santiago silver - Fotolia
FireEye researchers found a Poison Ivy RAT campaign using new social engineering, evasion and distribution techniques to spread the malware, which is capable of key logging, password theft, and taking screen and video captures. What new attack and delivery methods should enterprises should be on the lookout for with this remote access Trojan?
Every victim of a successful attack wants to think that the most sophisticated techniques were used to compromise the security of their systems. The truth is sometimes vulnerabilities remain on systems for long periods of time and known security recommendations are not used for many different reasons, resulting in attackers gaining easy access to systems.
This isn't to say the attack was the victim's fault -- this is just the sad state of information security. While there have been many security changes with mobile devices and advancements made with desktops, many times, an attacker can just buy a zero-day exploit to achieve their goals.
FireEye researchers wrote about an attack using the Poison Ivy RAT, where a phishing email is used to get the victim to open a malicious Word document and execute a macro. The emails were targeted at individuals working in the Mongolian government and claimed the documents contained webmail login instructions or information on a state law proposal.
The macro used a PowerShell script that downloads malware from the internet, along with decoy documents to divert the victim's attention. The script writes its data to the registry, taking advantage of a vulnerability in AppLocker by using regsvr32.exe to install fileless malware on the endpoint.
Since PowerShell came out over 10 years ago, some thought it would be used for malware-based attacks. Microsoft has recommendations for stopping malicious PowerShell scripts that can be used to address attacks like this. Enterprises should also have policies or plans to defend themselves and their individual users against phishing attacks like the one used to spread this RAT.
Learn how a remote access Trojan like GlassRAT remains undetected
Find out how the Trochilus RAT evades sandboxing to conduct cyberespionage
Read about how to handle phishing attempts on your employees
Dig Deeper on Malware, virus, Trojan and spyware protection and removal
Related Q&A from Nick Lewis
Cisco Talos' Thanatos ransomware decryptor can recover files affected by new ransomware that won't decrypt ransomed files even when a ransom has been... Continue Reading
A phishing campaign targeting Trezor wallets may have poisoned DNS or hijacked BGP to gain access. Learn how the attack worked and how to mitigate it... Continue Reading
Okta researchers found a bypass that allows macOS malware to pose as signed Apple files. Discover how this is possible and how to mitigate this ... Continue Reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.