Loading story…
Palo Alto Networks' Unit 42 reported that a new variant of the Poison Ivy remote access trojan was used to target Hong Kong pro-democracy activists. The malware was deployed in a politically themed campaign aimed at compromising victims' systems and giving attackers persistent remote access, continuing a pattern of cyber-espionage activity directed at civil society and dissident groups in the region.
The campaign highlighted how a modified Poison Ivy sample was adapted for targeted intrusion operations rather than broad criminal distribution. Once installed, the RAT could enable surveillance, data theft, and ongoing control of infected machines, underscoring the risk that commodity malware families can be repurposed for focused attacks against activists and other high-risk organizations.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
Palo Alto Networks Unit 42 published research describing a new Poison Ivy remote access trojan variant used to target Hong Kong pro-democracy activists. The report publicly disclosed the campaign and its technical findings.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**PoisonVine** (also tracked as **APT-C-01** and linked in other reporting to **GreenSpot**) conducted a long-running cyber-espionage campaign against organizations in China, targeting government agencies, military personnel, defense industry entities, research institutes, universities, maritime bodies, and a major shipping company. Reporting says the group has operated since at least 2007 and continued through later campaigns such as **Operation Rubia cordifolia**, using spear-phishing, watering-hole attacks, spoofed websites, fake recruitment and manuscript-solicitation emails, and malicious attachments to steal credentials and sensitive internal data for political and military intelligence collection. The operators combined commodity and customized malware, including **Poison Ivy**, **ZxShell/ZXShell**, **Gh0st**, **HttpBots**, and **Kanbox RAT**, while repeatedly exploiting older but reliable flaws such as `CVE-2012-0158`, `CVE-2014-4114`, `CVE-2014-6352`, `CVE-2017-8759`, and `CVE-2018-20250`. Investigators tied the activity together through shared dynamic DNS infrastructure, Vultr VPS hosting, overlapping phishing frameworks such as **LJFrame**, **CPFrame**, and **FAPPFrame**, and recurring operational patterns including staged loaders, antivirus evasion, cloud-storage exfiltration, and keyword-based collection of military and national-security documents; one case reportedly involved about **3 GB** of stolen files.
Aug 15, 2026
A spear-phishing campaign targeted Japanese organizations with HR-themed lures impersonating company representatives and delivered a multi-stage malware chain built around **PXDropper**, the **PoisonX** kernel driver, and the modular **10FXRAT** remote-access trojan. Victims were directed to Google Cloud Storage-hosted archives containing ZIP, RAR, LNK, or EXE payloads, including polyglot Windows shortcut files that dropped decoy Japanese PDFs and used obfuscated downloaders to fetch second-stage malware such as `RuntimeBroker.exe`. The operators also disguised payloads as legitimate Feishu/Lark and Baidu Netdisk installers and abused DLL sideloading with signed binaries including `dashost.exe` and `unregmp2.exe` to decrypt and launch the malware. Once installed, PoisonX used kernel-level capabilities to terminate security tools and conceal malicious processes and network traffic, while 10FXRAT provided remote shell access, SOCKS5 tunneling, persistence, plugin-based expansion, and tampering with Microsoft Defender. Researchers said the activity continued into May and expanded to Chinese organizations, with the operators shifting from a signed PoisonX driver to **BYOVD** techniques using legitimately signed but vulnerable drivers such as **ASUSTeK `EneIo64.sys`** and Microsoft **`procexp.sys`**. The campaign exposed at least 61 indicators, including 49 SHA-256 hashes and 12 IPv4 command-and-control addresses; notable infrastructure included the Google Cloud Storage bucket `opentokenaiit`, the URL `https://storage.googleapis.com/opentokenaiit/newgram.exe`, and C2 address `101.32.190.202`. Researchers assessed the tradecraft as consistent with a China-nexus operation, with one report noting a possible but unconfirmed link to **Silver Fox**.
Jun 29, 2026
TA428 conducted **Operation LagTime IT**, a cyber-espionage campaign targeting government organizations in East Asia and defense- and aviation-related entities in Russia and Mongolia. The intrusions used Royal Road-generated malicious RTF documents exploiting **`CVE-2018-0798`** in Microsoft Word, including lures themed around **Qasem Soleimani** and **COVID-19**, to deliver **Poison Ivy**, **Cotx RAT**, and the malware later identified as **nccTrojan** or **MsmRAT**. Researchers said the activity was observed from at least March 2019 through 2020 and showed overlap with Chinese intrusion clusters including **Tick**, **Tonto**, and possibly **DragonOK/Danti**. After initial compromise, the operators stole credentials from Outlook and **`lsass.exe`**, scanned victim networks, and moved laterally using **`MS17-010`** tooling including EternalBlue-related exploitation. TA428 also used **NBTScan**, DLL side-loading with legitimate Intel and PotPlayer binaries, malicious **`.wll`** files for persistence, and follow-on malware such as **Tmanger**, **Poison Ivy-B**, and multiple **nccTrojan** variants. Researchers found that **nccTrojan** had at least two major branches: an initial-access version with standard RAT functions and XOR-obfuscated traffic, and a later-stage version installed as a Windows service that used a custom TCP protocol with **AES-encrypted** payloads and an activation code for command handling.
Aug 15, 2026