SPIVY

SPIVY is a Poison Ivy remote access trojan variant observed in 2016 in targeted espionage activity against pro-democracy organizations and supporters in Hong Kong. It preserves core Poison Ivy code and behavior while introducing updated execution and command-and-control mechanisms, indicating a retooled lineage rather than a wholly distinct malware family.

SPIVY was delivered through weaponized Microsoft Office documents exploiting CVE-2015-2545 in spearphishing campaigns. The lure material was themed around contemporary Hong Kong political events and organizations, consistent with highly targeted collection against civil society and political-interest targets. After exploitation, the infection chain used DLL sideloading with a legitimate signed executable and a malicious DLL to decode and launch an obfuscated Poison Ivy shellcode payload.

Functionally, SPIVY operates as a classic RAT/backdoor in the Poison Ivy tradition. Analysis linked it directly to older Poison Ivy families through code reuse and retained implementation details such as the API call table generation approach. Its most notable evolution was in network communications: SPIVY altered the Poison Ivy challenge-response handshake by prepending pseudo-random padding and control bytes before the standard handshake structure, while leaving the remainder of the protocol largely unchanged. This modification likely served to hinder straightforward protocol recognition and detection.

SPIVY has been associated with targeted intrusion activity overlapping with clusters tracked around Hong Kong-focused spearphishing in 2016, and reporting has also referenced its use alongside other TA428-associated RATs. High-confidence reporting supports its role as a Windows-based espionage malware family used for covert remote access in politically motivated operations.