The Gelsemium group has been active since at least 2014 and was described in the past by a few security companies. Gelsemium’s name comes from one possible translation ESET found while reading a report from VenusTech who dubbed the group 狼毒草 for the first time. It’s the name of a genus of flowering plants belonging to the family Gelsemiaceae, Gelsemium elegans is the species that contains toxic compounds like Gelsemine, Gelsenicine and Gelsevirine, which ESET choses as names for the three components of this malware family.
The same group is tracked under different names by different vendors.
| Vendor | Name |
|---|---|
| OSINT | 狼毒草 |
Sectors: Government, Electronics Manufacturers, Universities, Religious organization
Victim countries: North Korea, South Korea, Japan, China, Mongolia, Egypt, Saudi Arabia, Yemen, Oman, Iran, Iraq, Kuwait, Israel, Jordan, Gaza, Syria, Turkey, Lebanon
No techniques mapped yet.
No IOCs extracted yet from reports naming this actor.
Every report in the Global Intel Library that names Gelsemium, newest first. Open any report to see the full analysis with provenance.
No reports in the Lore library name this actor yet.
Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to Gelsemium. Each row shows why it was linked and where it came from.
No feed indicators linked to this actor yet. Feeds are checked every hour.
Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.