GreenSpot

GreenSpot is a long-running espionage-focused advanced persistent threat cluster assessed to be associated with Taiwan and known for sustained targeting of organizations in China. Reported victimology centers on Chinese government departments and aviation-, military-, and research-related institutions. Activity has been linked across campaigns from at least the early 2010s, with possible related operations dating back to around 2007 from the same source direction. GreenSpot has relied heavily on spearphishing for initial access, typically using malicious attachments delivered as exploit documents or trojanized executables. The actor repeatedly used older or n-day vulnerabilities rather than exclusive zero-days, including CVE-2012-0158, CVE-2014-4114, and later CVE-2017-8759. A notable tradecraft feature was early use of MHT-formatted CVE-2012-0158 exploit documents to reduce antivirus detection. Malicious documents commonly displayed decoy content while dropping and executing payloads. The group has used multiple commodity and customized malware families, including Poison Ivy, Gh0st, HttpBots, and modified ZXShell variants. Its tooling has supported persistence, remote administration, command execution, file theft, credential collection, keylogging, and exfiltration. Customized ZXShell samples were reported to collect sensitive office documents, harvest saved email credentials, and gather host and network information, with some tasking tailored toward military- and aviation-related themes. In later observed chains, staged loaders downloaded encrypted shellcode and launched Poison Ivy, showing continued adaptation of delivery mechanisms while retaining familiar malware. GreenSpot’s operational pattern emphasizes practical and repeatable tradecraft: reuse and modification of public RATs, packing and customization to evade detection, shared infrastructure across campaigns, and long-term targeting aligned with intelligence collection. The actor has been linked through overlapping command-and-control infrastructure, common passwords, similar loaders, and code similarities. Overall, GreenSpot is best characterized as a persistent cyber-espionage actor focused on stealing sensitive documents and information from Chinese state, defense-adjacent, and research targets.