TF-MAL-ios.poisoncarp

Description

ThreatFox malware family `ios.poisoncarp`. Printable name: PoisonCarp. Aliases: INSOMNIA.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (1)

• ThreatFox: IOCs for this family ThreatFox Malwares

• Detecting and Explaining Malware Family Evolution Using Rule-Based ...
  web:arxiv.org

  Interpretable models are especially important in ad-versarial domains such as malware analysis, where understanding the rationale behind a classification can guide remediation efforts and enhance model robust-ness. This paper proposes a novel approach for detect-ing and explaining concept drift in malware families over time.

  2026-05-22 05:25 UTC
• Antivirus/Antimalware, Mitigation M1049 - MITRE ATT&CK®
  web:attack.mitre.org

  Antivirus/Antimalware solutions utilize signatures, heuristics, and behavioral analysis to detect, block, and remediate malicious software, including viruses, trojans, ransomware, and spyware. These solutions continuously monitor endpoints and systems for known malicious patterns and suspicious behaviors that indicate compromise. Antivirus/Antimalware software should be deployed across all ...

  2026-05-22 05:25 UTC
• PoisonCarp (Malware Family) - Fraunhofer
  web:malpedia.caad.fkie.fraunhofer.de

  Details for the PoisonCarp malware family including references, samples and yara signatures.

  2026-05-22 05:25 UTC
• Open Hunting - Threat Library
  web:openhunting.io

  The iOS exploit and spyware we observed was used in watering hole attacks reported by Google Project Zero, and a website used to serve exploits by POISON CARP was also observed in a campaign called "Evil Eye" reported by Volexity. The Android malware used in the campaign is a fully featured spyware kit that has not been previously documented.

  2026-05-22 05:25 UTC
• Poison Carp, Evil Eye
  web:threatintelligence.garden.handsomezebra.com

  Poison Carp, Evil Eye Description (Citizen Lab) • Between November 2018 and May 2019, senior members of Tibetan groups received malicious links in individually tailored WhatsApp text exchanges with operators posing as NGO workers, journalists, and other fake personas.

  2026-05-22 05:25 UTC
• Advancing Malware Family Classification with MOTIF - Booz Allen Hamilton
  web:www.boozallen.com

  The ability to quickly pin down the family of malware used during a cyber attack can be a massive boon to an incident responder. Not only does family classification provide immediate insights about the characteristics and behaviors of a malware sample, but it is a core part of the triage, remediation , and attribution efforts.

  2026-05-22 05:25 UTC
• Malware Incident Response: The 7-Step Playbook for 2025 - Breachsense
  web:www.breachsense.com

  Complete malware remediation now requires addressing both the infected endpoint and the stolen authentication data. Your malware incident response playbook must account for both.

  2026-05-22 05:25 UTC
• Poison Carp - Council on Foreign Relations
  web:www.cfr.org

  Read more Digital Crackdown: Large-Scale Surveillance and Exploitation of Uyghurs Citizen Lab cited in report on malware campaign against Tibetan and Uyghur activists

  2026-05-22 05:25 UTC
• Technical Approaches to Uncovering and Remediating Malicious ... - CISA
  web:www.cisa.gov

  It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.

  2026-05-22 05:25 UTC
• POISON CARP Threat Actor Targets Tibetan Groups
  web:www.securityweek.com

  A threat actor referred to as POISON CARP has targeted senior members of Tibetan groups via WhatsApp for around six months.

  2026-05-22 05:25 UTC

Only Available for Registered Users. Sign in to view.