Loading story…
PoisonVine (also tracked as APT-C-01 and linked in other reporting to GreenSpot) conducted a long-running cyber-espionage campaign against organizations in China, targeting government agencies, military personnel, defense industry entities, research institutes, universities, maritime bodies, and a major shipping company. Reporting says the group has operated since at least 2007 and continued through later campaigns such as Operation Rubia cordifolia, using spear-phishing, watering-hole attacks, spoofed websites, fake recruitment and manuscript-solicitation emails, and malicious attachments to steal credentials and sensitive internal data for political and military intelligence collection.
The operators combined commodity and customized malware, including Poison Ivy, ZxShell/ZXShell, Gh0st, HttpBots, and Kanbox RAT, while repeatedly exploiting older but reliable flaws such as CVE-2012-0158, CVE-2014-4114, CVE-2014-6352, CVE-2017-8759, and CVE-2018-20250. Investigators tied the activity together through shared dynamic DNS infrastructure, Vultr VPS hosting, overlapping phishing frameworks such as LJFrame, CPFrame, and FAPPFrame, and recurring operational patterns including staged loaders, antivirus evasion, cloud-storage exfiltration, and keyword-based collection of military and national-security documents; one case reportedly involved about 3 GB of stolen files.
TTPs, infrastructure, and targeting history in one profile.
18 events from the most recent confirmed update back to the earliest known activity.
QiAnXin stated that Operation Rubia cordifolia was still active as of October 2020.
QiAnXin reported that from August 2020, the LJFrame 2.0 phishing framework adopted variable paths such as /mainX/ to make phishing assets harder to find.
QiAnXin reported that neteaseyhnujm.serveusers.com, resolving to 139.180.202.208, was related to neteasedqwert.serveuser.com in phishing activity during late 2019. The report also identified infrastructure reuse through shared image resources.
QiAnXin said Operation Rubia cordifolia, a phishing and espionage campaign it attributed to PoisonVine, was active at least from 2018. The campaign targeted defense industry, military intelligence, government agencies, and higher-education research institutions.
QiAnXin's timeline states that PoisonVine was first publicly disclosed in 2018.
QiAnXin reported that a customized shellcode loader was discovered in early 2018 in PoisonVine activity. It triggered .hta execution via CVE-2017-8759 and supported drive-by download and execution.
QiAnXin said PoisonVine conducted several spearphishing attacks using CVE-2017-8759 in October 2017. Antiy separately reported GreenSpot using CVE-2017-8759 Office documents in 2017 to download and execute malware including Poison Ivy.
QiAnXin reported that PoisonVine used its customized Kanbox RAT in February 2015.
QiAnXin's report states Microsoft patched CVE-2014-6352 in October 2014 after PoisonVine's use of the exploit.
QiAnXin reported that PoisonVine used the zero-day later tracked as CVE-2014-6352 in September 2014. The report lists a sample creation time of 4 September 2014 and says the exploit bypassed the patch for CVE-2014-4114.
QiAnXin said PoisonVine attacked several military and government targets in 2013 through a compromised website used as a watering hole.
QiAnXin reported that the first ZxShell variant associated with PoisonVine activity was found in 2012.
Antiy said that in 2011–2015 GreenSpot commonly used spearphishing emails with malicious attachments, especially exploit documents abusing CVE-2012-0158 and bundled PE malware. The exploit-document campaigns often used MHT-formatted files to evade antivirus detection.
Antiy assessed that after 2010 the actor improved its ability to adapt 1-day and older vulnerabilities, customize public attack tools, and deploy some self-developed tooling.
QiAnXin reported that PoisonVine targeted universities and military industry organizations in China during 2008 and 2009 as part of its espionage activity.
QiAnXin's report states PoisonVine was first discovered in December 2007. A trojan attributed to the group targeted a large shipping company that year.
Antiy described suspected related intrusion activity from around 2007 using a DIY-style toolset including nc.exe, rar.exe, keyloggers, and HTTP utilities. It said it could not conclusively prove this was GreenSpot, but assessed it came from the same source direction.
Antiy found evidence suggesting GreenSpot used CVE-2014-4114 before October 2014.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 15 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A spear-phishing campaign targeted Japanese organizations with HR-themed lures impersonating company representatives and delivered a multi-stage malware chain built around **PXDropper**, the **PoisonX** kernel driver, and the modular **10FXRAT** remote-access trojan. Victims were directed to Google Cloud Storage-hosted archives containing ZIP, RAR, LNK, or EXE payloads, including polyglot Windows shortcut files that dropped decoy Japanese PDFs and used obfuscated downloaders to fetch second-stage malware such as `RuntimeBroker.exe`. The operators also disguised payloads as legitimate Feishu/Lark and Baidu Netdisk installers and abused DLL sideloading with signed binaries including `dashost.exe` and `unregmp2.exe` to decrypt and launch the malware. Once installed, PoisonX used kernel-level capabilities to terminate security tools and conceal malicious processes and network traffic, while 10FXRAT provided remote shell access, SOCKS5 tunneling, persistence, plugin-based expansion, and tampering with Microsoft Defender. Researchers said the activity continued into May and expanded to Chinese organizations, with the operators shifting from a signed PoisonX driver to **BYOVD** techniques using legitimately signed but vulnerable drivers such as **ASUSTeK `EneIo64.sys`** and Microsoft **`procexp.sys`**. The campaign exposed at least 61 indicators, including 49 SHA-256 hashes and 12 IPv4 command-and-control addresses; notable infrastructure included the Google Cloud Storage bucket `opentokenaiit`, the URL `https://storage.googleapis.com/opentokenaiit/newgram.exe`, and C2 address `101.32.190.202`. Researchers assessed the tradecraft as consistent with a China-nexus operation, with one report noting a possible but unconfirmed link to **Silver Fox**.
Jun 29, 2026
Multiple cyber-espionage campaigns targeted Japanese and broader Asia-Pacific organizations by combining spear-phishing, watering-hole compromises, and exploitation of both widely used and region-specific software vulnerabilities. Reporting links activity against Japanese government agencies, manufacturers, trading firms, petroleum and mobile organizations, and Taiwan government targets to groups including **DragonOK**, **Blue Termite/Cloudy Omega**, **APT17**, **BRONZE BUTLER/Tick**, and the operators behind **MILE TEA**. Attackers repeatedly abused Japanese software such as **Sanshiro**, **Ichitaro**, and **SKYSEA Client View**, while also relying on older Microsoft Office flaws such as `CVE-2012-0158` and other Windows vulnerabilities to deliver malware including **PlugX**, **Emdivi**, **Agtid**, **Wali**, **Datper**, **NodeRAT**, **Elirks**, **Micrass**, and **Logedrut**. Palo Alto Networks documented a 2015 DragonOK phishing operation against Japanese targets that used the `biosnews[.]info` command-and-control server to stage **Sysget/HelloBridge**, **NFlog**, **PoisonIvy**, **NewCT**, **PlugX**, and the custom **FormerFirstRAT** backdoor. The same threat ecosystem was later tied to a watering-hole attack on an aerospace firm website that served an Adobe Flash exploit for `CVE-2015-5122` and installed the **IsSpace** backdoor, assessed as an evolution of **NFlog**. Separate tracking of **MILE TEA** showed a long-running campaign from at least 2011 through 2016 that used flight e-ticket lures, custom installers, and malware that fetched command-and-control addresses from public blog pages, while Trend Micro reported continued heavy exploitation of legacy flaws, abuse of Dropbox for **PlugX** configuration, and PowerShell launched through malicious `.LNK` files across the region.
Aug 15, 2026
Multiple reports linked the Chinese espionage group **APT10**—also tracked as **MenuPass** and **Cicada**—to long-running intrusions that used **Poison Ivy**, **ChChes**, and **Sodamaster** against governments, NGOs, telecoms, legal, pharmaceutical, academic, media, and managed service provider targets across Asia, Europe, and North America. FireEye previously clustered Poison Ivy activity into the `menuPass`, `admin@338`, and `th3bug` campaigns, while Palo Alto documented `th3bug` watering-hole attacks that delivered Poison Ivy through compromised websites and infrastructure tied together by shared command-and-control patterns. Trend Micro also reported that the Japan-focused **ChessMaster** espionage campaign overlapped with APT10 in targeting, malware packaging, infrastructure, and tradecraft, and Symantec later said Cicada/APT10 expanded operations through prolonged intrusions, in some cases beginning with Microsoft Exchange access and persisting for months. Separate attribution research traced historical domain registrations, phishing metadata, social media accounts, and company records to alleged Tianjin-based operators including **Gao Qiang**, **Zhang Shilong**, and **An Zhiqiang**. Investigators said APT10-linked infrastructure such as `chromeenter[.]com`, `js001.3322[.]org`, `xiaohong[.]org`, and related domains connected to Tianjin email addresses, phone numbers, hostnames, and online personas including `fisherxp`, `baobeilong`, and `@gbaike`. The reporting argued that these overlaps tied real-world individuals and a Tianjin technology company to infrastructure associated with earlier **Cloud Hopper** and FireEye-tracked APT10 activity, strengthening claims that the group’s malware campaigns and domain operations were run by operators based in Tianjin, China.
Aug 15, 2026