PoisonIvy
Associated Software Descriptions
Name | Description |
---|---|
Poison Ivy | |
Darkmoon |
Techniques Used
Domain | ID | Name | Use | |
---|---|---|---|---|
Enterprise | T1010 | Application Window Discovery | ||
Enterprise | T1547 | .001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
PoisonIvy creates run key Registry entries pointing to a malicious executable dropped to disk.[3] |
Enterprise | T1059 | .003 | Command and Scripting Interpreter: Windows Command Shell |
PoisonIvy creates a backdoor through which remote attackers can open a command-line interface.[3] |
Enterprise | T1543 | .003 | Create or Modify System Process: Windows Service |
PoisonIvy creates a Registry subkey that registers a new service. PoisonIvy also creates a Registry entry modifying the Logical Disk Manager service to point to a malicious DLL dropped to disk.[3] |
Enterprise | T1005 | Data from Local System |
PoisonIvy creates a backdoor through which remote attackers can steal system information.[3] |
|
Enterprise | T1074 | .001 | Data Staged: Local Data Staging | |
Enterprise | T1573 | .001 | Encrypted Channel: Symmetric Cryptography |
PoisonIvy uses the Camellia cipher to encrypt communications.[1] |
Enterprise | T1105 | Ingress Tool Transfer |
PoisonIvy creates a backdoor through which remote attackers can upload files.[3] |
|
Enterprise | T1056 | .001 | Input Capture: Keylogging | |
Enterprise | T1112 | Modify Registry |
PoisonIvy creates a Registry subkey that registers a new system device.[3] |
|
Enterprise | T1027 | Obfuscated Files or Information |
PoisonIvy hides any strings related to its own indicators of compromise.[3] |
|
Enterprise | T1055 | .001 | Process Injection: Dynamic-link Library Injection | |
Enterprise | T1014 | Rootkit |
PoisonIvy starts a rootkit from a malicious file dropped to disk.[3] |
Groups That Use This Software
ID | Name | References |
---|---|---|
G0017 | DragonOK | |
G0018 | admin@338 | |
G0045 | menuPass | |
G0011 | PittyTiger | |
G0002 | Moafee | |
G0081 | Tropic Trooper | |
G0066 | Elderwood | |
G0021 | Molerats | |
G0006 | APT1 | |
G0093 | Soft Cell |
References
- FireEye. (2014). POISON IVY: Assessing Damage and Extracting Intelligence. Retrieved November 12, 2014.
- O'Gorman, G., and McDonald, G.. (2012, September 6). The Elderwood Project. Retrieved February 15, 2018.
- Hayashi, K. (2005, August 18). Backdoor.Darkmoon. Retrieved February 23, 2018.
- Payet, L. (2014, September 19). Life on Mars: How attackers took advantage of hope for alien existance in new Darkmoon campaign. Retrieved September 13, 2018.
- Haq, T., Moran, N., Vashisht, S., Scott, M. (2014, September). OPERATION QUANTUM ENTANGLEMENT. Retrieved November 4, 2015.
- FireEye Threat Intelligence. (2015, December 1). China-based Cyber Threat Group Uses Dropbox for Malware Communications and Targets Hong Kong Media Outlets. Retrieved December 4, 2015.
- PwC and BAE Systems. (2017, April). Operation Cloud Hopper: Technical Annex. Retrieved April 13, 2017.
- United States District Court Southern District of New York (USDC SDNY) . (2018, December 17). United States of America v. Zhu Hua and Zhang Shilong. Retrieved April 17, 2019.
- Villeneuve, N., Homan, J. (2014, July 31). Spy of the Tiger. Retrieved September 29, 2015.
- Haq, T., Moran, N., Scott, M., & Vashisht, S. O. (2014, September 10). The Path to Mass-Producing Cyber Attacks [Blog]. Retrieved November 12, 2014.
- Ray, V. (2016, November 22). Tropic Trooper Targets Taiwanese Government and Fossil Fuel Provider With Poison Ivy. Retrieved November 9, 2018.
- ClearSky. (2016, January 7). Operation DustySky. Retrieved January 8, 2016.
- ClearSky Cybersecurity. (2016, June 9). Operation DustySky - Part 2. Retrieved August 3, 2016.
- Villeneuve, N., Haq, H., Moran, N. (2013, August 23). OPERATION MOLERATS: MIDDLE EAST CYBER ATTACKS USING POISON IVY. Retrieved April 1, 2016.
- Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016.
- Cybereason Nocturnus. (2019, June 25). Operation Soft Cell: A Worldwide Campaign Against Telecommunications Providers. Retrieved July 18, 2019.