New Indicators of Compromise for APT Group Nitro Uncovered
Summary: Unit 42 found that the APT group Nitro compromised legitimate websites to serve malware across four waves from mid-March through mid-July, using Spindest variants plus PCClient and Farfli families not previously tied to the group. The July sample, hosted on a South Korean clothing and accessories manufacturer's site, was the only one configured to connect directly to an IP address for command and control, an IP the group had used for some time.
Why it matters: Nitro kept reusing old C2 infrastructure even as it swapped in new malware families, which is how Unit 42 attributed the activity - and that same IP is simple for any organization to block outbound, negating the effort the group put into delivering the malware.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026