GreenSpot

GreenSpot is a long-running espionage-focused advanced persistent threat cluster assessed to have operated for many years, with activity possibly dating back to around 2007 and clearer campaign continuity from 2011 through at least 2017. The actor has been associated with a Taiwan-linked source direction and is known for targeting Chinese government entities as well as aviation-, military-, and research-related organizations. Known aliases include GreenSpot, greenspot_apt, and 绿斑. GreenSpot’s operations have centered on spearphishing for initial access, typically using malicious attachments delivered as either trojanized executables or exploit documents. The group repeatedly relied on older or 1-day vulnerabilities rather than exclusive zero-days, including documented use of CVE-2012-0158, CVE-2014-4114, and later CVE-2017-8759. A notable tradecraft characteristic was early use of MHT-formatted CVE-2012-0158 lure documents to reduce antivirus detection while presenting decoy content to victims. The actor consistently used modified public malware and customized loaders for defense evasion, persistence, and post-compromise collection. Malware associated with GreenSpot includes Poison Ivy, Gh0st, HttpBots, and customized ZXShell variants. These customized ZXShell samples expanded standard functionality with targeted document theft, credential collection, host and network reconnaissance, and selective harvesting of files relevant to military and aviation themes. Earlier tooling linked to the same source direction also included utilities for remote shell access, administration, keylogging, persistence, local monitoring, and file packaging for exfiltration. GreenSpot demonstrated practical but effective post-exploitation tradecraft. Observed capabilities include persistence, credential theft, keylogging, reconnaissance, exfiltration, and use of staged loaders that decrypt and execute shellcode in memory. In later campaigns, the actor used multi-stage infection chains involving script-based downloaders and shellcode loaders culminating in deployment of Poison Ivy. Campaign linkage has been supported by overlapping infrastructure, shared operational patterns, common passwords, similar loaders, and code similarities across incidents. Overall, GreenSpot is best characterized as a persistent cyber-espionage actor that favored repeatable phishing, exploit reuse, and tailored customization of commodity malware to steal sensitive documents and intelligence from Chinese state, defense, aviation, and research targets.