Threat Profile: Genesis Day

Threat actors from an up-and-coming threat organization in China targeted several South Korean academic institutions and research facilities in the early weeks of 2023. This group is tracked as Genesis Day, Teng Snake, or Xiaoqiying, and are primarily motivated by patriotism toward the Chinese state, making those who oppose China susceptible to their attacks. Operationally, Genesis Day actors were observed communicating on two (2) Telegram channels which went dark after news of their South Korean attacks hit the media. Based on harvested logs from the channels, Genesis Day actors have claim to be responsible for a number of attacks on United States, Japan, South Korea, and Taiwan companies. In their most recent campaign, Genesis Day actors targeted education and research institutions websites with multiple web-defacement attacks around the time of the Lunar New Year. Twelve (12) websites in total were affected by these attacks, all of which were believed to have some sort of connection to the United States, Singapore, and Taiwan. In addition, Genesis Day also threatened to target over 2,000 international government entities, specifically mentioning the South Korean Ministry of Tourism, Culture, and Sports. CTIX analysts continue to monitor threat actor activity worldwide and will provide additional updates accordingly.