🇨🇳

Gelsemium

APT Group Information theft and espionage 1 zero-day CVE ETDA ✓

Also Known As

No alias recorded

Target Countries 39

Countries highlighted in red

United Arab Emirates Argentina Brunei Darussalam China Djibouti Egypt United Kingdom Equatorial Guinea Hong Kong Indonesia Israel Iraq Islamic Republic of Iran Jordan Japan Kenya Democratic People's Republic of Korea Republic of Korea Kuwait Lao People's Democratic Republic Lebanon Sri Lanka Mongolia Malaysia Nigeria Oman Philippines Pakistan Russian Federation Saudi Arabia Singapore Syrian Arab Republic Swaziland Thailand Turkey Province of China Taiwan United States Vietnam Yemen

Sectors Targeted

Religious organization Public Administration 92 Gaming Grantmaking and Giving Services 8132 Electronics Manufacturers Arts, Entertainment, and Recreation 71 Educational Services 61 NAICS:813 813 Computer Systems Design Services 541512 Government religious organizations Universities High-Tech Computer and Electronic Product Manufacturing 334 Information 51 NAICS:31 31 NGOs Education

Details

Origin 🇨🇳 CN

Last Updated 01 Jun 2022

MITRE ATT&CK 34

T1014 - Rootkit T1021 - Remote Services T1027 - Obfuscated Files or Information T1036 - Masquerading T1037 - Boot or Logon Initialization Scripts T1041 - Exfiltration Over C2 Channel T1055 - Process Injection T1056 - Input Capture T1059 - Command and Scripting Interpreter T1059.001 T1070 - Indicator Removal on Host T1071.001 T1078 - Valid Accounts T1082 - System Information Discovery T1083 - File and Directory Discovery T1090 T1102 - Web Service T1105 - Ingress Tool Transfer T1112 - Modify Registry T1222 - File and Directory Permissions Modification T1505 - Server Software Component T1543 - Create or Modify System Process T1546 - Event Triggered Execution T1547 - Boot or Logon Autostart Execution T1548 - Abuse Elevation Control Mechanism T1562 - Impair Defenses T1564 - Hide Artifacts T1566 - Phishing T1566.001 T1571 - Non-Standard Port T1573 - Encrypted Channel T1574 - Hijack Execution Flow T1583 - Acquire Infrastructure T1587 - Develop Capabilities

Related Zero-Days 1

CVE-2022-30190

Known Names 1 entries

Gelsemium ESET

Observed Target Countries 35

Based on ETDA data — countries highlighted in red

Argentina Brunei China Djibouti Egypt Equatorial Guinea Hong Kong Indonesia Iran Iraq Israel Japan Jordan Kenya Laos Lebanon Malaysia Mongolia Nigeria North Korea Oman Pakistan Russia Saudi Arabia South Korea Sri Lanka Swaziland Syria Taiwan Thailand Turkey UAE UK Vietnam Yemen

Description

(ESET) The Gelsemium group has been active since at least 2014 and was described in the past by a few security companies .Gelsemium’s name comes from one possible translation we found while reading a report from VenusTech who dubbed the group 狼毒草 for the first time .It’s the name of a genus of flowering plants belonging to the family Gelsemiaceae, Gelsemium elegans is the species that contains toxic compounds like Gelsemine, Gelsenicine and Gelsevirine, which we chose as names for the three components of this malware family.

Tools Used 18

ASPXSpy BadPotato China Chopper Chrommme EarthWorm Cobalt Strike FireWood Gelsemine Gelsenicine Gelsevirine JuicyPotato Owowa OwlProxy reGeorg SessionManager SpoolFool SweetPotato WolfsBane

Operations 5

2014 Operation “TooHash” https://public.gdatasoftware.com/Presse/Publikationen/Whitepaper/EN/GDATA_TooHash_CaseStudy_102014_EN_v1.pdf

2021-01 Operation “NightScout” A new supply-chain attack compromising the update mechanism of NoxPlayer, an Android emulator for PCs and Macs, and part of BigNox’s product range with over 150 million users worldwide. https://www.welivesecurity.com/2021/02/01/operation-nightscout-supply-chain-attack-online-gaming-asia/

2021-12 Kaspersky discovers poorly detected backdoor, targeting governments and NGOs around the globe https://www.kaspersky.com/about/press-releases/2022_kaspersky-discovers-poorly-detected-backdoor-targeting-governments-and-ngos-around-the-globe

2022 Mid Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government https://unit42.paloaltonetworks.com/rare-possible-gelsemium-attack-targets-se-asia/

2023 Unveiling WolfsBane: Gelsemium’s Linux counterpart to Gelsevirine https://www.welivesecurity.com/en/eset-research/unveiling-wolfsbane-gelsemiums-linux-counterpart-to-gelsevirine/

Reports & References 2

https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf https://www.venustech.com.cn/uploads/2018/08/231401512426.pdf

ETDA Profile

Gelsemium

Origin

China

First Seen 2014

Motivation

Information theft and espionage

View on ETDA APT Groups ↗