Md5
6 total3dbd3c04b1acab0b70546e48d39247b71b637a43abca552acaee11c01913db18834d94cf35d9417aa93a5cb350a756e97e043d880dcf7889c6767ab97764769c3139c8e0d0dd9683ebfecdb2e4f1b6bba9297a8acbee74ba0169333ee38be2ef
Nitrogen
Nitrogen is a malware cluster associated with two closely related roles over time: an initial-access malware chain used to compromise enterprise environments and a later independent ransomware operation.
Profile source: Mallory opens in a new tabNitrogen
Family profile
Nitrogen is a malware cluster associated with two closely related roles over time: an initial-access malware chain used to compromise enterprise environments and a later independent ransomware operation. The activity first emerged in 2023 as a loader-style intrusion set used to deliver follow-on payloads including BlackCat/ALPHV, and by mid-2024 it had evolved into a standalone double-extortion ransomware actor operating its own strain. Reporting also links the ransomware codebase to leaked Conti v2 builder material.
As an initial-access malware, Nitrogen has been distributed through malvertising and fake software download campaigns. Operators used sponsored search results and spoofed software sites impersonating widely used business tools to lure victims into downloading trojanized installers. The infection chain on Windows has included DLL sideloading, installation of a malicious Python-based component, persistence via autorun mechanisms, staging of a loader component, and deployment of Meterpreter and Cobalt Strike for hands-on-keyboard follow-on activity. This access pattern has been assessed as a precursor to broader enterprise compromise, data theft, and ransomware deployment.
As ransomware, Nitrogen targets enterprise environments including VMware ESXi hypervisors and has been observed in attacks affecting manufacturing, technology, business services, finance, education, and other sectors, with repeated reporting on North American victims. The operation conducts double-extortion by stealing data in addition to encrypting systems. Public reporting has associated Nitrogen with incidents affecting major manufacturers, including Foxconn, and with victimology spanning the United States and Canada among other countries.
Nitrogen’s tooling has notable implementation flaws. Its ESXi variant contains a cryptographic bug that corrupts part of the public key used during encryption, making decryption impossible even for the operators. Multiple reports state that some victims could not recover data even after payment because the decryptor or key material was defective. This weakness is significant operationally because it undermines the gang’s ability to provide working decryption.
Nitrogen is best understood as a financially motivated intrusion and ransomware ecosystem that combines malvertising-based initial access, stealthy post-compromise tooling, persistence, staged payload delivery, and data-theft-backed extortion. The same name has been used both for the earlier access malware and for the later ransomware operation, and the two are consistently linked in reporting.
Capabilities
- Defense Evasion
- Dll Sideloading
- Exfiltration
- Extortion
- Initial Access
- Persistence
- Post Exploitation
Operational record
10
Indicators
1
YARA rules
2
Ransom notes
2
Leak sites
0 available
Published indicators
Tox
4 total088B7708F2C1557B6023B1102FFC5C36C023FF4883CB073F26A33B73832C9268993ED58B817EC1DD64D0994AEAA297225CD94D1A6842819C74319A85350913AB9A82678C001EB09B71214D6646CA5EEC55A16767B7F8293DB18F753D1BF60C536747EFD115035DDA40948427E1DDFD107F03620C7A54EC212FB482A684BA74381C3623CCE4D0E27FAE348688F65E0F0F6B6A149790D1AE7D
Reported operators
Threat actors
1 named in public reportingAdverCRow is a group named by S2W that has been active since at least June 2023, and attempts to gain initial access through malvertising and then gains initial access through the Nitrogen malware.
MITRE ATT&CK
Nitrogen in ATT&CK
26 distinct techniquesTechniques
26 techniques T1486 Data Encrypted for Impact T1105 Ingress Tool Transfer T1583 Acquire Infrastructure T1189 Drive-by Compromise T1566 Phishing T1074 Data Staged T1048 Exfiltration Over Alternative Protocol T1657 Financial Theft T1059 Command and Scripting Interpreter T1059.001 Command and Scripting Interpreter: PowerShell T1204.002 User Execution: Malicious File T1053 Scheduled Task/Job T1053.005 Scheduled Task/Job: Scheduled Task T1068 Exploitation for Privilege Escalation T1027 Obfuscated Files or Information T1218 System Binary Proxy Execution T1003.001 OS Credential Dumping: LSASS Memory T1007 System Service Discovery T1057 Process Discovery T1021.001 Remote Services: Remote Desktop Protocol T1021.002 Remote Services: SMB/Windows Admin Shares T1119 Automated Collection T1020 Automated Exfiltration T1041 Exfiltration Over C2 Channel T1071 Application Layer Protocol T1071.001 Application Layer Protocol: Web Protocols
Reporting
Research mentioning Nitrogen
Jul 23
Scworld
Ransomware payments fail to prevent repeat attacks, new data shows | brief | SC Media
Proofpoint survey data shows that paying ransomware demands often fails to end an incident and can expose victims to further extortion. Among affected UK organizations, 58% paid a ransom, and 22% of those payers were targeted again; globally, 54% of victim organizations paid and 37% were extorted a second time. The findings reinforce long-standing warnings that attackers may continue pressuring victims even after receiving payment. The reporting also found that payment does not guarantee recovery: 2% of victims that paid never got their files back, underscoring that criminals may withhold working decryptors or retain stolen data. Coverage cited the LockBit takedown under Operation Cronos as evidence that ransomware operators can keep victim information after payment, while noting that AI is increasingly improving the phishing, credential theft, impersonation, and reconnaissance activity that often precedes ransomware attacks.
Jul 23
Itpro
Companies are still paying ransoms to cyber criminals despite official advice | IT Pro
Jul 22
Malware News
Greedy ransomware crews return for seconds after victims cough up first extortion payments - Malware News - Malware Analysis, News and Indicators
Jul 22
Techcrunch Com Security
If you pay a hacker's ransom, chances are that they'll come back for more | TechCrunch
Jul 22
Register Security
