POISON CARP
POISON CARP is a China-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets organisations in 7 countries, including the United States and Canada.
- Evil Eye
- Red Dev 16
- Earth Empusa
- EvilBamboo
- Sentinel Taurus
- Origin
- China
- Techniques
- 0
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2018
- Record updated
Who They Target.
About POISON CARP.
Between November 2018 and May 2019, senior members of Tibetan groups received malicious links in individually tailored WhatsApp text exchanges with operators posing as NGO workers, journalists, and other fake personas. The links led to code designed to exploit web browser vulnerabilities to install spyware on iOS and Android devices, and in some cases to OAuth phishing pages. This campaign was carried out by what appears to be a single operator that we call POISON CARP.
Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.