APT-C-01

APT-C-01, also known as Poison Vine and referred to in one mention as the “Poison Ivy Group,” is an unattributed cyber espionage threat actor. Reporting in the provided content describes its targeting profile as consistent with Southeast Asian or Taiwan-linked intelligence tasking. Chinese reporting further alleges APT-C-01 is one of several groups affiliated with Taiwan’s Information, Communications and Electronic Force Command (ICEFCOM), with claimed U.S. backing, but this attribution is presented as an allegation in the source material. Across the provided content, APT-C-01 is described as conducting espionage and long-duration intelligence collection. Reported targets include government and scientific organizations, and one summary also states Chinese government, military, and maritime organizations were targeted. The group is described as using phishing to compromise victims, followed by malware installation and data exfiltration. One mention notes overlap between APT-C-01 and APT-C-62 in their use of phishing against government and scientific targets. The Chinese report cited in the content characterizes the alleged Taiwan-linked groups, including APT-C-01, as relying on known vulnerabilities, public or open-source resources, commercial tools, and weak anti-tracing practices rather than zero-days or advanced indigenous capabilities. Known aliases in the provided content are APT-C-01 and Poison Vine; one mention also includes GreenSpot, but this alias is only briefly cited.