Nitro cyberattacks
The Nitro cyberattacks were a targeted malware campaign in 2011 suspected to be a case of corporate espionage.[1] At least 48 confirmed companies were infected with a Trojan called Poison Ivy that transferred intellectual property to remote servers.[2] Much of the information known about these attacks comes from a white paper published by cybersecurity company Symantec (renamed NortonLifeLock).
Targets
Initial attacks in April and May 2011 targeted human rights organizations, though later in May the focus shifted to automotive companies.[1][3] Then from July to September another series of breaches occurred with the majority of targets in the chemical and advanced materials industry and the defense sector.[4] The attacks were international, with targeted firms in 20 countries, though the majority were in the U.S., U.K., and Bangladesh.[5][6]
Methods
The targets seem to have been carefully selected and researched, with spear phishing emails usually going out to only a handful of employees at each company and claiming to be sent from specific business partners or to contain security updates.[7][4] These emails came with an attachment that infected the user's computer with Poison Ivy, which then allowed attackers to send remote commands and eventually gain access to valuable data. In a strange move, the hackers actually used Symantec's report on their activities as a means to gain victims' trust. After the paper was published, new emails were sent by Nitro that pretended to be from Symantec and contained cursory information about the attack along with an attachment named "the_nitro_attackspdf.7z". This executable file would actually create a PDF of the real Symantec white paper, but would also infect the machine with the remote access Trojan.[3]
Perpetrators
Unusually for a cybersecurity investigation, researchers were able to trace some attacks back to an individual dubbed Covert Grove who owned a U.S.-based virtual private server involved in the campaign, though he operated from Heibei Province, China.[4] The man claimed to only use the server for logging into the QQ instant messaging system and investigators were never able to confirm his direct involvement or connection to any other organization.[5] However, Symantec later attributed to the same Nitro group a series of attacks in 2012 using a Java zero-day vulnerability called CVE-2012-4681.[8]
See also
References
- ↑ 1.0 1.1 Finkle, Jim (31 October 2011). "New cyber attack targets chemical firms: Symantec". Reuters. https://www.reuters.com/article/us-cyberattack-chemicals-idUSTRE79U4K920111031.
- ↑ Schwartz, Matthew J. (1 November 2011). "Nitro Malware Targeted Chemical Companies". https://www.darkreading.com/attacks-and-breaches/nitro-malware-targeted-chemical-companies-/d/d-id/1101062.
- ↑ 3.0 3.1 Prince, Brian (12 December 2011). "Nitro Attackers Pose as Symantec in Attempt to Spread Malware". Security Week. https://www.securityweek.com/nitro-attackers-pose-symantec-attempt-spread-malware.
- ↑ 4.0 4.1 4.2 Keizer, Gregg (31 October 2011). "'Nitro' hackers use stock malware to steal chemical, defense secrets". https://www.computerworld.com/article/2499789/-nitro--hackers-use-stock-malware-to-steal-chemical--defense-secrets.html.
- ↑ 5.0 5.1 "The Nitro Attacks: Stealing Secrets from the Chemical Industry". Symantec. http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the_nitro_attacks.pdf.
- ↑ Gallagher, Sean (1 November 2011). ""Nitro" spear-phishers attacked chemical and defense company R&D". https://arstechnica.com/information-technology/2011/11/nitro-spear-phishers-attacked-chemical-and-defense-company-rd/.
- ↑ Prince, Brian (31 October 2011). "Coordinated Cyber Attacks Hit Chemical and Defense Firms". Security Week. https://www.securityweek.com/coordinated-cyber-attacks-hit-chemical-and-defense-firms.
- ↑ Fisher, Dennis (30 August 2012). "Use of Java Zero-Day Flaws Tied to Nitro Attack Crew". https://threatpost.com/use-java-zero-day-flaws-tied-nitro-attack-crew-083012/76965/.
External links
- Symantec's white paper on the attacks (archived)
 |
