- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Motivation
- Information theft and espionage
- Seen
- 2018
- Sources
- 8 sources carry it
- Identifier
- GINC-APT-0144 · poison-carp
ChinaWhat it is
Between November 2018 and May 2019, senior members of Tibetan groups received malicious links in individually tailored WhatsApp text exchanges with operators posing as NGO workers, journalists, and other fake personas. The links led to code designed to exploit web browser vulnerabilities to install spyware on iOS and Android devices, and in some cases to OAuth phishing pages. This campaign was carried out by what appears to be a single operator that we call POISON CARP.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- PwC
- Red Dev 16
- Trend Micro
- Earth Empusa
- Other names
- Poison Carp, Evil Eye, EvilBamboo, Poison Carp, Evil Eye, Sentinel Taurus
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Targets
- Countries
- Australia, Canada, China, Kazakhstan, Syria, Türkiye, United States
Tools
The tools and malware families the sources tie to it.
- ActionSpy
- Android and Google Chrome
- Androrat
- BADSIGNAL
- BADSOLAR
- BadBazaar
- BeEF
- Bourbon
- DroidJack
- Evil Eye
- IRONSQUIRREL
- IceCube
- MOONSHINE
- PoisonCarp
- PoisonIvy
- ScanBox
- Scotch
- Whisky
- Xploit
- several exploits in iOS
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de