Advisories

CERT-In Advisory CIAD-2011-0060

Malware attack "Nitro" targets chemical industrial organizations

Original Issue Date: November 04, 2011

Description

A targeted attack campaign dubbed as "Nitro" by Symantec targeting industrial chemical organizations to siphon competitive information is reported. Social engineering is used as the attack vector wherein email messages with attachments are targeted to the victim organizations. In most cases the attachment is a password protected archive with the mail body includes the password. The self extracting attachment is "Poison Ivy"- an infamous backdoor/ Remote Access Trojan(RAT).

Some of the examples of the file names attachment found are:

AntiVirus_update_package.7z, acquisition.7z, offer.7z, update_flashplayer10ax.7z

Once successfully installed, the Trojan connects to the C&C server over port 80/TCP and exfiltrate the victims IP address, information about the peers, and the dumped password hashes.

Recommendations/Countermeasures

Poison Ivy communication can be detected by observing the network traffic. Deploy appropriate IPS and apply the following signatures to detect the Poison Ivy traffic. .

Monitor SSL traffic to untrusted websites and block the same
Isolate suspected systems from network and report the same to CERT-In
Block suspicious (executable) email attachments.
Exercise caution while opening e-mail attachments received from unknown sources.
Install and maintain Desktop Firewall and block the ports which are not required.
Exercise caution while visiting trusted/untrusted sites
Disable Active Scripting through Browsers while visiting untrusted websites
Maintain all applications such as MS office, Adobe reader/Flash, Browsers, media players etc updated with latest patches
Maintain Operating system with latest updates

References

http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the_nitro_attacks.pdf
http://blog.trendmicro.com/the-significance-of-the-nitro-attacks/
http://threatpost.com/en_us/blogs/symantec-traces-attacks-chemical-industry-20-year-old-chinese-hacker-hire-110111
http://www.f-secure.com/v-descs/backdoor_w32_poisonivy.shtml

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India