H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

PoisonIvy

[PoisonIvy](https://attack.mitre.org/software/S0012) is a popular remote access tool (RAT) that has been used by many groups.(Citation: FireEye Poison Ivy)(Citation: Symantec Elderwood Sept 2012)(Citation: Symantec Darkmoon Aug 2005)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[PoisonIvy](https://attack.mitre.org/software/S0012) is a popular remote access tool (RAT) that has been used by many groups.(Citation: FireEye Poison Ivy)(Citation: Symantec Elderwood Sept 2012)(Citation: Symantec Darkmoon Aug 2005)

Labels

malware
31 recorded

Relationships

revoked-by
from Darkmoon
Malware
uses
from admin@338
Group
uses
from APT1
Group
uses
from APT5
Group
uses
from Axiom
Group
uses
from DragonOK
Group
uses
from Elderwood
Group
uses
from GALLIUM
Group
uses
from IndigoZebra
Group
uses
from menuPass
Group
uses
from Moafee
Group
uses
from Molerats
Group
uses
from Mustang Panda
Group
uses
from Operation Dust Storm
Campaign
uses
from PittyTiger
Group
uses
to Active Setup
Technique
uses
to Application Window Discovery
Technique
uses
to Data from Local System
Technique
uses
to Dynamic-link Library Injection
Technique
uses
to Ingress Tool Transfer
Technique
uses
to Keylogging
Technique
uses
to Local Data Staging
Technique
uses
to Modify Registry
Technique
uses
to Mutual Exclusion
Technique
uses
to Obfuscated Files or Information
Technique
uses
to Registry Run Keys / Startup Folder
Technique
uses
to Rootkit
Technique
uses
to Symmetric Cryptography
Technique
uses
to Windows Command Shell
Technique
uses
to Windows Service
Technique
uses
from Tropic Trooper
Group
10 external

References

mitre-attack
S0012
open
Poison Ivy
—
PoisonIvy
—
Breut
—
Darkmoon
—
FireEye Poison Ivy
https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf
open
Symantec Darkmoon Aug 2005
https://www.symantec.com/security_response/writeup.jsp?docid=2005-081910-3934-99
open
Novetta-Axiom
https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf
open
Symantec Elderwood Sept 2012
https://web.archive.org/web/20190717233006/http:/www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-elderwood-project.pdf
open
Symantec Darkmoon Sept 2014
https://www.symantec.com/connect/blogs/life-mars-how-attackers-took-advantage-hope-alien-existance-new-darkmoon-campaign
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance