Loading threat actor…
JungleBamboo is a China-linked cyber-espionage threat actor also tracked as APT31, Violet Typhoon, and TA412. In 2026, it conducted targeted phishing operations using a shared Chrome-and-Windows exploitation chain to compromise selected victims. The chain exploited browser and Windows vulnerabilities to escape browser security boundaries and inject code into Chrome processes. JungleBamboo used distinct infrastructure and post-exploitation tooling from other actors observed using the same exploit code. JungleBamboo deployed the SUPERSTOMP loader to silently install LONGTALE, also known as GemStone, a malicious Chrome extension masquerading as a Google Gemini-related extension. SUPERSTOMP altered Chrome preference-integrity protections to enable extension installation. LONGTALE supported credential and form-data collection, theft of cookies and web-session tokens, keylogging, clipboard and browser-data collection, keyword-triggered screenshot capture, periodic data exfiltration, and remotely directed collection and surveillance functions. The actor’s activity is consistent with intelligence collection against nongovernmental, government, and public-policy targets.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
21 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
3 malware families Mallory has associated with this actor across public reporting.
3 CVEs Mallory has associated with this actor across public reporting. 3 of them are exploited in the wild (not necessarily by this actor).
18 indicators attributed to this actor. Values are masked here and available in full in Mallory.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.