Gelsemium

Also known as: Gelsemium, Operation “NightScout”, Operation “TooHash”, 狼毒草

The Gelsemium group has been active since at least 2014 and was described in the past by a few security companies. Gelsemium’s name comes from one possible translation ESET found while reading a report from VenusTech who dubbed the group 狼毒草 for the first time. It’s the name of a genus of flowering plants belonging to the family Gelsemiaceae, Gelsemium elegans is the species that contains toxic compounds like Gelsemine, Gelsenicine and Gelsevirine, which ESET choses as names for the three components of this malware family.

🌍 Country ["China"]
📅 Activity 2014 — 2014
Government Electronics Manufacturers Universities Religious organization
2014
2014

Targeted Victims

North Korea South Korea Japan China Mongolia Egypt Saudi Arabia Yemen Oman Iran Iraq Kuwait Israel Jordan Gaza Syria Turkey Lebanon

Associated Operations

2014 2021-01 2021-12 2022 Mid 2023 A new supply-chain attack compromising the update mechanism of NoxPlayer Kaspersky discovers poorly detected backdoor Operation “NightScout” Operation “TooHash” Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government Unveiling WolfsBane: Gelsemium’s Linux counterpart to Gelsevirine an Android emulator for PCs and Macs and part of BigNox’s product range with over 150 million users worldwide. https://public.gdatasoftware.com/Presse/Publikationen/Whitepaper/EN/GDATA_TooHash_CaseStudy_102014_EN_v1.pdf https://unit42.paloaltonetworks.com/rare-possible-gelsemium-attack-targets-se-asia/ https://www.kaspersky.com/about/press-releases/2022_kaspersky-discovers-poorly-detected-backdoor-targeting-governments-and-ngos-around-the-globe https://www.welivesecurity.com/2021/02/01/operation-nightscout-supply-chain-attack-online-gaming-asia/ https://www.welivesecurity.com/en/eset-research/unveiling-wolfsbane-gelsemiums-linux-counterpart-to-gelsevirine/ targeting governments and NGOs around the globe

Introduction

The Gelsemium group has been active since at least 2014 and was described in the past by a few security companies. Gelsemium’s name comes from one possible translation ESET found while reading a report from VenusTech who dubbed the group 狼毒草 for the first time. It’s the name of a genus of flowering plants belonging to the family Gelsemiaceae, Gelsemium elegans is the species that contains toxic compounds like Gelsemine, Gelsenicine and Gelsevirine, which ESET choses as names for the three components of this malware family.

Activities and Tactics

Targeted Sectors: Government, Electronics Manufacturers, Universities, Religious organization

Country of Origin: 🇨🇳 [“China”]

First Seen: 2014

Last Activity: 2014

Suspected Victims: North Korea, South Korea, Japan, China, Mongolia, Egypt, Saudi Arabia, Yemen, Oman, Iran…

Notable Campaigns

  • 2014
  • 2021-01
  • 2021-12
  • 2022 Mid
  • 2023
  • A new supply-chain attack compromising the update mechanism of NoxPlayer
  • Kaspersky discovers poorly detected backdoor
  • Operation “NightScout”
  • Operation “TooHash”
  • Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government
  • Unveiling WolfsBane: Gelsemium’s Linux counterpart to Gelsevirine
  • an Android emulator for PCs and Macs
  • and part of BigNox’s product range with over 150 million users worldwide.
  • https://public.gdatasoftware.com/Presse/Publikationen/Whitepaper/EN/GDATA_TooHash_CaseStudy_102014_EN_v1.pdf
  • https://unit42.paloaltonetworks.com/rare-possible-gelsemium-attack-targets-se-asia/
  • https://www.kaspersky.com/about/press-releases/2022_kaspersky-discovers-poorly-detected-backdoor-targeting-governments-and-ngos-around-the-globe
  • https://www.welivesecurity.com/2021/02/01/operation-nightscout-supply-chain-attack-online-gaming-asia/
  • https://www.welivesecurity.com/en/eset-research/unveiling-wolfsbane-gelsemiums-linux-counterpart-to-gelsevirine/
  • targeting governments and NGOs around the globe

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No atomic indicators are listed in this profile. The APTnotes snapshot indexes 1 public reports that may contain IOCs; see Source Attribution for dataset links.

Malware and Tools

  • ASPXSpy:
  • BadPotato:
  • China Chopper:
  • Chrommme:
  • Cobalt Strike:
  • EarthWorm:
  • FireWood:
  • Gelsemine:
  • Gelsenicine:
  • Gelsevirine:
  • JuicyPotato:
  • OwlProxy:
  • Owowa:
  • SessionManager:
  • SpoolFool:
  • SweetPotato:
  • WolfsBane:
  • reGeorg:

Attribution and Evidence

Country of Origin: [“China”] Additional attribution information pending cataloguing.

References

References pending cataloguing.