinese state, especially Tibetans and Uyghurs. Targeting has included the Private Office of His Holiness the Dalai Lama, the Central Tibetan Administration, the Tibetan Parliament, Tibetan human rights groups, and related civil society figures. Tradecraft includes impersonation, spear-phishing via messaging apps, exploit delivery through malicious links, OAuth consent phishing, selective targeting, and modular mobile surveillance implants. Aliases include PoisonCarp, poisoncarp, and poison_carp. POISON CARP has sometimes been discussed alongside Earth Empusa or Evil Eye because of overlaps in targeting and some tooling or vendor-developed malware, but several analyses assess POISON CARP as a separate activity cluster rather than identical to Earth Empusa. It has also been mentioned in relation to Earth Minotaur because both used MOONSHINE against similar communities, though available reporting does not establish them as the same actor. Overall, POISON CARP represents a mobile-focused espionage operator within the broader China-linked surveillance ecosystem, distinguished by tailored social engineering, operational interest in Tibetan and Uyghur communities, and early documented use of one-click mobile exploitation in support of transnational repression and intelligence collection.