Gelsemium is espionage-focused and leverages custom malware such as WolfsBane, a Linux-based tool, and FireWood, which is linked to the older Project Wood backdoor. These tools are designed to steal sensitive information, exploit web vulnerabilities, and evade detection using advanced techniques like rootkits. Their emphasis on Linux systems demonstrates their adaptability and ability to exploit emerging vulnerabilities. Gelsemium’s activities pose significant risks, including intellectual property theft, operational disruptions, and reputational damage. Their multi-stage attacks typically begin by targeting publicly accessible servers, then spread laterally within networks to compromise critical systems.

Gelsemium is potentially connected to the Blackwood APT group, based on the correlation between the FireWood Backdoor and Project Wood. Blackwood, active since at least 2018, has conducted cyberespionage operations targeting individuals and organizations in China, Japan, and the United Kingdom. Known for using AiTM (Adversary-in-the-Middle) attacks, Blackwood intercepts network communications to steal credentials, forge encryption keys, and facilitate further attacks. These techniques have been used to deploy the NSPX30 implant by exploiting update mechanisms of software such as Tencent QQ, WPS Office, and Sogou Pinyin. Given Blackwood’s history of targeting Japan, the Gelsemium APT group may continue to pose a significant threat to the region.