PoisonIvy
PoisonIvy is a remote access trojan that enables key logging, screen capturing, video capturing, file transfers, system administration, password theft, and traffic relaying.[1] It was created around 2005 by a Chinese hacker[2] and has been used in several prominent hacks, including a breach of the RSA SecurID authentication tool and the Nitro attacks on chemical companies, both in 2011.[3][4][5][6][7][8] Another name for the malware is "Backdoor.Darkmoon".[9]
References
[edit]- ↑ "POISON IVY: Assessing Damage and Extracting Intelligence" (PDF). FireEye. Archived from the original (PDF) on 15 Sep 2015. Retrieved March 11, 2021.
- ↑ Keizer, Gregg (31 October 2011). "'Nitro' hackers use stock malware to steal chemical, defense secrets". Computerworld. Archived from the original on 11 Aug 2020.
- ↑ "Poison Ivy NJCCIC Threat Profile". nj.gov. NJCCIC. April 12, 2017. Archived from the original on June 3, 2021. Retrieved March 11, 2021.
- ↑ Higgins, Kelly Jackson (21 August 2013). "Poison Ivy Trojan Just Won't Die". DARK Reading. Archived from the original on 5 Nov 2014. Retrieved 12 March 2021.
- ↑ Kirk, Jeremy (22 August 2013). "Poison Ivy Trojan used in RSA SecurID attack still popular". InfoWorld. Retrieved 12 March 2021.
- ↑ Mills, Elinor (5 April 2011). "Attack on RSA used zero-day Flash exploit in Excel". CNET. Archived from the original on 17 July 2011.
- ↑ "'Nitro attacks' continue". Virus Bulletin. 13 December 2011.
- ↑ Phneah, Ellyne (1 November 2011). "'Nitro' attack targets chemical firms". ZDNet.[dead link]
- ↑ Fisher, Dennis (30 August 2012). "Use of Java Zero-Day Flaws Tied to Nitro Attack Crew". threatpost. Archived from the original on 2 June 2021. Retrieved 7 April 2021.
 | This malware-related article is a stub. You can help Wikipedia by adding missing information. |