Stealing data from ~50 companies with PoisonIvy trojan?!

[p0et]

Talk about an old trojan...  Can't believe this easily detected old trojan got through all of the ~50 companies defenses (if they had any)

http://www.eweek.com/c/a/Security/Nitro-CyberSpying-Campaign-Stole-Data-From-Chemical-Defense-Companies-863610/

[pseud0]

I'll comment on it since I spent the better part of 4 months working on the issue:

-First, Symantec's timeline is wrong.  I know of at least two very large chemical companies that were hit as early as August last year. Same MO.  Same emails. Same malware. Same targeted data.

-Second, yes, PoinsonIvy, but a highly modified one.  We recovered original versions of it and it was modified enough from the original form that AV and IDS didn't pick it up. VirusTotal only had 2 products that flagged it.  It was also VM aware as we couldn't get the emails to dump the payload in our vmworkstations.  We actually had to have the client put one of their images on a laptop in order to get the malware samples.

-Third, the attackers were persistent.  Every time they were pushed out of the environment they'd use information they'd gathered to find a new way back in.  Note to admins: don't be cute and use the same password for web apps and remote access as you do for AD and systems. 

[p0et]

Whoa!  That's quite a bit more advanced than it initially reads (just mentioning the PoisonIvy rat).  Man, I'd love to get my hands on their modified version and have a look.  Sounds like they did a good job of modifying it.

I'm jealous.. I'd love to have your job if it involves working with issues such as this one! 

[pseud0]

I've got a sample of it on a usb drive in the lab.  It has a ball of duct tape the size of a soft ball wrapped around the body of it with skulls drawn on it because every time someone wanted to move files they'd grab that drive every time. We'd have 50 usb drives sitting on the table and this one would be hidden under a box and still someone would find it and stick it in their laptop.

[eth3real]

I've heard about this. I believe this is the same attack that breached the RSA earlier this year.

http://blogs.rsa.com/rivner/anatomy-of-an-attack/

[p0et]

Wow!  I heard all about the RSA breach but I guess I forgot or didn't see that it was also Poison Ivy... man that trojan gets around.