ThreatNexus
Nation-state APT intelligence
Dossiers Open app
TaiwanClaimedTaiwan's ICEFCOMEspionageActive 2007 – 2025

GreenSpot

Also known asAPT-C-01 · APT-Q-20 · Poison Cloud Vine

11ATT&CK techniques6Malware & tools2Exploited CVEs3Campaigns6Sectors
Open the interactive dossier Diamond Model Hunt coverage Tradecraft lanes
Share

Summary

Espionage cluster tracked by Chinese vendors — Qihoo 360 as APT-C-01 ('Poison Cloud Vine', 毒云藤), QiAnXin as APT-Q-20, also GreenSpot — against PRC defence, government, science, education and maritime bodies since 2007, interested in the military industry, US–China and cross-Strait relations. It relies on spear-phishing (posing as think tanks, military journals, defence parks and civil-service headhunters), cloned login pages of popular PRC mail and social services, watering holes, and weak-password attacks on routers, cameras and firewalls; QiAnXin describes the tooling as unsophisticated but persistent (2018–2025). Attribution is PRC-only: in Mar 2025 the MSS said a cyber centre inside Taiwan's Information, Communications and Electronic Force Command (ICEFCOM) runs it and named four people, and Antiy and QiAnXin reports tied it to the Taiwanese government; in Jun 2025 Guangzhou police put 20 alleged ICEFCOM-linked suspects on a wanted list. Taiwan denies the accusations. No non-PRC source corroborates the attribution, so the country is held at low confidence and the ICEFCOM allegations are claimed.

Attribution

ClaimedClaimed only: Taiwan's ICEFCOM

Asserted only by PRC sources; not corroborated

Asserted only by an interested party, typically an adversary government; unverified.

Sources

Campaigns 3

CampaignPeriodTargetsSectorsSource
ICEFCOM attacks on mainland key institutions — 20 suspects wanted (PRC police allegation)CLAIMED2025 – 2025-06China, Hong Kong, MacauDefense, Aviation, Energy, TransportationGuangzhou Tianhe PSB / CVERC via Xinhua (2025-06-05) — PRC/Russian government allegation — recorded as claimed, not independently corroborated
Cloned PRC mail, social and government sites for credential harvesting; themed spear-phishing (APT-Q-20)2018 – 2025ChinaGovernment, Defense, ResearchQiAnXin via Global Times (2025-03-17)
Eleven-year spear-phishing espionage against PRC defence, government and maritime bodies (APT-C-01)2007-12 – 2018-09ChinaDefense, Government, Maritime, EducationQihoo 360 (2018-09-20) — "从2007年开始至今" (from 2007 to now): ongoing at publication

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 11

Resource Development1T1583.001Domains
Initial Access3T1566.001Spearphishing AttachmentT1566.002Spearphishing LinkT1189Drive-by Compromise
Execution2T1059.001PowerShellT1203Exploitation for Client Execution
Persistence1T1547.001Registry Run Keys / Startup Folder
Stealth1T1036.002Right-to-Left Override
Credential Access1T1110Brute Force
Collection1T1119Automated Collection
Exfiltration1T1567.002Exfiltration to Cloud Storage

Malware and tools 6

NameDescriptionPlatform
Poison IvyRATWindows
ZxShellBackdoor (modified from public source; adds IEPass)Windows
GH0ST RATRATWindows
XRATRATWindows
HttpBotBackdoorWindows
SCLoaderByWebShellcode loader (fetches XOR-encoded Poison Ivy shellcode)Windows

Exploited vulnerabilities 2

CVECVSSDetail
CVE-2012-01588.8Microsoft Windows Common Controls (MSCOMCTL.OCX) — RCE (KEV 2021-11-03)
CVE-2017-87597.8Microsoft .NET Framework — WSDL parser RCE (KEV 2021-11-03)

Highest CVSS first.

Infrastructure patterns

  • Dynamic-DNS C2 domains, e.g. updateinfo.servegame[.]org, zxcv201789.dynssl[.]com (Qihoo 360, 2018)
  • Kanbox cloud-drive API used as the upload C2 (Qihoo 360, 2018)
  • XOR-encoded shellcode staged as .tmp files on its distribution domains (Qihoo 360, 2018)
  • Phishing sent through webmail logins and PHPMailer (Qihoo 360, 2018)
  • Continual registration of new domains and purchase of servers (QiAnXin, 2025)

Reporting and advisories 4