Poison Ivy RAT becoming the AK-47 of cyber-espionage attacks

Just because it's simple to use doesn't mean the user is low-rent


The Poison Ivy Remote Access Tool (RAT) - often considered a tool for novice "script kiddies" - has become a ubiquitous feature of cyber-espionage campaigns, according to experts.

Research by malware protection firm FireEye has revealed that the tool served as lynchpin of many sophisticated cyber attacks, including the compromise of RSA SecurID data in 2011 and the "Nitro" assault against chemical makers, government offices, defence firms and human-rights groups last year.

A Peeping Tom webcam sextortionist has been jailed for six years in the US after targeting several young women in attacks that relied on a modified version of Poison Ivy, an incident which shows that the tool has malign uses beyond cyber-espionage.

Poison Ivy remains popular and effective eight years after its original release. FireEye has compiled a list of nation state-type attackers making use of the utility. These include a group called admin@338, which specialises in attacks targeting the financial services industry; th3bug, who have been hammering universities and healthcare facilities since 2009, and menuPass, a group that has run cyberespionage attacks against defence contractors over the last four years.

Poison Ivy is the preferred RAT of several threat actors located in China. Over recent months other attackers elsewhere in the world have begun adopting the same methodology.

A campaign by a Middle East hacking group called “Molerats” (AKA Gaza Hackers Team) switched during June and July to using Poison Ivy to attack Israeli government targets. The latest malware was signed with a fake Microsoft certificate, similar to earlier attacks using the XtremeRat trojan.

FireEye has also intercepted Egyptian- and Middle Eastern-themed attacks using decoy content in Arabic whose targets remain uncertain but may include targets in the Palestinian authority.

"The cyber attacks against Israeli and Palestinian targets that were first documented last year are ongoing," FireEye concludes. "The attackers, which we have called 'Molerats', have also targeted government entities in the UK and in the US. In addition to using XtremeRAT, which is popular among Middle Eastern attackers, we have found that Molerats have adopted the use of Poison Ivy RAT, which is traditionally favoured by Chinese attackers."

"We do not know if this is an intentional attempt by MoleRats to deflect attribution to China-based threat actors, or if they have simply added another, effective, publicly-available RAT to their arsenal. However, this development should raise a warning flag for those who attribute all Poison Ivy attacks to threat actors based in China. The ubiquity of off-the-shelf RATs makes determining positive attribution an increasing challenge," it adds.

More details on the Molerats' cyber-espionage campaign can be found in a blog post, featuring diagrams, screen shots and charts, and put together by three FireEye researchers (Nart Villeneuve, Ned Moran and Thoufique Haq) here.

"You can download the default version of Poison Ivy from poisonivy-rat.com," explained FireEye's Ned Moran. "However, each of these groups are using a custom version of Poison Ivy. We do not believe these specific custom versions are available for sale."

RATs such as Poison Ivy require little technical savvy while offering unfettered access to compromised machines, hence their use by even well resourced professional cyber-ninja types. It can be considered as the easy to use front end of attacks that might be actually quite sophisticated when viewed as a whole.

"They [RATs] are often delivered as a key component of coordinated attacks that use previously unknown (zero-day) software flaws and clever social engineering," explained Darien Kindlund, manager of threat intelligence at FireEye in a blog post. "Attackers can point and click their way through the target’s network to steal data and intellectual property," using tools such as Poison Ivy, he added.

FireEye released its a white paper on its research into the hacker tool along with Calamine, a set of free tools to help organisations to detect possible Poison Ivy infections. ®

Similar topics

Broader topics


Other stories you might like

  • Techniques to fool AI with hidden triggers are outpacing defenses – study
    Here's how to catch up with those poisoning machine-learning systems

    The increasingly wide use of deep neural networks (DNNs) for such computer vision tasks as facial recognition, medical imaging, object detection, and autonomous driving is going to, if not already, catch the attention of cybercriminals.

    DNNs have become foundational to deep learning and to the larger field of artificial intelligence (AI). They're a multi-layered class of machine learning algorithms that essentially try to mimic how a human brain works and are becoming more popular in developing modern applications.

    That use is expected to increase rapidly in the coming years. According to analysts with Emergen Research, the worldwide market for DNN technology will grow from $1.26bn in 2019 to $5.98bn by 2027, with demand in such industries as healthcare, banking, financial services and insurance surging.

    Continue reading
  • Skyhigh Security rises from McAfee-FireEye’s SSE
    CEO chats to us about zero trust, data protection, and more

    Skyhigh Security, formed from the Secure Service Edge (SSE) pieces of McAfee Enterprise and FireEye, today announced its name and data-guarding portfolio. 

    CEO Gee Rittenhouse, who led McAfee Enterprise Cloud and is a former Cisco security executive, said Skyhigh aims to shift practitioners' focus from granting or blocking network access to resources, to fine-grain monitoring and protection of applications and data even after people have logged in.

    Instead of simply securing access to an application, Skyhigh examines what people and machines do with the software, and how they use information with in once their identity has been verified and access granted, Rittenhouse said.

    Continue reading
  • ‘Precursor malware’ infection may be sign you're about to get ransomware, says startup
    As more and more biz pays up to restore data, we're told

    Ransomware is among the most feared of the myriad cyberthreats circulating today, putting critical data at risk and costing some enterprises tens of millions of dollars in damage and ransoms paid. However, ransomware doesn't occur in a vacuum, according to security startup Lumu Technologies.

    A ransomware infection is usually preceded by what Lumu founder and CEO Ricardo Villadiego calls "precursor malware," essentially reconnaissance malicious code that has been around for a while and which lays the groundwork for the full ransomware campaign to come. Find and remediate that precursor malware and a company can ward off the ransomware attack is the theory.

    "The moment you see your network – and by network, I mean the network defined the modern times, whatever you have on premises, whatever is out in the clouds, whatever you have with your remote users – when you see any assets from your network contacting an adversarial infrastructure, eliminate that contact because that puts you in your zone of maximum resistance to attacks," Villadiego told The Register.

    Continue reading

Biting the hand that feeds IT © 1998–2022