A cybercrime gang that primarily targets companies from the chemical industry has launched a new series of attacks that involve malware-laden emails purporting to be from Symantec, the security vendor responsible for exposing its operation earlier this year.
Dubbed the Nitro attacks, the gang’s original industrial espionage efforts began sometime in July and lasted until September. The attackers’ modus operandi involved sending emails that carried a variant of the Poison Ivy backdoor and were specifically crafted for each targeted company.
Despite being publicly exposed by Symantec in an October report, the gang didn’t give up on its plans and, in fact, stuck to many of its techniques.
“The same group is still active, still targeting chemical companies, and still using the same social engineering modus operandi,” security researchers from Symantec said in a blog post on Monday.
“That is, they are sending targets a password-protected archive, through email, which contains a malicious executable,” they added.
The interesting aspect about the gang’s new attacks is that they are using Symantec’s own report in order to trick victims. One email intercepted by the security company was crafted to appear as if it were sent by its technical support department and warns recipients that many enterprise computers were infected with Poison Ivy.
The rogue messages claim that a special removal tool was released by Symantec in order to help its customers scan their systems. Attached to the email is a 7-Zip archive called the_nitro_attackspdf.7z containing a malicious executable file and a copy of Symantec’s original report about Nitro.
“The attackers, in an attempt to lend some validity to their email, are sending a document to targets that describes their very own activity,” Symantec said. The executable file is a new variant of Poison Ivy that connects to a command-and- control (C&C) server hosted by the same provider used in the previous attacks.
The fake Symantec alert is not the only lure this gang is using. Other malicious emails that are part of the same campaign claim to originate from Adobe Systems and contain a fake upgrade for Adobe Reader.
Symantec managed to take down the domain name used by the new C&C server and alerted the hosting provider. However, given the determination shown by these attackers so far, it’s unlikely that the Nitro attacks will stop.
The group’s primary goal is to steal domain administrator credentials, as well as to gain access to systems that store intellectual property. After identifying the “desired” IP, the attackers copy it to archives on internal systems used as staging servers, with the content uploaded from there to a site outside of the compromised organization, according to Symantec’s October report.