Seguridad Mania.com - España y América Latina

MILPITAS, CA -- (Marketwired) -- 08/21/13 -- FireEye, Inc., the leader in stopping today's new breed of cyber attacks, today announced the release of a report titled, "Poison Ivy: Assessing Damage and Extracting Intelligence," that highlights the resurgence of Poison Ivy, a malware Remote Access Tool (RAT) that has remained popular and effective eight years after its original release -- attacking dozens of Fortune 1000 firms. In conjunction with the research, FireEye is also releasing Calamine, a set of free tools to help organizations detect possible Poison Ivy infections.

"Remote access tools may be the hacker's equivalent of training wheels," said Darien Kindlund, manager of threat intelligence at FireEye. "But dismissing this common breed of malware could be a costly mistake. Despite their reputation as a software toy for novice attackers -- RATs remain a linchpin of many sophisticated cyber attacks and are used by numerous threat actors. Today, we see hundreds of attacks using Poison Ivy targeting very high profile enterprises."

Poison Ivy has been used in several high-profile malware campaigns, most famously, the 2011 compromise of RSA SecurID data. In the same year, Poison Ivy powered a coordinated attack dubbed "Nitro" against chemical makers, government offices, defense firms, and human rights groups.

The FireEye report identifies several ongoing nation-state threat actors currently using Poison Ivy, including:

• admin@338: Active since 2008, this actor mostly targets the financial services industry. FireEye has also observed activity from this actor in telecom, government, and defense sectors.
  
  
• th3bug: First detected in 2009, FireEye has observed this actor targeting a number of industries, primarily higher education and healthcare.
  
  
• menuPass: Also first detected in 2009, FireEye research suggests that this actor targets U.S. and overseas defense contractors.
  

With the Calamine package, security professionals can identify telltale indicators of a Poison Ivy attack -- including the attacker's Poison Ivy process mutex and password, decoded command and control traffic to identify exfiltration/lateral movement, and a timeline of Poison Ivy malware activity. The FireEye report explains how Calamine can connect these and other facets of the attack.

This evidence is especially useful when it is correlated with multiple attacks that display the same identifying features. Combining these granular details with big-picture intelligence can help profile threat attackers and enhance IT defenses.

To download the full report, please visit http://www.fireeye.com/resources/pdfs/fireeye-poison-ivy-report.pdf.

To see the blog summary: http://www.fireeye.com/blog/technical/targeted-attack/2013/08/pivy-assessing-damage-and-extracting-intel.html.

To participate in a FireEye Labs webinar explaining Poison Ivy and how to detect it, please visit http://www2.fireeye.com/combatting-poison-ivy-attacks.html.

About FireEye, Inc.

FireEye has invented a purpose-built, virtual machine-based security platform that provides real-time threat protection to enterprises and governments worldwide against the next generation of cyber attacks. These highly sophisticated cyber attacks easily circumvent traditional signature-based defenses, such as next-generation firewalls, IPS, anti-virus, and gateways. The FireEye platform provides real-time, dynamic threat protection without the use of signatures to protect an organization across the primary threat vectors, including Web, email, and files and across the different stages of an attack life cycle. The core of the FireEye platform is a virtual execution engine, complemented by dynamic threat intelligence, to identify and block cyber attacks in real time. FireEye has over 1,000 customers across more than 40 countries, including over 100 of the Fortune 500.

© 2013 FireEye, Inc. All rights reserved. FireEye is a registered trademark of FireEye, Inc. All other brands, products, or service names are or may be trademarks or service marks of their respective owners.