APT-C-01

Poison Vine, also tracked as APT-C-01, is an unattributed cyber espionage group alleged by Chinese authorities to be associated with Taiwan’s Information, Communications and Electronic Force Command. Its reported targeting profile is consistent with intelligence collection against Chinese entities, particularly government, scientific, military, and maritime organizations. Government and scientific institutions are the most consistently cited victim classes, with additional reporting indicating long-duration collection against Chinese strategic sectors. The group has been described as using phishing for initial access, followed by malware deployment and data exfiltration. Reported activity overlaps with other alleged Taiwan-linked clusters in its use of phishing-led intrusions against public-sector and research targets. Claimed tradecraft includes reliance on known vulnerabilities, public or commercial tooling, and comparatively weak anti-tracing practices, although those capability assessments derive from adversarial public attribution and should be treated cautiously. No high-confidence public evidence in the supplied material supports ransomware or destructive operations by this actor. Known aliases include APT-C-01 and Poison Vine. "Poison Ivy Group" and "GreenSpot" are also cited as associated names in reporting. The actor is best characterized as an espionage-focused cluster targeting Chinese state, research, and strategic organizations for intelligence collection.