LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0012: PoisonIvy

PoisonIvy is a popular remote access tool (RAT) that has been used by many groups.[1][2][3]

EnterpriseS0012MalwareObject v2.2Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

PoisonIvy is a Windows remote access tool identified by ATT&CK as widely used by many groups. Its business significance is not the name alone; it represents a mature RAT capability set that can support hands-on intrusion activity, including command execution, credential collection through keylogging, local data discovery and staging, tool transfer, obfuscation, DLL injection, and rootkit-style hiding. Leaders should treat coverage for PoisonIvy-like behavior as a test of whether Windows endpoint, identity, SOC, and incident response programs can see and contain an interactive compromise rather than only block known malware files.

Executive priority

Prioritize this as a resilience and evidence question: can the organization prove it collects and reviews the Windows endpoint, command execution, file activity, credential-access, and network-transfer evidence needed to investigate a RAT intrusion? ATT&CK relationships connect PoisonIvy to multiple espionage groups and Operation Dust Storm, so intelligence teams may use it for threat-informed prioritization; however, those relationships should not be interpreted as proof of current targeting or exposure. For budget and control planning, focus on closing blind spots around endpoint visibility, privileged account monitoring, data staging detection, and IR readiness for remote-access malware.

Technical view

For SOC and detection engineering, validate behavior coverage against the ATT&CK techniques linked to PoisonIvy: Data from Local System, Application Window Discovery, Rootkit, Obfuscated Files or Information, DLL Injection, Keylogging, Windows Command Shell, Local Data Staging, and Ingress Tool Transfer. Because the object’s platform is Windows and ATT&CK provides no official detection text, detection should be built from local telemetry: suspicious cmd.exe activity, abnormal process injection indicators, unexpected DLL loads, unusual file collection or staging patterns, keylogging-like input capture indicators where available, hidden or tampered services/drivers, and inbound tool transfer over command-and-control channels. Incident responders should be prepared to scope beyond the initial host because a RAT with tool-transfer and data-staging behaviors can indicate broader operator access.

Likely telemetry

  • Windows endpoint process creation and command-line events, especially cmd.exe execution patterns
  • Endpoint file creation, modification, access, and staging-directory activity
  • DLL load, memory, process injection, and cross-process access telemetry
  • Security product, driver, service, and kernel-level integrity signals relevant to rootkit-style hiding
  • Keyboard/input monitoring indicators where endpoint tooling supports them

Detection direction

  • Do not rely only on signatures for the PoisonIvy name; validate behavior analytics mapped to the related ATT&CK techniques.
  • Tune Windows command-shell detections to distinguish administrative scripts from unusual remote or malware-driven execution.
  • Correlate data discovery, local staging, and outbound or ingress file-transfer events instead of treating each as isolated low-severity activity.
  • Review process injection and DLL injection detections for both coverage and false positives from legitimate software that injects into other processes.
  • Assess whether endpoint controls can surface tampering, hidden components, or rootkit-like activity; absence of visibility here is a material blind spot.

Mitigation priorities

  • Ensure broad Windows endpoint visibility and retention before relying on advanced detections.
  • Harden and monitor privileged and high-value workstations where keylogging or command execution would create disproportionate business risk.
  • Limit unnecessary command-shell, scripting, and file-transfer paths through least privilege and administrative control review.
  • Apply application control and execution prevention where operationally feasible to reduce unauthorized RAT and tool execution.
  • Strengthen credential protections and monitoring because the linked behaviors include keylogging and credential-access activity.
Additional notes and limits

ATT&CK describes PoisonIvy as a popular RAT used by many groups and provides relationships to several groups and one campaign, plus technique relationships that define the defensive validation scope. Darkmoon S0209 is revoked by this object, so historical references may appear under either naming lineage. The strongest practical use of this object is as a control-validation bundle for Windows RAT behavior rather than a single malware signature.

The supplied ATT&CK object has no official detection guidance, no object-level tactics, no aliases listed, and only Windows as the malware platform. Related technique descriptions include platforms beyond Windows, but those should not expand the assessed PoisonIvy platform without additional evidence. Local environment logs, asset criticality, and confirmed telemetry coverage are required to determine actual detection readiness or exposure.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

PoisonIvy

PoisonIvy is a popular remote access tool (RAT) that has been used by many groups.[1][2][3]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

15 rows
DomainIDNameRelationship / procedure
EnterpriseT1543.003Windows ServiceSub-technique

PoisonIvy creates a Registry subkey that registers a new service. PoisonIvy also creates a Registry entry modifying the Logical Disk Manager service to point to a malicious DLL dropped to disk.[3]

EnterpriseT1112Modify Registry

PoisonIvy creates a Registry subkey that registers a new system device.[3]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

PoisonIvy creates run key Registry entries pointing to a malicious executable dropped to disk.[3]

EnterpriseT1027Obfuscated Files or Information

PoisonIvy hides any strings related to its own indicators of compromise.[3]

EnterpriseT1056.001KeyloggingSub-technique

PoisonIvy contains a keylogger.[1][3]

EnterpriseT1547.014Active SetupSub-technique

PoisonIvy creates a Registry key in the Active Setup pointing to a malicious executable.[9][10][11]

EnterpriseT1480.002Mutual ExclusionSub-technique

PoisonIvy creates a mutex using either a custom or default value.[1]

EnterpriseT1055.001Dynamic-link Library InjectionSub-technique

PoisonIvy can inject a malicious DLL into a process.[1][3]

EnterpriseT1074.001Local Data StagingSub-technique

PoisonIvy stages collected data in a text file.[3]

EnterpriseT1059.003Windows Command ShellSub-technique

PoisonIvy creates a backdoor through which remote attackers can open a command-line interface.[3]

EnterpriseT1105Ingress Tool Transfer

PoisonIvy creates a backdoor through which remote attackers can upload files.[3]

EnterpriseT1573.001Symmetric CryptographySub-technique

PoisonIvy uses the Camellia cipher to encrypt communications.[1]

EnterpriseT1005Data from Local System

PoisonIvy creates a backdoor through which remote attackers can steal system information.[3]

EnterpriseT1010Application Window Discovery

PoisonIvy captures window titles.[3]

EnterpriseT1014Rootkit

PoisonIvy starts a rootkit from a malicious file dropped to disk.[3]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0066: Elderwood

Elderwood is a suspected Chinese cyber espionage group that was reportedly responsible for the 2009 Google intrusion known as Operation Aurora. [1] The group has targeted defense organizations, supply chain manufacturers, human rights and nongovernmental organizations (NGOs), and IT service providers. [2] [3]

GroupEnterprise

G1023: APT5

APT5 is a China-based espionage actor that has been active since at least 2007 primarily targeting the telecommunications, aerospace, and defense industries throughout the U.S., Europe, and Asia. APT5 has displayed advanced tradecraft and significant interest in compromising networking devices and their underlying software including through the use of zero-day exploits.[1][2][3][4][5][6]

GroupEnterprise

G0093: GALLIUM

GALLIUM is a cyberespionage group that has been active since at least 2012, primarily targeting telecommunications companies, financial institutions, and government entities in Afghanistan, Australia, Belgium, Cambodia, Malaysia, Mozambique, the Philippines, Russia, and Vietnam. This group is particularly known for launching Operation Soft Cell, a long-term campaign targeting telecommunications providers.[1] Security researchers have identified GALLIUM as a likely Chinese state-sponsored group, based in part on tools used and TTPs commonly associated with Chinese threat actors.[1][2][3]

GroupEnterprise

G0006: APT1

APT1 is a Chinese threat group that has been attributed to the 2nd Bureau of the People’s Liberation Army (PLA) General Staff Department’s (GSD) 3rd Department, commonly known by its Military Unit Cover Designator (MUCD) as Unit 61398. [1]

GroupEnterprise

G0018: admin@338

admin@338 is a China-based cyber threat group. It has previously used newsworthy events as lures to deliver malware and has primarily targeted organizations involved in financial, economic, and trade policy, typically using publicly available RATs such as PoisonIvy, as well as some non-public backdoors. [1]

GroupEnterprise

G0081: Tropic Trooper

Tropic Trooper is an unaffiliated threat group that has led targeted campaigns against targets in Taiwan, the Philippines, and Hong Kong. Tropic Trooper focuses on targeting government, healthcare, transportation, and high-tech industries and has been active since 2011.[1][2][3]

GroupEnterprise

G0017: DragonOK

DragonOK is a threat group that has targeted Japanese organizations with phishing emails. Due to overlapping TTPs, including similar custom tools, DragonOK is thought to have a direct or indirect relationship with the threat group Moafee. [1] It is known to use a variety of malware, including Sysget/HelloBridge, PlugX, PoisonIvy, FormerFirstRat, NFlog, and NewCT. [2]

GroupEnterprise

G0001: Axiom

Axiom is a suspected Chinese cyber espionage group that has targeted the aerospace, defense, government, manufacturing, and media sectors since at least 2008. Some reporting suggests a degree of overlap between Axiom and Winnti Group but the two groups appear to be distinct based on differences in reporting on TTPs and targeting.[1][2][3]

GroupEnterprise

G0045: menuPass

menuPass is a threat group that has been active since at least 2006. Individual members of menuPass are known to have acted in association with the Chinese Ministry of State Security's (MSS) Tianjin State Security Bureau and worked for the Huaying Haitai Science and Technology Development Company.[1][2]

menuPass has targeted healthcare, defense, aerospace, finance, maritime, biotechnology, energy, and government sectors globally, with an emphasis on Japanese organizations. In 2016 and 2017, the group is known to have targeted managed IT service providers (MSPs), manufacturing and mining companies, and a university.[3][4][5][6][7][1][2]

GroupEnterprise

G0002: Moafee

Moafee is a threat group that appears to operate from the Guandong Province of China. Due to overlapping TTPs, including similar custom tools, Moafee is thought to have a direct or indirect relationship with the threat group DragonOK. [1]

MalwareEnterprise

S0209: Darkmoon

Official MITRE ATT&CK object mirrored from source data.

Revoked/deprecated
CampaignEnterprise

C0016: Operation Dust Storm

Operation Dust Storm was a long-standing persistent cyber espionage campaign that targeted multiple industries in Japan, South Korea, the United States, Europe, and several Southeast Asian countries. By 2015, the Operation Dust Storm threat actors shifted from government and defense-related intelligence targets to Japanese companies or Japanese subdivisions of larger foreign organizations supporting Japan's critical infrastructure, including electricity generation, oil and natural gas, finance, transportation, and construction.[1]

Operation Dust Storm threat actors also began to use Android backdoors in their operations by 2015, with all identified victims at the time residing in Japan or South Korea.[1]

Relationship explorer

All related ATT&CK context

uses · GroupG0066: ElderwoodEnterpriseuses · TechniqueT1543.003: Windows ServiceEnterpriseuses · TechniqueT1112: Modify RegistryEnterpriseuses · CampaignC0016: Operation Dust StormEnterpriseuses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · TechniqueT1027: Obfuscated Files or InformationEnterpriseuses · GroupG1023: APT5Enterpriseuses · GroupG0093: GALLIUMEnterpriseuses · TechniqueT1056.001: KeyloggingEnterpriseuses · GroupG0006: APT1Enterpriseuses · TechniqueT1547.014: Active SetupEnterpriseuses · GroupG0018: admin@338Enterpriseuses · TechniqueT1480.002: Mutual ExclusionEnterpriseuses · TechniqueT1055.001: Dynamic-link Library InjectionEnterpriseuses · TechniqueT1074.001: Local Data StagingEnterpriseuses · GroupG0081: Tropic TrooperEnterpriserevoked by · MalwareS0209: DarkmoonEnterpriseuses · GroupG0017: DragonOKEnterpriseuses · GroupG0011: PittyTigerEnterpriseuses · GroupG0136: IndigoZebraEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · GroupG0001: AxiomEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1573.001: Symmetric CryptographyEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
2.2
Created
Modified
Raw hash
4ed53268fb335bb5...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.12.2Current bundle4ed53268fb33…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    FireEye Poison Ivy

    FireEye. (2014). POISON IVY: Assessing Damage and Extracting Intelligence. Retrieved September 19, 2024.

    Open source URL
  2. [2]
    Symantec Elderwood Sept 2012

    O'Gorman, G., and McDonald, G.. (2012, September 6). The Elderwood Project. Retrieved November 17, 2024.

    Open source URL
  3. [3]
    Symantec Darkmoon Aug 2005

    Hayashi, K. (2005, August 18). Backdoor.Darkmoon. Retrieved February 23, 2018.

    Open source URL
  4. [4]
    Cylance Dust Storm

    Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.

    Open source URL
  5. [5]
    Mandiant Advanced Persistent Threats

    Mandiant. (n.d.). Advanced Persistent Threats (APTs). Retrieved February 14, 2024.

    Open source URL
  6. [6]
    Cybereason Soft Cell June 2019

    Cybereason Nocturnus. (2019, June 25). Operation Soft Cell: A Worldwide Campaign Against Telecommunications Providers. Retrieved July 18, 2019.

    Open source URL
  7. [7]
    Microsoft GALLIUM December 2019

    MSTIC. (2019, December 12). GALLIUM: Targeting global telecom. Retrieved January 13, 2021.

    Open source URL
  8. [8]
    Mandiant APT1

    Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016.

    Open source URL
  9. [9]
    Microsoft PoisonIvy 2017

    McCormack, M. (2017, September 15). Backdoor:Win32/Poisonivy.E. Retrieved December 21, 2020.

    Open source URL
  10. [10]
    paloalto Tropic Trooper 2016

    Ray, V., et al. (2016, November 22). Tropic Trooper Targets Taiwanese Government and Fossil Fuel Provider With Poison Ivy. Retrieved December 18, 2020.

    Open source URL
  11. [11]
    FireEye Regsvr32 Targeting Mongolian Gov

    Anubhav, A., Kizhakkinan, D. (2017, February 22). Spear Phishing Techniques Used in Attacks Targeting the Mongolian Government. Retrieved February 24, 2017.

    Open source URL
  12. [12]
    FireEye admin@338

    FireEye Threat Intelligence. (2015, December 1). China-based Cyber Threat Group Uses Dropbox for Malware Communications and Targets Hong Kong Media Outlets. Retrieved December 4, 2015.

    Open source URL
  13. [13]
    Unit 42 Tropic Trooper Nov 2016

    Ray, V. (2016, November 22). Tropic Trooper Targets Taiwanese Government and Fossil Fuel Provider With Poison Ivy. Retrieved November 9, 2018.

    Open source URL
  14. [14]
    Operation Quantum Entanglement

    Haq, T., Moran, N., Vashisht, S., Scott, M. (2014, September). OPERATION QUANTUM ENTANGLEMENT. Retrieved November 17, 2024.

    Open source URL
  15. [15]
    Villeneuve 2014

    Villeneuve, N., Homan, J. (2014, July 31). Spy of the Tiger. Retrieved September 29, 2015.

    Open source URL
  16. [16]
    Securelist APT Trends Q2 2017

    Kaspersky Lab's Global Research & Analysis Team. (2017, August 8). APT Trends report Q2 2017. Retrieved February 15, 2018.

    Open source URL
  17. [17]
    Cisco Group 72

    Esler, J., Lee, M., and Williams, C. (2014, October 14). Threat Spotlight: Group 72. Retrieved January 14, 2016.

  18. [18]
    Novetta-Axiom

    Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.

    Open source URL
  19. [19]
    PWC Cloud Hopper Technical Annex April 2017

    PwC and BAE Systems. (2017, April). Operation Cloud Hopper: Technical Annex. Retrieved April 13, 2017.

    Open source URL
  20. [20]
    District Court of NY APT10 Indictment December 2018

    US District Court Southern District of New York. (2018, December 17). United States v. Zhu Hua Indictment. Retrieved December 17, 2020.

    Open source URL
  21. [21]
    Haq 2014

    Haq, T., Moran, N., Scott, M., & Vashisht, S. O. (2014, September 10). The Path to Mass-Producing Cyber Attacks [Blog]. Retrieved November 12, 2014.

    Open source URL
  22. [22]
    Eset PlugX Korplug Mustang Panda March 2022

    Alexandre Cote Cyr. (2022, March 23). Mustang Panda’s Hodur: Old tricks, new Korplug variant. Retrieved September 9, 2025.

    Open source URL
  23. [23]
    Recorded Future REDDELTA July 2020

    Insikt Group. (2020, July 28). CHINESE STATE-SPONSORED GROUP ‘REDDELTA’ TARGETS THE VATICAN AND CATHOLIC ORGANIZATIONS. Retrieved April 13, 2021.

    Open source URL
  24. [24]
    Crowdstrike MUSTANG PANDA June 2018

    Meyers, A. (2018, June 15). Meet CrowdStrike’s Adversary of the Month for June: MUSTANG PANDA. Retrieved April 12, 2021.

    Open source URL
  25. [25]
    DustySky

    ClearSky. (2016, January 7). Operation DustySky. Retrieved January 8, 2016.

    Open source URL
  26. [26]
    DustySky2

    ClearSky Cybersecurity. (2016, June 9). Operation DustySky - Part 2. Retrieved August 3, 2016.

  27. [27]
    FireEye Operation Molerats

    Villeneuve, N., Haq, H., Moran, N. (2013, August 23). OPERATION MOLERATS: MIDDLE EAST CYBER ATTACKS USING POISON IVY. Retrieved November 17, 2024.

    Open source URL
  28. [28]
    Breut

    (Citation: Novetta-Axiom)

  29. [29]
    Breut

    (Citation: Novetta-Axiom)

  30. [30]
    Breut

    (Citation: Novetta-Axiom)

  31. [31]
    Darkmoon

    (Citation: Symantec Darkmoon Sept 2014)

  32. [32]
    Darkmoon

    (Citation: Symantec Darkmoon Sept 2014)

  33. [33]
    Darkmoon

    (Citation: Symantec Darkmoon Sept 2014)

  34. [34]
    FireEye Poison Ivy

    FireEye. (2014). POISON IVY: Assessing Damage and Extracting Intelligence. Retrieved September 19, 2024.

    Open source URL
  35. [35]
    FireEye Poison Ivy

    FireEye. (2014). POISON IVY: Assessing Damage and Extracting Intelligence. Retrieved September 19, 2024.

    Open source URL
  36. [36]
    Novetta-Axiom

    Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.

    Open source URL
  37. [37]
    Novetta-Axiom

    Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.

    Open source URL
  38. [38]
    Poison Ivy

    (Citation: FireEye Poison Ivy) (Citation: Symantec Darkmoon Sept 2014)

  39. [39]
    Poison Ivy

    (Citation: FireEye Poison Ivy) (Citation: Symantec Darkmoon Sept 2014)

  40. [40]
    Poison Ivy

    (Citation: FireEye Poison Ivy) (Citation: Symantec Darkmoon Sept 2014)

  41. [41]
    PoisonIvy

    (Citation: FireEye Poison Ivy)(Citation: Symantec Darkmoon Sept 2014)

  42. [42]
    PoisonIvy

    (Citation: FireEye Poison Ivy)(Citation: Symantec Darkmoon Sept 2014)

  43. [43]
    PoisonIvy

    (Citation: FireEye Poison Ivy)(Citation: Symantec Darkmoon Sept 2014)

  44. [44]
    Symantec Darkmoon Aug 2005

    Hayashi, K. (2005, August 18). Backdoor.Darkmoon. Retrieved February 23, 2018.

    Open source URL
  45. [45]
    Symantec Darkmoon Aug 2005

    Hayashi, K. (2005, August 18). Backdoor.Darkmoon. Retrieved February 23, 2018.

    Open source URL
  46. [46]
    Symantec Darkmoon Sept 2014

    Payet, L. (2014, September 19). Life on Mars: How attackers took advantage of hope for alien existance in new Darkmoon campaign. Retrieved September 13, 2018.

    Open source URL
  47. [47]
    Symantec Darkmoon Sept 2014

    Payet, L. (2014, September 19). Life on Mars: How attackers took advantage of hope for alien existance in new Darkmoon campaign. Retrieved September 13, 2018.

    Open source URL
  48. [48]
    Symantec Darkmoon Sept 2014

    Payet, L. (2014, September 19). Life on Mars: How attackers took advantage of hope for alien existance in new Darkmoon campaign. Retrieved September 13, 2018.

    Open source URL
  49. [49]
    Symantec Elderwood Sept 2012

    O'Gorman, G., and McDonald, G.. (2012, September 6). The Elderwood Project. Retrieved November 17, 2024.

    Open source URL
  50. [50]
    Symantec Elderwood Sept 2012

    O'Gorman, G., and McDonald, G.. (2012, September 6). The Elderwood Project. Retrieved November 17, 2024.

    Open source URL
  51. [51]
    mitre-attackS0012
    Open source URL
  52. [52]
    mitre-attackS0012
    Open source URL
  53. [53]
    mitre-attackS0012
    Open source URL
  54. [54]
    Symantec Elderwood Sept 2012

    O'Gorman, G., and McDonald, G.. (2012, September 6). The Elderwood Project. Retrieved November 17, 2024.

    Open source URL
  55. [55]
    Symantec Elderwood Sept 2012

    O'Gorman, G., and McDonald, G.. (2012, September 6). The Elderwood Project. Retrieved November 17, 2024.

    Open source URL
  56. [56]
    Symantec Darkmoon Aug 2005

    Hayashi, K. (2005, August 18). Backdoor.Darkmoon. Retrieved February 23, 2018.

    Open source URL
  57. [57]
    Symantec Darkmoon Aug 2005

    Hayashi, K. (2005, August 18). Backdoor.Darkmoon. Retrieved February 23, 2018.

    Open source URL
  58. [58]
    Symantec Darkmoon Aug 2005

    Hayashi, K. (2005, August 18). Backdoor.Darkmoon. Retrieved February 23, 2018.

    Open source URL
  59. [59]
    Symantec Darkmoon Aug 2005

    Hayashi, K. (2005, August 18). Backdoor.Darkmoon. Retrieved February 23, 2018.

    Open source URL
  60. [60]
    Cylance Dust Storm

    Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.

    Open source URL
  61. [61]
    Symantec Darkmoon Aug 2005

    Hayashi, K. (2005, August 18). Backdoor.Darkmoon. Retrieved February 23, 2018.

    Open source URL
  62. [62]
    Symantec Darkmoon Aug 2005

    Hayashi, K. (2005, August 18). Backdoor.Darkmoon. Retrieved February 23, 2018.

    Open source URL
  63. [63]
    Symantec Darkmoon Aug 2005

    Hayashi, K. (2005, August 18). Backdoor.Darkmoon. Retrieved February 23, 2018.

    Open source URL
  64. [64]
    Symantec Darkmoon Aug 2005

    Hayashi, K. (2005, August 18). Backdoor.Darkmoon. Retrieved February 23, 2018.

    Open source URL
  65. [65]
    Mandiant Advanced Persistent Threats

    Mandiant. (n.d.). Advanced Persistent Threats (APTs). Retrieved February 14, 2024.

    Open source URL
  66. [66]
    Cybereason Soft Cell June 2019

    Cybereason Nocturnus. (2019, June 25). Operation Soft Cell: A Worldwide Campaign Against Telecommunications Providers. Retrieved July 18, 2019.

    Open source URL
  67. [67]
    Microsoft GALLIUM December 2019

    MSTIC. (2019, December 12). GALLIUM: Targeting global telecom. Retrieved January 13, 2021.

    Open source URL
  68. [68]
    FireEye Poison Ivy

    FireEye. (2014). POISON IVY: Assessing Damage and Extracting Intelligence. Retrieved September 19, 2024.

    Open source URL
  69. [69]
    FireEye Poison Ivy

    FireEye. (2014). POISON IVY: Assessing Damage and Extracting Intelligence. Retrieved September 19, 2024.

    Open source URL
  70. [70]
    Symantec Darkmoon Aug 2005

    Hayashi, K. (2005, August 18). Backdoor.Darkmoon. Retrieved February 23, 2018.

    Open source URL
  71. [71]
    Symantec Darkmoon Aug 2005

    Hayashi, K. (2005, August 18). Backdoor.Darkmoon. Retrieved February 23, 2018.

    Open source URL
  72. [72]
    Mandiant APT1

    Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016.

    Open source URL
  73. [73]
    FireEye Regsvr32 Targeting Mongolian Gov

    Anubhav, A., Kizhakkinan, D. (2017, February 22). Spear Phishing Techniques Used in Attacks Targeting the Mongolian Government. Retrieved February 24, 2017.

    Open source URL
  74. [74]
    Microsoft PoisonIvy 2017

    McCormack, M. (2017, September 15). Backdoor:Win32/Poisonivy.E. Retrieved December 21, 2020.

    Open source URL
  75. [75]
    paloalto Tropic Trooper 2016

    Ray, V., et al. (2016, November 22). Tropic Trooper Targets Taiwanese Government and Fossil Fuel Provider With Poison Ivy. Retrieved December 18, 2020.

    Open source URL
  76. [76]
    FireEye admin@338

    FireEye Threat Intelligence. (2015, December 1). China-based Cyber Threat Group Uses Dropbox for Malware Communications and Targets Hong Kong Media Outlets. Retrieved December 4, 2015.

    Open source URL
  77. [77]
    FireEye Poison Ivy

    FireEye. (2014). POISON IVY: Assessing Damage and Extracting Intelligence. Retrieved September 19, 2024.

    Open source URL
  78. [78]
    FireEye Poison Ivy

    FireEye. (2014). POISON IVY: Assessing Damage and Extracting Intelligence. Retrieved September 19, 2024.

    Open source URL
  79. [79]
    FireEye Poison Ivy

    FireEye. (2014). POISON IVY: Assessing Damage and Extracting Intelligence. Retrieved September 19, 2024.

    Open source URL
  80. [80]
    FireEye Poison Ivy

    FireEye. (2014). POISON IVY: Assessing Damage and Extracting Intelligence. Retrieved September 19, 2024.

    Open source URL
  81. [81]
    Symantec Darkmoon Aug 2005

    Hayashi, K. (2005, August 18). Backdoor.Darkmoon. Retrieved February 23, 2018.

    Open source URL
  82. [82]
    Symantec Darkmoon Aug 2005

    Hayashi, K. (2005, August 18). Backdoor.Darkmoon. Retrieved February 23, 2018.

    Open source URL
  83. [83]
    Symantec Darkmoon Aug 2005

    Hayashi, K. (2005, August 18). Backdoor.Darkmoon. Retrieved February 23, 2018.

    Open source URL
  84. [84]
    Symantec Darkmoon Aug 2005

    Hayashi, K. (2005, August 18). Backdoor.Darkmoon. Retrieved February 23, 2018.

    Open source URL
  85. [85]
    Unit 42 Tropic Trooper Nov 2016

    Ray, V. (2016, November 22). Tropic Trooper Targets Taiwanese Government and Fossil Fuel Provider With Poison Ivy. Retrieved November 9, 2018.

    Open source URL
  86. [86]
    Operation Quantum Entanglement

    Haq, T., Moran, N., Vashisht, S., Scott, M. (2014, September). OPERATION QUANTUM ENTANGLEMENT. Retrieved November 17, 2024.

    Open source URL
  87. [87]
    Villeneuve 2014

    Villeneuve, N., Homan, J. (2014, July 31). Spy of the Tiger. Retrieved September 29, 2015.

    Open source URL
  88. [88]
    Securelist APT Trends Q2 2017

    Kaspersky Lab's Global Research & Analysis Team. (2017, August 8). APT Trends report Q2 2017. Retrieved February 15, 2018.

    Open source URL
  89. [89]
    Symantec Darkmoon Aug 2005

    Hayashi, K. (2005, August 18). Backdoor.Darkmoon. Retrieved February 23, 2018.

    Open source URL
  90. [90]
    Symantec Darkmoon Aug 2005

    Hayashi, K. (2005, August 18). Backdoor.Darkmoon. Retrieved February 23, 2018.

    Open source URL
  91. [91]
    Cisco Group 72

    Esler, J., Lee, M., and Williams, C. (2014, October 14). Threat Spotlight: Group 72. Retrieved January 14, 2016.

  92. [92]
    Novetta-Axiom

    Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.

    Open source URL
  93. [93]
    Novetta-Axiom

    Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.

    Open source URL
  94. [94]
    Symantec Darkmoon Aug 2005

    Hayashi, K. (2005, August 18). Backdoor.Darkmoon. Retrieved February 23, 2018.

    Open source URL
  95. [95]
    Symantec Darkmoon Aug 2005

    Hayashi, K. (2005, August 18). Backdoor.Darkmoon. Retrieved February 23, 2018.

    Open source URL
  96. [96]
    FireEye Poison Ivy

    FireEye. (2014). POISON IVY: Assessing Damage and Extracting Intelligence. Retrieved September 19, 2024.

    Open source URL
  97. [97]
    FireEye Poison Ivy

    FireEye. (2014). POISON IVY: Assessing Damage and Extracting Intelligence. Retrieved September 19, 2024.

    Open source URL
  98. [98]
    District Court of NY APT10 Indictment December 2018

    US District Court Southern District of New York. (2018, December 17). United States v. Zhu Hua Indictment. Retrieved December 17, 2020.

    Open source URL
  99. [99]
    PWC Cloud Hopper Technical Annex April 2017

    PwC and BAE Systems. (2017, April). Operation Cloud Hopper: Technical Annex. Retrieved April 13, 2017.

    Open source URL
  100. [100]
    Symantec Darkmoon Aug 2005

    Hayashi, K. (2005, August 18). Backdoor.Darkmoon. Retrieved February 23, 2018.

    Open source URL
  101. [101]
    Symantec Darkmoon Aug 2005

    Hayashi, K. (2005, August 18). Backdoor.Darkmoon. Retrieved February 23, 2018.

    Open source URL
  102. [102]
    Haq 2014

    Haq, T., Moran, N., Scott, M., & Vashisht, S. O. (2014, September 10). The Path to Mass-Producing Cyber Attacks [Blog]. Retrieved November 12, 2014.

    Open source URL
  103. [103]
    Crowdstrike MUSTANG PANDA June 2018

    Meyers, A. (2018, June 15). Meet CrowdStrike’s Adversary of the Month for June: MUSTANG PANDA. Retrieved April 12, 2021.

    Open source URL
  104. [104]
    Eset PlugX Korplug Mustang Panda March 2022

    Alexandre Cote Cyr. (2022, March 23). Mustang Panda’s Hodur: Old tricks, new Korplug variant. Retrieved September 9, 2025.

    Open source URL
  105. [105]
    Recorded Future REDDELTA July 2020

    Insikt Group. (2020, July 28). CHINESE STATE-SPONSORED GROUP ‘REDDELTA’ TARGETS THE VATICAN AND CATHOLIC ORGANIZATIONS. Retrieved April 13, 2021.

    Open source URL
  106. [106]
    Symantec Darkmoon Aug 2005

    Hayashi, K. (2005, August 18). Backdoor.Darkmoon. Retrieved February 23, 2018.

    Open source URL
  107. [107]
    Symantec Darkmoon Aug 2005

    Hayashi, K. (2005, August 18). Backdoor.Darkmoon. Retrieved February 23, 2018.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use