santiago silver - Fotolia
FireEye researchers found a Poison Ivy RAT campaign using new social engineering, evasion and distribution techniques to spread the malware, which is capable of key logging, password theft, and taking screen and video captures. What new attack and delivery methods should enterprises should be on the lookout for with this remote access Trojan?
Every victim of a successful attack wants to think that the most sophisticated techniques were used to compromise the security of their systems. The truth is sometimes vulnerabilities remain on systems for long periods of time and known security recommendations are not used for many different reasons, resulting in attackers gaining easy access to systems.
This isn't to say the attack was the victim's fault -- this is just the sad state of information security. While there have been many security changes with mobile devices and advancements made with desktops, many times, an attacker can just buy a zero-day exploit to achieve their goals.
FireEye researchers wrote about an attack using the Poison Ivy RAT, where a phishing email is used to get the victim to open a malicious Word document and execute a macro. The emails were targeted at individuals working in the Mongolian government and claimed the documents contained webmail login instructions or information on a state law proposal.
The macro used a PowerShell script that downloads malware from the internet, along with decoy documents to divert the victim's attention. The script writes its data to the registry, taking advantage of a vulnerability in AppLocker by using regsvr32.exe to install fileless malware on the endpoint.
Since PowerShell came out over 10 years ago, some thought it would be used for malware-based attacks. Microsoft has recommendations for stopping malicious PowerShell scripts that can be used to address attacks like this. Enterprises should also have policies or plans to defend themselves and their individual users against phishing attacks like the one used to spread this RAT.
Learn how a remote access Trojan like GlassRAT remains undetected
Find out how the Trochilus RAT evades sandboxing to conduct cyberespionage
Read about how to handle phishing attempts on your employees
Dig Deeper on Malware, virus, Trojan and spyware protection and removal
Related Q&A from Nick Lewis
A flaw was found in the Android installer for Fortnite and was patched within 24 hours. Learn how such a quick turnaround affects mobile app security... Continue Reading
Credential stuffing attacks can put companies that offer online membership programs, as well as their customers, at risk. Find out how to proactively... Continue Reading
A Mozilla vulnerability duplicated in the Browser Reaper set of DoS proofs of concept caused Chrome, Firefox and Safari to crash. Learn why and how ... Continue Reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.