Nitro

🔴 High
Also known as: Covert Grove, Nitro

These attackers were the subject of an extensive report by Symantec in 2011, which termed the attackers Nitro and stated: ‘The goal of the attackers appears to be to collect intellectual property such as design documents, formulas, and manufacturing processes. In addition, the same attackers appear to have a lengthy operation history including attacks on other industries and organizations. Attacks on the chemical industry are merely their latest attack wave. As part of our investigations, we were also able to identify and contact one of the attackers to try and gain insights into the motivations behind these attacks.’ Palo Alto Networks reported on continued activity by the attackers in 2014.

🌍 Country China
📅 Activity 2011 — 2014
⚡ Risk Level High
Chemical
2011
2014

Associated Operations

2014-07 Historically New Indicators of Compromise found Nitro appears to have somewhat modified their malware and delivery methods to include Spindest and legitimate compromised websites Nitro is known for targeted spear phishing campaigns and using Poison Ivy malware as reported by Cyber Squared’s TCIRT. https://unit42.paloaltonetworks.com/new-indicators-compromise-apt-group-nitro-uncovered/ which was not seen in these attacks. Since at least 2013

Introduction

These attackers were the subject of an extensive report by Symantec in 2011, which termed the attackers Nitro and stated: ‘The goal of the attackers appears to be to collect intellectual property such as design documents, formulas, and manufacturing processes. In addition, the same attackers appear to have a lengthy operation history including attacks on other industries and organizations. Attacks on the chemical industry are merely their latest attack wave. As part of our investigations, we were also able to identify and contact one of the attackers to try and gain insights into the motivations behind these attacks.’ Palo Alto Networks reported on continued activity by the attackers in 2014.

Activities and Tactics

Targeted Sectors: Chemical

Country of Origin: 🇨🇳 China

Risk Level: High

First Seen: 2011

Last Activity: 2014

Notable Campaigns

  • 2014-07
  • Historically
  • New Indicators of Compromise found
  • Nitro appears to have somewhat modified their malware and delivery methods to include Spindest and legitimate compromised websites
  • Nitro is known for targeted spear phishing campaigns and using Poison Ivy malware
  • as reported by Cyber Squared’s TCIRT.
  • https://unit42.paloaltonetworks.com/new-indicators-compromise-apt-group-nitro-uncovered/
  • which was not seen in these attacks. Since at least 2013

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No atomic indicators are listed in this profile. The APTnotes snapshot indexes 2 public reports that may contain IOCs; see Source Attribution for dataset links.

Malware and Tools

  • Gh0st RAT:
  • PCClient:
  • Poison Ivy:
  • Spindest:

Attribution and Evidence

Country of Origin: China Additional attribution information pending cataloguing.

References

References pending cataloguing.