ThaiCERT    ETDA    MDES
Report
Search
Home > List all groups > List all tools > List all groups using tool PoisonCarp

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link Tool: PoisonCarp

NamesPoisonCarp
CategoryMalware
TypeBackdoor, Info stealer, Exfiltration
Description(Citizen Lab) We observed POISON CARP employing a total of eight Android browser exploits and one Android spyware kit, as well as one iOS exploit chain and iOS spyware. None of the exploits that we observed were zero days. POISON CARP overlaps with two recently reported campaigns against the Uyghur community. The iOS exploit and spyware we observed was used in watering hole attacks reported by Google Project Zero, and a website used to serve exploits by POISON CARP was also observed in a campaign called “Evil Eye” reported by Volexity. The Android malware used in the campaign is a fully featured spyware kit that has not been previously documented.
Information<https://citizenlab.ca/2019/09/poison-carp-tibetan-groups-targeted-with-1-click-mobile-exploits/>
Malpedia<https://malpedia.caad.fkie.fraunhofer.de/details/ios.poisoncarp>

Last change to this tool card: 22 April 2020

Download this tool card in JSON format

Previous: PocoDown
Next: Poison Ivy

All groups using tool PoisonCarp

ChangedNameCountryObserved

APT groups

 Poison Carp, Evil EyeChina2018-Early 2020 

1 group listed (1 APT, 0 other, 0 unknown)

Thailand Computer Emergency Response Team (ThaiCERT)
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents

Telephone +66 (0)2-123-1234
E-mail report@thaicert.or.th
PGP Download PGP key