APT Explorer

All actors

GreenSpot

Also reported as PoisonVine and APT-Q-20. Linked to Taiwan by two sources.

Reports
8
Last reported
Known CVEs
5
Origin
Taiwan
ID
greenspot
Sources
MISPMalpedia
Merge evidence
3 alias matches

Reports per quarter

Dated reports, 2018 Q3 to 2025 Q1.

CVEs named in reports

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

  1. GreenSpot APT Targets NetEase 163.com Users with Fake Download Pages & Spoofed Domains

    Malpedia library date ORKL

    Archived copy on ORKL Details

  2. Antiy's analysis report on the recent APT attacks against the Green Spot organization

    date in the title ORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Details

  3. a long‑term attack against China

    Malpedia library date ORKL

    Archived copy on ORKL Details

  4. VB2019-A Vine Climbing Over Great Firewall A Long-Term Attack to China

    file creation date ORKL

    Archived copy on ORKL Details

  5. SECR_001_EN-1901%20-%20NETSCOUT%20Threat%20Intelligence%20Report%202H%202018.pdf

    file creation date ORKL

    Archived copy on ORKL Details

  6. “GreenSpot”Operations Grow For Many Years - Antiy Labs

    Malpedia library date ORKL

    Archived copy on ORKL Details

  7. CN_APT-C-01

    file creation date ORKL

    The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Details

  8. “绿斑”行动——持续多年的攻击

    date in the CCS '25 data Antiy Labs ORKLCCS '25 data

    The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Details

Newest first. Details opens the report in Explore.