Skip to content
brandefense.io
Request A Demo
Nation-state APTEspionageIntermediate sophistication · State-backed

GreenSpot

GreenSpot is a Taiwan-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets 5 sectors, including Government and Technology, in China. It uses 2 MITRE ATT&CK techniques and exploits 4 known CVEs.

Also known as
  • PoisonVine
  • APT-Q-20
  • APT-C-01
  • Poison Ivy Group
Request IOC feedRequest ATT&CK export
Origin
Taiwan
Techniques
2
Exploited CVEs
4
First seen
Jan 1, 2007
Last seen
Sep 20, 2018
Record updated

Who They Target.

Sectors · 5
Countries · 1

About GreenSpot.

GreenSpot is an APT group believed to operate from Taiwan, active since at least 2007, primarily targeting government, academic, and military entities in China through phishing campaigns. The group frequently targets 163.com, aiming to steal login credentials using deceptive domains, manipulated TLS certificates, and counterfeit interfaces. Their tactics highlight the sophistication of modern credential theft operations, necessitating detection efforts focused on irregular domain registrations and certificate anomalies.

Last updated Sep 19, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.