santiago silver - Fotolia
FireEye researchers found a Poison Ivy RAT campaign using new social engineering, evasion and distribution techniques to spread the malware, which is capable of key logging, password theft, and taking screen and video captures. What new attack and delivery methods should enterprises should be on the lookout for with this remote access Trojan?
Every victim of a successful attack wants to think that the most sophisticated techniques were used to compromise the security of their systems. The truth is sometimes vulnerabilities remain on systems for long periods of time and known security recommendations are not used for many different reasons, resulting in attackers gaining easy access to systems.
This isn't to say the attack was the victim's fault -- this is just the sad state of information security. While there have been many security changes with mobile devices and advancements made with desktops, many times, an attacker can just buy a zero-day exploit to achieve their goals.
FireEye researchers wrote about an attack using the Poison Ivy RAT, where a phishing email is used to get the victim to open a malicious Word document and execute a macro. The emails were targeted at individuals working in the Mongolian government and claimed the documents contained webmail login instructions or information on a state law proposal.
The macro used a PowerShell script that downloads malware from the internet, along with decoy documents to divert the victim's attention. The script writes its data to the registry, taking advantage of a vulnerability in AppLocker by using regsvr32.exe to install fileless malware on the endpoint.
Since PowerShell came out over 10 years ago, some thought it would be used for malware-based attacks. Microsoft has recommendations for stopping malicious PowerShell scripts that can be used to address attacks like this. Enterprises should also have policies or plans to defend themselves and their individual users against phishing attacks like the one used to spread this RAT.
Learn how a remote access Trojan like GlassRAT remains undetected
Find out how the Trochilus RAT evades sandboxing to conduct cyberespionage
Read about how to handle phishing attempts on your employees
Dig Deeper on Malware, virus, Trojan and spyware protection and removal
Related Q&A from Nick Lewis
Cloud penetration testing presents new challenges for information security teams. Here's how a playbook from the Cloud Security Alliance can help ... Continue Reading
Many cloud providers are tight-lipped about internal security control details. Learn how to evaluate cloud security providers with certifications and... Continue Reading
Enterprises new to the cloud can write new security policies from scratch, but others with broad cloud usage may need an update. Consider these ... Continue Reading