Skuggaheimar/Threat Intelligence/Poison Ivy RAT
POISON IVY RAT
POISON IVY
MALWARE
CHINESE APTS
Threat IntelligenceMalwareMarch 31, 2025•15 min read

Poison Ivy RAT: Threat Intelligence Profile

Classic Chinese APT RAT

Scroll

Poison Ivy RAT (also known as Poison Ivy, PIVY, Darkmoon) is a malware active since 2005. Classic Chinese APT RAT. Key characteristics include: remote desktop, keylogger, file manager, webcam, registry editor, historically used by APT1/APT10/APT12.

Overview & Background

Classic Chinese APT RAT. First identified in 2005, this threat is attributed to Chinese APTs.

Threat Assessment

Poison Ivy RAT remains an active threat. Organizations should implement detection rules and monitor for indicators associated with this malware.

Technical Analysis

Poison Ivy RAT employs the following capabilities and techniques:

MITRE ATT&CK Mapping

TacticTechniqueUsage
Initial AccessT1566.001 Phishing AttachmentCommon delivery vector
ExecutionT1204.002 Malicious FileUser-triggered execution
PersistenceT1547.001 Registry Run KeysAutostart persistence
Defense EvasionT1027 Obfuscated FilesPayload obfuscation
C2T1071.001 Web ProtocolsHTTP/HTTPS C2

Detection & Defense

Defend Against Poison Ivy RAT

Mjolnir Security provides detection and response capabilities against Poison Ivy RAT and similar threats.

Threat DetectionIncident ResponseThreat HuntingMDR ServicesThreat Intelligence
  • Proactive Threat Hunting Hunt for Poison Ivy RAT indicators and TTPs within your environment.
  • Threat Intelligence Monitor Poison Ivy RAT campaigns and infrastructure changes.
  • 24/7 Incident Response Rapid containment and forensic investigation. Call +1 833 403 5875.
Written by: Mjolnir Security  |  Published: March 31, 2025
Related Reports
Malware

Cobalt Strike: When Red Team Tools Become the Adversary's Arsenal

Read Report →
Malware

RedLine Stealer: The Infostealer That Fueled a Cybercrime Empire

Read Report →