Nitro__2011__the_nitro_attacks.pdf

Symantec's 'Nitro' report describes a targeted industrial espionage campaign that used spearphishing emails and password-protected self-extracting archives to install the Poison Ivy RAT on victims—primarily chemical and advanced-materials companies—enabling attackers to harvest domain credentials, traverse networks, stage sensitive IP on internal servers, and exfiltrate proprietary documents; the report provides technical indicators (C2 domains/IPs, MD5 hashes), delivery and TTPs, geographic distribution of infections, and partial attribution to an individual linked to a U.S.-hosted VPS.