Nitro, Covert Grove
Nitro, Covert Grove is a China-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets 3 sectors, including Technology and Manufacturing, in 19 countries, including the United States and the United Kingdom.
- Nitro
- Covert Grove
- Origin
- China
- Techniques
- 0
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2011
- Record updated
Who They Target.
About Nitro, Covert Grove.
The Nitro Attacks: Stealing Secrets from the Chemical Industry The attackers have changed their targets over time. From late April to early May, the attackers focused on human rights related NGOs. They then moved on to the motor industry in late May. From June until mid-July no activity was detected. At this point, the current attack campaign against the chemical industry began. This particular attack has lasted much longer than previous attacks, spanning two and a half months. A total of 29 companies in the chemical sector were confirmed to be targeted in this attack wave and another 19 in various other sectors, primarily the defense sector, were seen to be affected as well. These 48 companies are the minimum number of companies targeted and likely other companies were also targeted. In a recent two week period, 101 unique IP addresses contacted a command and control server with traffic consistent with an infected machine. These Ips represented 52 different unique Internet Service Providers or organizations in 20 countries. Nitro may be related to {{APT 18, Dynamite Panda, Wekby}}.
Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.