Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · GreenSpot · Unknown · assessed origin Taiwan · misp-galaxy · refreshed 2026-10-06

GreenSpot

  • PoisonVine
  • APT-Q-20

sigil · no ATT&CK coverage stated

What changed

ledger · newest first
  1. —todaynew CVE3 new CVEs: CVE-2012-0158, CVE-2014-4114, CVE-2017-8759

Analyst brief

misp-galaxy

GreenSpot is an APT group believed to operate from Taiwan, active since at least 2007, primarily targeting government, academic, and military entities in China through phishing campaigns. The group frequently targets 163.com, aiming to steal login credentials using deceptive domains, manipulated TLS certificates, and counterfeit interfaces. Their tactics highlight the sophistication of modern credential theft operations, necessitating detection efforts focused on irregular domain registrations and certificate anomalies.

CVEs GreenSpot is cited as exploiting

none on KEV
  1. CVE-2017-87592026-10-17
    1. “In 2017, Antiy Labs analyzed a new attack document of “GreenSpot” group, which exploits the latest CVE-2017-8759 vulnerability”

      cited as exploiting · source: antiy.net ↗ · 2026-10-17

  2. CVE-2014-41142026-10-17
    1. “We have some analytical evidence that “GreenSpot” group exploited CVE-2014-4114 vulnerability”

      cited as exploiting · source: antiy.net ↗ · 2026-10-17

  3. CVE-2012-01582026-10-17
    1. “The traditional CVE-2012-0158 exploit format is mainly RTF, but “GreenSpot” group uses the MHT format, which can also trigger vulnerabilities, and can evade multiple antivirus software.”

      cited as exploiting · source: antiy.net ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

3 sources
  1. 1.hunt.io/blog/greenspot-apt-targets-163com-fake-downloads-spoof…
  2. 2.antiy.net/p/greenspotoperations-grow-for-many-years
  3. 3.virusbulletin.com/virusbulletin/2019/11/vb2019-paper-vine-climbing-over-…

Track GreenSpot on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.