POISON CARP

Also known as: Earth Empusa, Evil Eye, EvilBamboo, POISON CARP, Poison Carp, Red Dev 16, Sentinel Taurus

Between November 2018 and May 2019, senior members of Tibetan groups received malicious links in individually tailored WhatsApp text exchanges with operators posing as NGO workers, journalists, and other fake personas. The links led to code designed to exploit web browser vulnerabilities to install spyware on iOS and Android devices, and in some cases to OAuth phishing pages. This campaign was carried out by what appears to be a single operator that we call POISON CARP.

🌍 Country China

Associated Operations

2018 2020 Early 2020-01 2022 2023-06 Digital Crackdown: Large-Scale Surveillance and Exploitation of Uyghurs Evil Eye EvilBamboo Targets Mobile Devices in Multi-year Campaign Immediately after the publications from Google and Volexity Lookout Discovers Long-running Surveillance Campaigns Targeting Uyghurs While tracking Earth Empura also known as POISON CARP/Evil Eye and various hostnames stopped resolving. This largely remained the case until early January 2020 command and control (C2) servers were taken down https://blog.trendmicro.com/trendlabs-security-intelligence/new-android-spyware-actionspy-revealed-via-phishing-attacks-from-earth-empusa/ https://www.lookout.com/blog/uyghur-surveillance-campaign-badbazaar-moonshine https://www.volexity.com/blog/2019/09/02/digital-crackdown-large-scale-surveillance-and-exploitation-of-uyghurs/ https://www.volexity.com/blog/2020/04/21/evil-eye-threat-actor-resurfaces-with-ios-exploit-and-updated-implant/ https://www.volexity.com/blog/2023/09/22/evilbamboo-targets-mobile-devices-in-multi-year-campaign/ the Evil Eye threat actor went fairly quiet. They removed their malicious code from compromised websites we identified an undocumented Android spyware we have named ActionSpy. when Volexity observed a series of new activity across multiple previously compromised Uyghur websites.

Introduction

Between November 2018 and May 2019, senior members of Tibetan groups received malicious links in individually tailored WhatsApp text exchanges with operators posing as NGO workers, journalists, and other fake personas. The links led to code designed to exploit web browser vulnerabilities to install spyware on iOS and Android devices, and in some cases to OAuth phishing pages. This campaign was carried out by what appears to be a single operator that we call POISON CARP.

Activities and Tactics

Country of Origin: 🇨🇳 China

Notable Campaigns

  • 2018
  • 2020 Early
  • 2020-01
  • 2022
  • 2023-06
  • Digital Crackdown: Large-Scale Surveillance and Exploitation of Uyghurs
  • Evil Eye
  • EvilBamboo Targets Mobile Devices in Multi-year Campaign
  • Immediately after the publications from Google and Volexity
  • Lookout Discovers Long-running Surveillance Campaigns Targeting Uyghurs
  • While tracking Earth Empura
  • also known as POISON CARP/Evil Eye
  • and various hostnames stopped resolving. This largely remained the case until early January 2020
  • command and control (C2) servers were taken down
  • https://blog.trendmicro.com/trendlabs-security-intelligence/new-android-spyware-actionspy-revealed-via-phishing-attacks-from-earth-empusa/
  • https://www.lookout.com/blog/uyghur-surveillance-campaign-badbazaar-moonshine
  • https://www.volexity.com/blog/2019/09/02/digital-crackdown-large-scale-surveillance-and-exploitation-of-uyghurs/
  • https://www.volexity.com/blog/2020/04/21/evil-eye-threat-actor-resurfaces-with-ios-exploit-and-updated-implant/
  • https://www.volexity.com/blog/2023/09/22/evilbamboo-targets-mobile-devices-in-multi-year-campaign/
  • the Evil Eye threat actor went fairly quiet. They removed their malicious code from compromised websites
  • we identified an undocumented Android spyware we have named ActionSpy.
  • when Volexity observed a series of new activity across multiple previously compromised Uyghur websites.

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • PoisonIvy
  • DroidJack
  • Androrat
  • Xploit
  • ActionSpy:
  • ScanBox:
  • BeEF:
  • Evil Eye:
  • Android and Google Chrome:
  • BADSIGNAL:
  • BADSOLAR:
  • BadBazaar:
  • Bourbon:
  • IRONSQUIRREL:
  • IceCube:
  • MOONSHINE:
  • PoisonCarp:
  • Scotch:
  • Whisky:
  • several exploits in iOS:

Attribution and Evidence

Country of Origin: China Additional attribution information pending cataloguing.

References

References pending cataloguing.