- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Motivation
- Information theft and espionage
- Seen
- 2011–2014
- Status
- Dormant
- Sources
- 8 sources carry it
- Identifier
- GINC-APT-0141 · nitro
What it is
These attackers were the subject of an extensive report by Symantec in 2011, which termed the attackers Nitro and stated: 'The goal of the attackers appears to be to collect intellectual property such as design documents, formulas, and manufacturing processes. In addition, the same attackers appear to have a lengthy operation history including attacks on other industries and organizations. Attacks on the chemical industry are merely their latest attack wave. As part of our investigations, we were also able to identify and contact one of the attackers to try and gain insights into the motivations behind these attacks.' Palo Alto Networks reported on continued activity by the attackers in 2014.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Other names
- Covert Grove, Nitro, Covert Grove
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Targets
- Countries
- Argentina, Bangladesh, Canada, China, Czech, Finland, France, Germany, Hong Kong, India, Japan, Netherlands, Norway, Russia, Singapore, South Korea, Sweden, Taiwan, United Kingdom, United States
- Sectors
- Automotive, Chemical, NGOs, Technology
Tools
The tools and malware families the sources tie to it.
- Gh0st RAT
- PCClient
- Poison Ivy
- Spindest
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de