'Nitro attacks' continue

PoisonIvy trojan sent attached to email warning about the same trojan.

Researchers at Symantec report that the 'Nitro attacks', which target a number of large companies, many of which are active in the chemical industry, are continuing, using the same methods as before.

In the most recent part of this attack, employees of the targeted companies received emails containing a password-protected zip archive. The archive contained an executable (although the filename suggested it was a PDF document) which installed a variant of the PoisonIvy trojan. At the same time, a harmless PDF was dropped onto the victim's machine, apparently in an attempt to distract the user from the malicious installation that had taken place.

None of these techniques are new, nor are they very sophisticated. What is remarkable in this case is that the emails contained a warning against the PoisonIvy trojan itself and claimed that the attachment contained 'a special kill poison Ivy Trojan anti-virus software', apparently released by Symantec. The harmless PDF dropped onto the victim's machine was the very document Symantec published earlier about these Nitro attacks.

It is important for users to be aware of such attacks, especially if they target the industry they are working in. This example shows, however, that one should never blindly install software even if it is supposed to provide protection.

More at Symantec's blog here.

At the 3rd VB 'Securing Your Organization in the Age of Cybercrime' Seminar, Symantec.cloud's Martin Lee will talk about targeted attacks. The seminar takes place on 19 April 2012 at the OU Campus in Milton Keynes, UK; registration is now open.

Posted on 13 December 2011 by Virus Bulletin

twitter.png
fb.png
linkedin.png
googleplus.png
reddit.png

 

Latest posts:

VB2015 paper: Sizing cybercrime: incidents and accidents, hints and allegations

Cybercrime is big. But how big is it really? In a paper presented at VB2015 and together with the presentation video published on our website today, ESET researcher Stephen Cobb looks at previous studies that attempt the size of cybercrime and asks…

Throwback Thursday: The Thin Blue Line

This Throwback Thursday, VB heads back to 1994 when UK Fraud Squad detectives started making inroads into the most puzzling 'Whodunnit' since the Great Train Robbery. Had an outbreak of computer crime swept Britain? No, it was all part of a police…

Welcome to virusbulletin.com

Almost 20 years after Virus Bulletin revealed its first site on the "world wide web", we've redesigned our whole website. And we have a new domain as well.

VB2015 video: TurlaSat: The Fault in our Stars

In a presentation at VB2015 in Prague, Kaspersky Lab researcher Kurt Baumgartner talked about Turla's extraplanetary activities: the malware used (and abused) satellite Internet connections for command and control communication.

Security vendors should embrace those hunting bugs in their products

When interviewed by the Risky Business podcast last week, VB Editor Martijn Grooten talked about the security of security products and said that many vendors are embracing the work done by Tavis Ormandy and others - as they should.