Nitrogen

Nitrogen is a malware family and associated threat operation that first appeared in 2023 as an initial access malware/loader used to deliver BlackCat/ALPHV ransomware, and later evolved into an independent ransomware operator by mid-2024. Reporting describes Nitrogen as providing initial access to victim environments and, in later activity, operating its own ransomware strain derived from leaked Conti 2 builder code. The group has conducted double-extortion attacks and has been linked primarily to Eastern European infrastructure.

As an initial access malware, Nitrogen has been distributed through malvertising and search-engine ad campaigns on Google and Bing that impersonate legitimate software such as AnyDesk, Cisco AnyConnect, TreeSize Free, and WinSCP. Victims are redirected to fake software download sites, often via compromised WordPress pages and geographic filtering, and download trojanized ISO installers. The installer sideloads a malicious DLL (msi.dll), installs the expected legitimate application to reduce suspicion, deploys a malicious Python package, creates a registry Run key named "Python" for persistence, and launches a malicious pythonw.exe periodically. Subsequent components, including NitrogenStager, establish command-and-control communications and deploy Meterpreter and Cobalt Strike Beacons. Sophos assessed this activity as staging for ransomware deployment, and Trend Micro previously linked a similar ad-driven intrusion chain to BlackCat/ALPHV ransomware. S2W also reported AdverCRow using malvertising to gain initial access through Nitrogen.

As ransomware, Nitrogen has targeted VMware ESXi environments and broader enterprise victims. Multiple reports state that its ESXi variant contains a critical cryptographic implementation flaw: part of the encryption public key is overwritten with zeros or otherwise corrupted during encryption, causing files to be encrypted with an invalid public key that has no corresponding private key. As a result, decryption is impossible even for the operators, making ransom payment ineffective for affected ESXi victims. This flaw has been described by Coveware and Veeam, with analysis tying the ransomware to leaked Conti 2 builder code. Nitrogen has also been associated with codebase overlap noted in ClamAV detections alongside Babuk-related families.

Victim and targeting reporting indicates activity against organizations in manufacturing, business services, technology, hospitality, education, utilities, finance, and media, with the United States most represented in observed victim listings. Specific reporting says the campaign has targeted technology and non-profit organizations in North America, as well as North American financial institutions, mechanical and industrial firms. Foxconn publicly confirmed a cyberattack affecting several North American factories after Nitrogen claimed responsibility on its leak site, alleging theft of about 8 TB of data and more than 11 million files, including confidential technical records, project materials, and drawings tied to major customers such as Apple, Intel, Google, Nvidia, Dell, and AMD. Reported Nitrogen victims also include ENENSYS Technologies, PCCA, Coweta County School System, SRP Federal Credit Union, and Red Barrels.

Known ransomware artifacts and indicators mentioned in the content include ransom note filenames READ_ME_.TXT and readme.txt, a YARA rule reference nitrogen.yar, and MD5 hashes 1b637a43abca552acaee11c01913db18, 3139c8e0d0dd9683ebfecdb2e4f1b6bb, 3dbd3c04b1acab0b70546e48d39247b7, 7e043d880dcf7889c6767ab97764769c, 834d94cf35d9417aa93a5cb350a756e9, and a9297a8acbee74ba0169333ee38be2ef. ATT&CK-style behaviors referenced for Nitrogen include PowerShell use, scheduled tasks, LSASS memory credential dumping, RDP, SMB/Windows Admin Shares, automated collection, automated exfiltration, and exfiltration over command-and-control channels.