Elderwood

Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code

Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection. Encrypting and/or encoding file

Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external ad

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to ope

An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to cl

Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or

Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a sp

Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specifi

Briba is a trojan used by Elderwood to open a backdoor and downloa

Hydraq is a data-theft trojan first used by Elderwood in the 2009

Linfo is a rootkit trojan used by Elderwood to open a backdoor on

Naid is a trojan used by Elderwood to open a backdoor on compromis

Nerex is a Trojan used by Elderwood to open a backdoor on compromi

Pasam is a trojan used by Elderwood to open a backdoor on compromi

PoisonIvy is a popular remote access tool (RAT) that has been used by many groups.(Citation: FireEye Poison

Vasport is a trojan used by Elderwood to open a backdoor on compro

Wiarp is a trojan used by Elderwood to open a backdoor on compromi