In March 2011, approximately a month after hosting the world’s largest cybersecurity conference, RSA (the security division of EMC) announced that it had been the victim of a successful APT attack. Although many experts would not place this attack in the same category as some of the more sophisticated intelligence-gathering attacks that have been mounted on governments and Fortune 500 companies, this was clearly a professional, targeted attack by a major APT actor.
The attack itself was relatively simple, but effective: It was initiated by a phishing email exploiting an Adobe flash vulnerability embedded in an attached spreadsheet. The intrusion resulted in the theft of confidential information, including data relating to RSA’s best-selling SecurID authentication technology. The attack used a piece of malware named PoisonIvy, which at the time was a widely available remote access Trojan that had been used to steal information from companies in the chemical and motor sectors as well as from human rights organizations.