aol.pm

PoisonIvy

Software · ATTACK:enterprise:S0012

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:S0012",
  "title": "PoisonIvy",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0012",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--b42378e0-f147-496f-992a-26a49705395b",
  "external_id": "S0012",
  "domain": "enterprise",
  "created": "2017-05-31T21:32:15.263Z",
  "modified": "2024-11-17T19:55:07.591Z",
  "version": "2.2",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Poison Ivy"
    },
    {
      "source_name": "PoisonIvy"
    },
    {
      "source_name": "Breut"
    },
    {
      "source_name": "Darkmoon"
    },
    {
      "source_name": "FireEye Poison Ivy",
      "url": "https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf"
    },
    {
      "source_name": "Symantec Darkmoon Aug 2005",
      "url": "https://www.symantec.com/security_response/writeup.jsp?docid=2005-081910-3934-99"
    },
    {
      "source_name": "Novetta-Axiom",
      "url": "https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf"
    },
    {
      "source_name": "Symantec Elderwood Sept 2012",
      "url": "https://web.archive.org/web/20190717233006/http:/www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-elderwood-project.pdf"
    },
    {
      "source_name": "Symantec Darkmoon Sept 2014",
      "url": "https://www.symantec.com/connect/blogs/life-mars-how-attackers-took-advantage-hope-alien-existance-new-darkmoon-campaign"
    }
  ]
}

Explicit source assertions (30)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0066 → uses → ATTACK:enterprise:S0012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--003f23dd-24c7-4b3b-b703-0bf081d638f4

Symantec Elderwood Sept 2012

ATTACK:enterprise:S0012 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1888d04c-e3ba-47bc-adb3-ab8066678772

Symantec Darkmoon Aug 2005

ATTACK:enterprise:S0012 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--19161920-e6b5-481f-a240-62f05c624010

Symantec Darkmoon Aug 2005

ATTACK:enterprise:C0016 → uses → ATTACK:enterprise:S0012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1f07783f-cc60-4464-a0b2-154308d799c2

Cylance Dust Storm

ATTACK:enterprise:S0012 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--22879bfd-c9de-480b-83f3-4b58ef6dd08e

Symantec Darkmoon Aug 2005

ATTACK:enterprise:S0012 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27f8b192-9e86-49dc-abca-5bda3f8f7e89

Symantec Darkmoon Aug 2005

ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:S0012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f409bb6-2dc3-4e4b-901b-b177d4d03fd6

Mandiant Advanced Persistent Threats

ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:S0012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3b86d8fe-5677-4516-bf77-898e4da6171f

Cybereason Soft Cell June 2019 · Microsoft GALLIUM December 2019

ATTACK:enterprise:S0012 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3ef89472-470c-42c9-be01-155efe607b78

FireEye Poison Ivy · Symantec Darkmoon Aug 2005

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:S0012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--47545d87-b0ae-45ae-aeea-dc849eac2f6f

Mandiant APT1

ATTACK:enterprise:S0012 → uses → ATTACK:enterprise:T1547.014

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--64b25323-3b00-404f-afaa-cf1808ac5743

Microsoft PoisonIvy 2017 · paloalto Tropic Trooper 2016 · FireEye Regsvr32 Targeting Mongolian Gov

ATTACK:enterprise:G0018 → uses → ATTACK:enterprise:S0012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7b355dcf-9a9f-43b3-9989-128f5171b5c3

FireEye admin@338

ATTACK:enterprise:S0012 → uses → ATTACK:enterprise:T1480.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7b82ddb8-6a3a-4f0a-b463-7b20a9199647

FireEye Poison Ivy

ATTACK:enterprise:S0012 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7d020981-51b3-4ff6-825f-7cd192c934e1

FireEye Poison Ivy · Symantec Darkmoon Aug 2005

ATTACK:enterprise:S0012 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7d8e5c4d-afdb-43f9-bfcf-7ed674a516e3

Symantec Darkmoon Aug 2005

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:S0012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--831143c2-3477-49e4-8806-c1e07be0fa79

Unit 42 Tropic Trooper Nov 2016

ATTACK:enterprise:G0017 → uses → ATTACK:enterprise:S0012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8797579b-e3be-4209-a71b-255a4d08243d

Operation Quantum Entanglement

ATTACK:enterprise:G0011 → uses → ATTACK:enterprise:S0012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8d65162b-650d-4a38-9c19-cc6c8e85a2e9

Villeneuve 2014

ATTACK:enterprise:G0136 → uses → ATTACK:enterprise:S0012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8e1cc8cd-8344-4ba4-9d61-05e63b54bc6b

Securelist APT Trends Q2 2017

ATTACK:enterprise:S0012 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--962db69e-efe1-4e5f-b845-99294ace5eb0

Symantec Darkmoon Aug 2005

ATTACK:enterprise:G0001 → uses → ATTACK:enterprise:S0012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--abe1a402-9ad5-43d0-9e5d-cabe4269fc06

Cisco Group 72 · Novetta-Axiom

ATTACK:enterprise:S0012 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ae7b632b-bb15-4807-be21-bdfff70f4f2e

Symantec Darkmoon Aug 2005

ATTACK:enterprise:S0012 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b41c9b77-536b-49bc-8cb9-a873aa121002

FireEye Poison Ivy

ATTACK:enterprise:G0045 → uses → ATTACK:enterprise:S0012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bab6aadc-7a93-43e4-88cb-904fd1f2fddd

PWC Cloud Hopper Technical Annex April 2017 · District Court of NY APT10 Indictment December 2018

ATTACK:enterprise:S0012 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c011e80b-7b86-405a-8d41-745bd37a0d10

Symantec Darkmoon Aug 2005

ATTACK:enterprise:G0002 → uses → ATTACK:enterprise:S0012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d6e40826-7af0-4e4e-96c3-28493abda6c7

Haq 2014

ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:S0012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d6fb17bf-df52-4eff-b669-c5b77c13e26c

Eset PlugX Korplug Mustang Panda March 2022 · Recorded Future REDDELTA July 2020 · Crowdstrike MUSTANG PANDA June 2018

ATTACK:enterprise:S0012 → uses → ATTACK:enterprise:T1010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f436f533-1116-499f-b073-9cc7698e18b0

Symantec Darkmoon Aug 2005

ATTACK:enterprise:S0012 → uses → ATTACK:enterprise:T1014

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f8340d49-ee7a-4ade-988f-3660904a18bb

Symantec Darkmoon Aug 2005

ATTACK:enterprise:G0021 → uses → ATTACK:enterprise:S0012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fad44d26-02a8-4cdc-b566-5e24f32a93b3

DustySky2 · DustySky · FireEye Operation Molerats

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.