毒云藤

Poison Vine, also tracked as 毒云藤, APT-C-01, and APT-Q-20, is a long-running Chinese-language cyber-espionage threat actor assessed in the supplied reporting as associated with Taiwan. Activity attributed to the group has been traced back to at least 2007, with public disclosure beginning in 2015. The actor primarily targets mainland China entities, especially government, military, defense, intelligence-related, and scientific research organizations, as well as higher-education institutions connected to research and national defense topics. Poison Vine is characterized by sustained credential-harvesting and intelligence-collection operations. Its campaigns have used spearphishing emails, phishing websites, watering-hole style attacks, and social-engineering lures themed around military affairs, cyber defense, civil-military fusion, recruitment, manuscript solicitation, and official notifications. The group has impersonated popular mainland email services, government portals, universities, enterprises, and consumer web applications to steal credentials and collect internal information. Some operations reused stolen internal notices from compromised mailboxes to improve lure credibility. The actor has operated multiple phishing frameworks, including LJFrame, LJFrame 2.0, LJFrame 3.0, CPFrame, and FAPPFrame. These frameworks supported credential capture, victim validation, redirection to legitimate services after submission, and infrastructure changes intended to hinder discovery. Reporting also links Poison Vine to malware delivery through malicious attachments and exploitation of CVE-2018-20250 in WinRAR ACE archives. Associated malware and post-compromise tooling have included custom loaders and backdoors as well as Cobalt Strike, Sliver, and tinyshell. Observed capabilities include credential theft, file discovery and exfiltration, remote command execution, process and drive enumeration, persistence via startup placement and autorun mechanisms, in-memory payload execution, and defense evasion such as anti-logging patching. The group has also been described as using publicly known N-day vulnerabilities and weak-password attacks against edge and embedded devices such as routers, cameras, smart-home devices, and firewalls to gain footholds or pivot into internal networks. Overall, Poison Vine is best understood as an espionage-oriented APT focused on long-term access, credential collection, and theft of sensitive internal information from mainland Chinese government, defense, military, and research targets.