{"id":22546,"date":"2023-07-26T05:20:55","date_gmt":"2023-07-26T13:20:55","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2023\/07\/26\/news-16276\/"},"modified":"2023-07-26T05:20:55","modified_gmt":"2023-07-26T13:20:55","slug":"news-16276","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2023\/07\/26\/news-16276\/","title":{"rendered":"Into the tank with Nitrogen"},"content":{"rendered":"

Credit to Author: Gabor Szappanos| Date: Wed, 26 Jul 2023 10:00:04 +0000<\/strong><\/p>\n

\n

In mid-June, Sophos X-Ops identified a previously unreported initial-access malware campaign leveraging malicious advertising (malvertising)<\/a> and impersonating legitimate software to compromise business networks.<\/p>\n

This campaign – which we have dubbed Nitrogen<\/strong> based on strings found in the code – is a primarily opportunistic attack campaign abusing Google and Bing ads to target users seeking certain IT tools, with the goal of gaining access to enterprise environments to deploy second-stage attack tools such as Cobalt Strike.<\/p>\n

Sophos X-Ops has observed the Nitrogen campaign targeting several organizations in the technology and non-profit sectors in North America. Though Sophos mitigated the infections before further hands-on-keyboard activity occurred, we assess it is likely that the threat actors mean to leverage this infection chain to stage compromised environments for ransomware deployment. This assessment is corroborated by recent research from Trend Micro<\/a> stating it has observed a similar infection chain that led to a BlackCat (aka ALPHV)<\/a> ransomware infection.<\/p>\n

\"A<\/a><\/p>\n

Figure 1: An overview of the observed Nitrogen infection chain<\/em><\/p>\n

\u00a0<\/em>In this article, we’ll briefly walk through the infection process, which begins when a user searches for certain popular software packages on Google or Bing.\u00a0 Since there are subtle differences in how this stage goes, we have included three examples of different search-to-infection chains, which includes a twist designed to troll investigators. We then turn to a detailed description of how the malware operates and what happens once the infected file has been downloaded. (A list of MITRE ATT&CK techniques seen in this attack chain is provided at the end of the article.)<\/p>\n

Nitrogen Malware Family<\/h3>\n

While investigating this campaign, X-Ops analysts uncovered a new initial access malware family called Nitrogen. The name derives from the components and debug information we found in the samples, which indicate that the developers refer to this project as Nitrogen or Nitronet. The names of these components also indicate a relation to the Metasploit Framework (MSF), which is leveraged in the Nitrogen campaign to generate the reverse shell scripts used in NitrogenStager.<\/p>\n

The main components use the following class names:<\/p>\n