Gelsemium
Gelsemium is a China-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets 8 sectors, including Government and Technology, in 34 countries, including the United Kingdom and Indonesia. It uses 6 MITRE ATT&CK techniques and exploits 3 known CVEs.
- Operation “TooHash”
- Operation “NightScout”
- Origin
- China
- Techniques
- 6
- Exploited CVEs
- 3
- First seen
- Jan 1, 2014
- Last seen
- Nov 21, 2024
- Record updated
Who They Target.
About Gelsemium.
The Gelsemium group has been active since at least 2014 and was described in the past by a few security companies.Gelsemium’s name comes from one possible translation we found while reading a report from VenusTech who dubbed the group 狼毒草 for the first time.It’s the name of a genus of flowering plants belonging to the family Gelsemiaceae, Gelsemium elegans is the species that contains toxic compounds like Gelsemine, Gelsenicine and Gelsevirine, which we chose as names for the three components of this malware family.
Last updated Sep 21, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.