Loading threat actor…
PoisonVine is a cyber-espionage threat actor tracked as APT-C-01 and also referred to as GreenSpot and APT-Q-20. The group has been active since at least 2007 and is assessed to have conducted long-running intelligence collection against targets in China, with a primary focus on political and military information. Reported victims include Chinese government agencies, military personnel, research institutes, maritime agencies, universities, military industry entities, and a major shipping company. PoisonVine is associated with spear-phishing and watering-hole operations for initial compromise, including the use of malicious document lures and client-side exploitation. Reported exploitation has included CVE-2012-0158, CVE-2014-6352, and CVE-2017-8759. Delivery and execution tradecraft has included disguised attachments, self-extracting archives, right-to-left override filename deception, and script-based execution chains including mshta. The actor has used both commodity and customized malware, including Poison Ivy, ZxShell, and a custom family known as Kanbox RAT. Collection activity has focused on locally stored office documents and keyword-based filtering oriented toward military, national security, international affairs, and technology themes. PoisonVine has also used cloud services and dynamic DNS-backed infrastructure for command and control and data exfiltration. Observed defense-evasion methods include reversed API strings and malformed or invalid API parameter usage intended to hinder analysis or detection. The group’s operations are consistent with a disciplined espionage actor emphasizing document theft, covert persistence, and post-compromise collection rather than disruptive or financially motivated activity. Public reporting in 2025 linked PoisonVine to Taiwan and described it as targeting China for political and military intelligence. That attribution was presented alongside the aliases GreenSpot and APT-Q-20. High-confidence characterization of the actor is therefore that of a long-running espionage group focused on Chinese governmental, military, maritime, academic, and defense-related targets.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
4 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
5 malware families attributed to this actor across reporting.
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
0day was discovered(CVE-2014-6352) ... CVE-2014-6352 • bypass the patch of CVE-2014-4114 used by Sandworm • 0-day • sample creation time on 4th Sep 2014 • patched on Oct 2014
Several spear phishing attacks and using CVE-2017-8759 ... Customized shellcode loader • discovered in early 2018 • .hta -> CVE-2017-8759 • triggered .hta execute with CVE-2017-8759
10 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Alleged Taiwan-linked espionage-focused APT activity targeting mainland China, using spear-phishing and fake government portals to deliver RATs (including Sliver/Cobalt Strike) and credential-harvesting infrastructure; also reported using Poison Ivy and ZxShell and exploiting known (N-day) device vulnerabilities for access and movement.
Long-term espionage campaign targeting China for political and military intelligence, including government, military, research, maritime, university, and shipping-related targets.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.