File · Grayling · Nation-state · assessed origin China · misp-galaxy · refreshed 2026-10-06
Grayling
state sponsor · China
sigil · no ATT&CK coverage stated
What changed
ledger · newest first- —todaynew CVE1 new CVE: CVE-2019-0803
Analyst brief
misp-galaxyGrayling activity was first observed in early 2023, when a number of victims were identified with distinctive malicious DLL side-loading activity. Grayling appears to target organisations in Asia, however one unknown organisation in the United States was also targeted. Industries targeted include Biomedical, Government and Information Technology. Grayling use a variety of tools during their attacks, including well known tools such as Cobalt Strike and Havoc and also some others.
Observed targets (as stated by the sources)
3 countries · 3 sectorsassessed origin · Chinaobserved targets · 3
countries · 3
- Taiwan
- United States
- Vietnam
sectors · 3
- Biomedical
- Government
- Information technology
also stated: Solomon Islands
as stated by MISP galaxy / ransomware.live — not inferred
CVEs Grayling is cited as exploiting
none on KEV- CVE-2019-08032026-10-17
“Grayling used the publicly available spyware tool NetSpy, exploited legacy Windows elevation of privileges bug CVE-2019-0803”
cited as exploiting · source: ics-cert.kaspersky.com ↗ · 2026-10-17
Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.
Take it with you
keyless · no signupReferences
1 sourceTrack Grayling on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.