Loading threat actor…
PoisonVine is a cyber-espionage threat actor tracked as APT-C-01 and also referred to as GreenSpot and APT-Q-20. The group has been active since at least 2007 and is assessed to have conducted long-running intelligence collection against targets in China, with a primary focus on political and military information. Reported victims include Chinese government agencies, military personnel, research institutes, maritime agencies, universities, military industry entities, and a major shipping company. PoisonVine is associated with spear-phishing and watering-hole operations for initial compromise, including the use of malicious document lures and client-side exploitation. Reported exploitation has included CVE-2012-0158, CVE-2014-6352, and CVE-2017-8759. Delivery and execution tradecraft has included disguised attachments, self-extracting archives, right-to-left override filename deception, and script-based execution chains including mshta. The actor has used both commodity and customized malware, including Poison Ivy, ZxShell, and a custom family known as Kanbox RAT. Collection activity has focused on locally stored office documents and keyword-based filtering oriented toward military, national security, international affairs, and technology themes. PoisonVine has also used cloud services and dynamic DNS-backed infrastructure for command and control and data exfiltration. Observed defense-evasion methods include reversed API strings and malformed or invalid API parameter usage intended to hinder analysis or detection. The group’s operations are consistent with a disciplined espionage actor emphasizing document theft, covert persistence, and post-compromise collection rather than disruptive or financially motivated activity. Public reporting in 2025 linked PoisonVine to Taiwan and described it as targeting China for political and military intelligence. That attribution was presented alongside the aliases GreenSpot and APT-Q-20. High-confidence characterization of the actor is therefore that of a long-running espionage group focused on Chinese governmental, military, maritime, academic, and defense-related targets.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
4 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
5 malware families Mallory has associated with this actor across public reporting.
2 CVEs Mallory has associated with this actor across public reporting. 2 of them are exploited in the wild (not necessarily by this actor).
10 indicators attributed to this actor. Values are masked here and available in full in Mallory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.