ETDA สำนักงานพัฒนาธุรกรรมทางอิเล็กทรอนิกส์
Electronic Transactions Development Agency
Home > List all groups > Gelsemium

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link APT group: Gelsemium

NamesGelsemium (ESET)
CountryChina China
MotivationInformation theft and espionage
First seen2014
Description(ESET) The Gelsemium group has been active since at least 2014 and was described in the past by a few security companies .Gelsemium’s name comes from one possible translation we found while reading a report from VenusTech who dubbed the group 狼毒草 for the first time .It’s the name of a genus of flowering plants belonging to the family Gelsemiaceae, Gelsemium elegans is the species that contains toxic compounds like Gelsemine, Gelsenicine and Gelsevirine, which we chose as names for the three components of this malware family.
ObservedSectors: Education, Gaming, Government, High-Tech, NGOs and religious organizations.
Countries: Argentina, Brunei, China, Djibouti, Egypt, Equatorial Guinea, Hong Kong, Indonesia, Iran, Iraq, Israel, Japan, Jordan, Kenya, Laos, Lebanon, Malaysia, Mongolia, Nigeria, North Korea, Oman, Pakistan, Russia, Saudi Arabia, South Korea, Sri Lanka, Swaziland, Syria, Taiwan, Thailand, Turkey, UAE, UK, Vietnam, Yemen.
Tools usedASPXSpy, BadPotato, China Chopper, Chrommme, EarthWorm, Cobalt Strike, Gelsemine, Gelsenicine, Gelsevirine, JuicyPotato, Owowa, OwlProxy, reGeorg, SessionManager, SpoolFool, SweetPotato.
Operations performed2014Operation “TooHash”
Jan 2021Operation “NightScout”
A new supply-chain attack compromising the update mechanism of NoxPlayer, an Android emulator for PCs and Macs, and part of BigNox’s product range with over 150 million users worldwide.
Dec 2021Kaspersky discovers poorly detected backdoor, targeting governments and NGOs around the globe
Mid 2022Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government

Last change to this card: 12 October 2023

Download this actor card in PDF or JSON format

Previous: GCMAN
Next: GhostEmperor

Digital Service Security Center
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents

Telephone +66 (0)2-123-1227
E-mail [email protected]