GINC-APT-0141 · State

Nitro

Also Covert Grove, Nitro, Covert Grove.

Category
State · Attributed to a state or working for one.
Origin
China(high confidence)
Motivation
Information theft and espionage
Seen
2011–2014
Status
Dormant
Sources
8 sources carry it
Identifier
GINC-APT-0141 · nitro

What it is

These attackers were the subject of an extensive report by Symantec in 2011, which termed the attackers Nitro and stated: 'The goal of the attackers appears to be to collect intellectual property such as design documents, formulas, and manufacturing processes. In addition, the same attackers appear to have a lengthy operation history including attacks on other industries and organizations. Attacks on the chemical industry are merely their latest attack wave. As part of our investigations, we were also able to identify and contact one of the attackers to try and gain insights into the motivations behind these attacks.' Palo Alto Networks reported on continued activity by the attackers in 2014.

Names

The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.

Other names
Covert Grove, Nitro, Covert Grove

Attribution

Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.

Targets

Countries
Argentina, Bangladesh, Canada, China, Czech, Finland, France, Germany, Hong Kong, India, Japan, Netherlands, Norway, Russia, Singapore, South Korea, Sweden, Taiwan, United Kingdom, United States
Sectors
Automotive, Chemical, NGOs, Technology

Tools

The tools and malware families the sources tie to it.

  • Gh0st RAT
  • PCClient
  • Poison Ivy
  • Spindest

Sources