Stealing data from ~50 companies with PoisonIvy trojan?!

Viewing 5 reply threads
  • Author
    Posts
    • #6990
      p0et
      Participant

      Talk about an old trojan…  Can’t believe this easily detected old trojan got through all of the ~50 companies defenses (if they had any)

      http://www.eweek.com/c/a/Security/Nitro-CyberSpying-Campaign-Stole-Data-From-Chemical-Defense-Companies-863610/

    • #43456
      pseud0
      Participant

      I’ll comment on it since I spent the better part of 4 months working on the issue:

      -First, Symantec’s timeline is wrong.  I know of at least two very large chemical companies that were hit as early as August last year. Same MO.  Same emails. Same malware. Same targeted data.

      -Second, yes, PoinsonIvy, but a highly modified one.  We recovered original versions of it and it was modified enough from the original form that AV and IDS didn’t pick it up. VirusTotal only had 2 products that flagged it.  It was also VM aware as we couldn’t get the emails to dump the payload in our vmworkstations.  We actually had to have the client put one of their images on a laptop in order to get the malware samples.

      -Third, the attackers were persistent.  Every time they were pushed out of the environment they’d use information they’d gathered to find a new way back in.  Note to admins: don’t be cute and use the same password for web apps and remote access as you do for AD and systems. 

    • #43457
      p0et
      Participant

      Whoa!  That’s quite a bit more advanced than it initially reads (just mentioning the PoisonIvy rat).  Man, I’d love to get my hands on their modified version and have a look.  Sounds like they did a good job of modifying it.

      I’m jealous.. I’d love to have your job if it involves working with issues such as this one!  🙂

    • #43458
      pseud0
      Participant

      I’ve got a sample of it on a usb drive in the lab.  It has a ball of duct tape the size of a soft ball wrapped around the body of it with skulls drawn on it because every time someone wanted to move files they’d grab that drive every time. We’d have 50 usb drives sitting on the table and this one would be hidden under a box and still someone would find it and stick it in their laptop.

    • #43459
      eth3real
      Participant

      I’ve heard about this. I believe this is the same attack that breached the RSA earlier this year.

      http://blogs.rsa.com/rivner/anatomy-of-an-attack/

    • #43460
      p0et
      Participant

      Wow!  I heard all about the RSA breach but I guess I forgot or didn’t see that it was also Poison Ivy… man that trojan gets around.  😉

Viewing 5 reply threads
  • You must be logged in to reply to this topic.

Copyright ©2021 Caendra, Inc.

Contact Us

Thoughts, suggestions, issues? Send us an email, and we'll get back to you.

Sending

Sign in with Caendra

Forgot password?Sign up

Forgot your details?