New Poison Ivy RAT Variant Targets Hong Kong Pro-Democracy Activists
Summary: Unit 42 observed a new Poison Ivy variant, named SPIVY, deployed in March via weaponized documents exploiting CVE-2015-2545, with decoy themes tied to recent Hong Kong pro-democracy events. The backdoor was built as obfuscated shellcode, side-loaded through a legitimate signed binary and stub DLL, and uses a modified challenge-response protocol that prepends 1 to 16 bytes of pseudo-random padding to the historical 256-byte handshake.
Why it matters: The two command-and-control domains sit under leeh0m[.]org, registered in late February 2016, less than a month before the attacks - and the decoys were specific enough to name Joshua Wong, the Mong Kok riot, and a Tiananmen anniversary event, meaning the targeting depended on knowledge of a community your threat intel likely does not cover.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Mentions
- CVE-2015-2545
- Related
- CVE-2015-2545: Microsoft Office Malformed EPS File Vulnerability Known Exploited Vulnerabilities · Mar 03, 2022Operation Ke3chang Resurfaces With New Tide Pool Malware Cyber Risks ·