NitroThreat actor
- covert grove
These attackers were the subject of an extensive report by Symantec in 2011, which termed the attackers Nitro and stated: 'The goal of the attackers appears to be to collect intellectual property such as design documents, formulas, and manufacturing processes. In addition, the same attackers appear to have a lengthy operation history including attacks on other industries and organizations.From MISP Galaxy
Last reported 8 days ago, by The Hacker News5 reports
ATT&CK techniques
6 of 36 · each with the sentence it comes from- T1053.005Scheduled Task
“On a machine that pulled the package, a downloader that GTIG calls CROSSROAD unpacked a bundle into a local Radmin folder, created a scheduled task set to run every three hours, and then deleted itself from disk.”
- T1195Supply Chain Compromise
“It said this is the first supply chain compromise it has encountered built on Windows this short, "effectively evading traditional point-in-time triage and automated file scanning."”
- T1001.001Junk Data
“T1001.001”
- T1016System Network Configuration Discovery
“T1016”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Encrypted/Encoded File”
- T1027.013Encrypted/Encoded File
“T1027.013”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor“…at passed those checks, GTIG later saw a second tool pushed down on top of SHINYROAD, the open-source Adaptix C2 framework, disguised as Nitro PDF software.”
-
Investigating Ephemeral Supply Chain Tampering“Post-Exploitation: Nitro PDF Theme & Adaptix C2”
-
upm Launches as a Fast, Tiny Package Manager Written in TypeScript“Pooya Parsa, a longtime Nuxt contributor and creator of Nitro and UnJS, has introduced upm, a TypeScript package manager for the npm registry that uses Node.js's built-in networking, worker threads, compression, and filesystem tools.”
-
Gotta Breach 'Em All! The Journey Of ShinyHunters“The Australian PDF software firm Nitro PDF (GoNitro) had roughly 77 million records and document metadata stolen.”
-
Shedding light on the dark web“On October 21, 2020, the Nitro PDF (sold as GoNitro dump) service stated that it had been subject to a low impact security incident, however, the media then reported that user and document databases allegedly stolen as a result of the incident were offered for sale in a private a…”
Indicators in its reports
named in the reports above- 8.210.84[.]56in 2 reports
- promotion.storage-data[.]comin 2 reports
- storage-data[.]comin 2 reports
- aomei.storage-data[.]comin 2 reports
- 8.218.65[.]184in 2 reports
- 47.239.60[.]117in 2 reports
- security[.]orgin 1 report
- checkip.amazonaws[.]comin 1 report
- gonitro[.]comin 1 report
- ggumim.com[.]krin 1 report
Copy these 10 indicators · defanged
Thanks — we review every report.