HOMETHREATSGelsemium
APT / THREAT GROUP

Gelsemium

2
aliases
Last seen:Mar 17, 2026

Intelligence Profile

[Gelsemium](https://attack.mitre.org/groups/G0141) is a cyberespionage group that has been active since at least 2014, targeting governmental institutions, electronics manufacturers, universities, and religious organizations in East Asia and the Middle East.(Citation: ESET Gelsemium June 2021)

Threat Analysis

Gelsemium is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://www.welivesecurity.com/2021/06/09/gelsemium-when-threat-actors-go-gardening/
→https://www.venustech.com.cn/uploads/2018/08/231401512426.pdf
→https://hitcon.org/2016/pacific/0composition/pdf/1202/1202%20R0%200930%20an%20intelligance-driven%20approach%20to%20cyber%20defense.pdf
→https://public.gdatasoftware.com/Presse/Publikationen/Whitepaper/EN/GDATA_TooHash_CaseStudy_102014_EN_v1.pdf

Quick Facts

TypeAPT / Threat Group
Aliases2
SourceMalpedia

Also Known As

Gelsemium狼毒草

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search Gelsemium