malware

PoisonIvy

S0012 · ATT&CK v19.2

aka Breut, Poison Ivy, Darkmoon

Platforms

Windows

Tracked actors

Description

[PoisonIvy](https://attack.mitre.org/software/S0012) is a popular remote access tool (RAT) that has been used by many groups.(Citation: FireEye Poison Ivy)(Citation: Symantec Elderwood Sept 2012)(Citation: Symantec Darkmoon Aug 2005)

Actors that use this

2 tracked actors

Gaza Cybergang / MoleratsATT&CK-attributed

Tropic TrooperATT&CK-attributed