Recent Watering Hole Attacks Attributed to APT Group “th3bug” Using Poison Ivy
Summary: Unit 42 attributed a series of summer 2014 watering hole attacks to the APT group "th3bug," which compromised legitimate websites, including a well-known Uyghur-language site, to serve Poison Ivy RAT variants. The first sample appeared July 14, 2014, with a PE timestamp of July 11, and a July 16 executable hosted on uyghurweb.net masqueraded as an ApacheBench tool while downloading a Poison Ivy payload from the same site.
What's compelling: The attackers compromised a legitimate, trusted website so visitors had no way to know in advance it would serve them malware, and the source notes that even a fully patched system can fall to a zero-day exploit in this style of attack.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026