Poison Ivy

Internal ID: win.poison_ivy

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Malware family identifying win.poison_ivy. Origin and technical characteristics tracked via Malpedia.

Threat Analysis

Poison Ivy is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→http://blog.fortinet.com/2017/08/23/deep-analysis-of-new-poison-ivy-variant

→http://blogs.360.cn/post/APT_C_01_en.html

→http://csecybsec.com/download/zlab/20180713_CSE_APT28_X-Agent_Op-Roman%20Holiday-Report_v6_1.pdf

→https://attack.mitre.org/groups/G0011

→https://blog.bushidotoken.net/2022/07/space-invaders-cyber-threats-that-are.html

→https://blog.fortinet.com/2017/09/15/deep-analysis-of-new-poison-ivy-plugx-variant-part-ii

→https://blogs.jpcert.or.jp/ja/2022/05/HUILoader.html

→https://community.riskiq.com/article/56fa1b2f

→https://engineers.ffri.jp/entry/2022/11/30/141346

→https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections/blob/master/2016/2016.04.26.New_Poison_Ivy_Activity_Targeting_Myanmar_Asian_Countries/New%20Poison%20Ivy%20Activity%20Targeting%20Myanmar%2C%20Asian%20Countries.pdf

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.poison_ivy

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Poison Ivy