Poison Ivy and the “Nitro” Attacks

1338 Words3 Pages

Poison Ivy and the “Nitro” Attacks

Poison Ivy is the name given to a family of malicious remote administration Trojans first developed in 2005 and still being utilized for cyber attacks today. As a type of remote administration software, once a computer becomes infected the attacker has complete control of the computer. The most recently documented large-scale utilization of the software was during the “Nitro” attacks from July 2011 through September 2011 that targeted both chemical and defense companies for the purpose of industrial espionage (Fisher). The information security firm McAfee stated that five multinational natural gas and oil companies were successfully targeted by the Poison Ivy malware, as well as 29 other companies identified by Symantec (Finkle). These organizations lost proprietary information to the attackers, including confidential bidding plans (for the energy companies) and details on manufacturing processes and formulas (for several chemical companies).

The malware propagated mainly through the use of email attachments. The attackers utilized social engineering by posing as legitimate business partners or touting security updates. Once the employees opened the email’s attachment their computer would be infected. After a computer became infected, the attacker had the ability to perform a wide range of actions. Poison Ivy utilizes a client/server architecture that turns the infected machines into “servers” that the attackers can access from anywhere there is an Internet connection (Prince). Investigations by Symantec and law enforcement identified that the attacker’s actions were different in each case. In addition to having the ability to browse, copy, and upload documents from an infected computer the att...

... middle of paper ...

...users-rash-110311

Finkle http://www.reuters.com/article/2011/10/31/us-cyberattack-chemicals-idUSTRE79U4K920111031

http://www.f-secure.com/v-descs/backdoor_w32_poisonivy.shtml

Prince http://www.securityweek.com/poison-ivy-kit-enables-easy-malware-customization-attackers

Roberts http://threatpost.com/en_us/blogs/report-hacks-china-shuttered-uk-firm-cost-economy-43-billion-102511

Myers http://www.cyberesi.com/2011/10/11/poison-ivy/

http://www.kaspersky.com/about/news/virus/2010/Kaspersky_Lab_provides_its_insights_on_Stuxnet_worm

Maclean

http://www.reuters.com/article/2010/09/24/security-cyber-iran-idUSLDE68N1OI20100924

Aleksandr Matrosov, Senior Virus Researcher

Eugene Rodionov, Rootkit Analyst

David Harley, Senior Research Fellow

Juraj Malcho, Head of Virus Laboratory

http://go.eset.com/us/resources/white-papers/Stuxnet_Under_the_Microscope.pdf

More about Poison Ivy and the “Nitro” Attacks

Open Document