New Indicators of Compromise for APT Group Nitro Uncovered - Palo Alto Networks BlogPalo Alto Networks Blog

This report describes mid‑2014 activity by the APT group “Nitro” that deployed multiple malware families (Spindest, PCClient, Farfli) through compromised legitimate websites and spear-phishing campaigns; analysts identified numerous IOCs (SHA256/MD5 hashes, filenames, C2 domains and IPs) across several targeted organizations and linked samples by shared C2 infrastructure and DNS/IP resolution overlap.