Log in Request a demo

Malware profile

PoisonIvy

Also known as Poison Ivy, Breut

PoisonIvy is a remote access tool (RAT) for Windows that MITRE describes as popular and used by many groups.

In short

PoisonIvy is a remote access tool (RAT) for Windows that MITRE describes as popular and used by many groups. It gives an attacker a backdoor to a computer, with a command line, file upload, keylogging and window title capture. A US indictment of two APT10 members names it among the malware installed through spear phishing emails.

Last updated 9 October 2026

Profile MapMalware
  1. Names4names in public reportsPoisonIvy · Poison Ivy · Breut
  2. Techniques15ATT&CK techniques listedPersistence · Execution · Command and Control
  3. Infection Steps4in the delivery chainSpear phishing email · Attachment opened
  4. Linked Groups3groups that use itAPT1 · menuPass · Mustang Panda

In one minute

What it is
A remote access tool (RAT) for Windows that gives an attacker control of an infected computer.
What it does
Opens a command line, uploads files, logs keystrokes, captures window titles and sets itself up to start again after a restart.
Who uses it
MITRE ATT&CK lists APT1, menuPass and Mustang Panda, among many other groups, as users. The US indictment of 17 December 2018, as attributed by the US Department of Justice, says APT10 (also called MenuPass) used malware including a variant known as Poison Ivy. No government source in this page confirms the APT1 and Mustang Panda links.
How it gets in
Spear phishing email with an attachment that installs the malware, as described in the US indictment of APT10 members.
What to do first
Watch for new Registry run keys, unexpected command shells and tool downloads on Windows computers, and filter phishing attachments, as CISA advises in AA20-275A.

What it does

A remote access tool lets an attacker control a computer from far away. MITRE ATT&CK describes PoisonIvy as a popular RAT that has been used by many groups.

CISA lists PoisonIvy, with Cobalt Strike, Mimikatz and China Chopper, among publicly known tools that Chinese threat actors use against enterprise networks (advisory AA20-275A).

Names

Public sources use several names for this malware.

Names
NameWhere it appears
PoisonIvyMITRE ATT&CK software S0012 and CISA advisory AA20-275A[1, 3]
Poison IvyMITRE ATT&CK Associated Software and the US indictment of APT10 members[1, 2]
BreutMITRE ATT&CK Associated Software[1]
DarkmoonMITRE ATT&CK Associated Software[1]

What it can do

What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.

Persistence

  • Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder T1547.001

    It adds run key entries in the Registry that point to a malicious program dropped to disk.[1, 3]

  • Boot or Logon Autostart Execution: Active Setup T1547.014

    It adds a key in the Registry Active Setup that points to a malicious program.[1]

  • Create or Modify System Process: Windows Service T1543.003

    It adds a Registry subkey that registers a new service, and edits the Logical Disk Manager service to point to a malicious DLL.[1]

  • Modify Registry T1112

    It creates a Registry subkey that registers a new system device.[1]

Execution

  • Command and Scripting Interpreter: Windows Command Shell T1059.003

    Its backdoor lets a remote attacker open a command line.[1, 3]

Command and Control

  • Ingress Tool Transfer T1105

    Its backdoor lets a remote attacker upload files to the computer.[1, 3]

  • Encrypted Channel: Symmetric Cryptography T1573.001

    It encrypts its communications with the Camellia cipher.[1]

Collection

  • Input Capture: Keylogging T1056.001

    It contains a keylogger.[1, 2]

  • Data from Local System T1005

    Its backdoor lets remote attackers steal system information.[1]

  • Data Staged: Local Data Staging T1074.001

    It stages collected data in a text file.[1]

Discovery

  • Application Window Discovery T1010

    It captures window titles.[1]

Stealth

  • Rootkit T1014

    It starts a rootkit from a malicious file dropped to disk.[1]

  • Process Injection: Dynamic-link Library Injection T1055.001

    It can inject a malicious DLL into a process.[1]

  • Obfuscated Files or Information T1027

    It hides strings that relate to its own indicators of compromise.[1, 3]

  • Execution Guardrails: Mutual Exclusion T1480.002

    It creates a mutex, using either a custom or a default value.[1]

How it spreads

PoisonIvy does not spread by itself in any source we cite. The US indictment of two APT10 members says the group sent spear phishing emails with attachments, and the attachment installed malware that typically included customized variants of a RAT, one known as Poison Ivy. The same indictment says the emails appeared to come from legitimate addresses and the attachment names looked legitimate.

How an infection runs

The order of steps in a typical infection, as the sources describe it.

  1. Spear phishing email

    Members of the group send emails that appear to come from legitimate addresses, with attachments that look legitimate.[2]

  2. Attachment opened

    When the recipient opens the attachment, it installs malware on the computer. The malware typically included customized variants of a RAT, one known as Poison Ivy, and keystroke loggers.[2]

  3. Contact with attacker

    The malware automatically communicates with domains assigned to IP addresses of computers the group controls, which gives them persistent remote access.[2]

  4. Further tools

    After the malware was installed, the group downloaded additional malware and tools to the compromised computers.[2]

Timeline

  1. 2006

    APT10 campaigns begin

    The US indictment says members of the APT10 Group conducted intrusion campaigns from at least about 2006 to about 2018. It names Poison Ivy among the malware installed through spear phishing.[2]

  2. 17 December 2018

    Indictment of two APT10 members

    MITRE cites the indictment of Zhu Hua and Zhang Shilong in the US District Court, Southern District of New York, dated 17 December 2018.[2, 4]

  3. 20 October 2020

    CISA advisory AA20-275A

    CISA lists PoisonIvy among publicly known tools used by Chinese threat actors against enterprise networks. The page shows this as the last revision date.[3]

Detection and defense

  1. Filter phishing attachments

    Use email gateways and network intrusion detection to find suspicious attachments, open them in detonation chambers, quarantine suspicious files and train users to spot phishing. The indictment describes spear phishing as the way the malware was installed.[2, 3]

    Counters: T1105 T1059.003

  2. Watch Registry run keys

    Monitor the startup folder for additions and changes, and the Registry for run key changes that do not match known patches or updates.[3]

    Counters: T1547.001

  3. Watch command shells

    Learn what normal script and shell use looks like, then monitor processes and command lines for suspicious use. Disable unused shells and interpreters.[3]

    Counters: T1059.003

  4. Watch for tool transfers

    Monitor for unexpected file creation or transfers into the network, and for unusual data flows, such as a client sending much more than it receives.[3]

    Counters: T1105

  5. Detect obfuscated files

    Analyze signatures of modified files and use antivirus to check commands after processing.[3]

    Counters: T1027

  6. Use the official resources

    CISA advisory AA20-275A gives detection and mitigation options per technique for tools like PoisonIvy. It does not carry signatures or indicators for PoisonIvy itself, and we found no government malware analysis report for it.[3]

    Counters: T1547.001 T1059.003 T1105

Questions

What is PoisonIvy?

A remote access tool (RAT) for Windows. MITRE ATT&CK describes it as popular and used by many groups.

What can PoisonIvy do?

MITRE lists a backdoor that opens a command line and uploads files, a keylogger, window title capture, a rootkit and persistence through the Registry.

Who uses PoisonIvy?

MITRE ATT&CK lists many groups, including APT1, menuPass and Mustang Panda. The US indictment of two APT10 members, a group also called MenuPass, names Poison Ivy among the malware installed by spear phishing.

How can I defend against PoisonIvy?

CISA advises monitoring Registry run keys and command shell use, watching for unexpected tool transfers and filtering phishing attachments (AA20-275A).

In our research

  1. Software Shared Across ATT&CK Groups: Reuse Study October 2026
  2. GALLIUM APT: What MITRE ATT&CK Says December 2025
  3. APT1 Threat group
  4. menuPass Threat group
  5. Mustang Panda Threat group

Sources

  1. PoisonIvy, Software S0012 MITRE ATT&CKSupports: Description, aliases, platform, techniques and groups listed for PoisonIvy.
  2. United States v. Zhu Hua and Zhang Shilong, Sealed Indictment US District Court, Southern District of New York, via US Department of JusticeSupports: APT10 aliases, 2006 to 2018 campaigns, spear phishing and Poison Ivy.
  3. AA20-275A Potential for China Cyber Response to Heightened U.S.-China Tensions CISASupports: PoisonIvy named among tools used by Chinese threat actors, with detection and mitigation advice.
  4. menuPass, Group G0045 MITRE ATT&CKSupports: MITRE lists menuPass as a user of PoisonIvy and cites the 17 December 2018 indictment.
  5. APT1, Group G0006 MITRE ATT&CKSupports: MITRE lists APT1 as a user of PoisonIvy.
  6. Mustang Panda, Group G0129 MITRE ATT&CKSupports: MITRE lists Mustang Panda as a user of PoisonIvy.

Browse the threat library

Keep exploring

Knowledge Hub

Article

GALLIUM APT: What MITRE ATT&CK Says

GALLIUM is a cyberespionage group MITRE ATT&CK says has been active since at least 2012. See what MITRE confirms, what is unproven and how…

Read more

Glossary term

Remote access trojan (RAT)

A remote access trojan, or RAT, is malware that lets an attacker control a computer from a distance.

Read more

Glossary term

Backdoor

A backdoor is an undocumented way of gaining access to a computer system, and NIST says it is a potential security risk.

Read more