Loading threat actor…
Nitrogen, also known as the Nitrogen gang or Nitrogen ransomware group, is a financially motivated cybercriminal operation active since 2023. Initially associated with an initial-access malware loader used in attacks that delivered ALPHV/BlackCat ransomware, it subsequently developed its own ransomware using leaked Conti 2 builder code and began independent extortion operations in 2024. Its ransomware targets Windows and VMware ESXi environments. Its geographic origin has not been established with high confidence. Nitrogen conducts double-extortion attacks, combining data theft and encryption with threats to publish stolen information on its leak site. Manufacturing, technology, and business services are prominent targets, with additional victims in financial services, real estate, hospitality, healthcare, education, and other sectors. Its victim distribution is concentrated in the United States and Canada, with additional victims in Portugal, Taiwan, and France. Named victims include Foxconn, SRP Federal Credit Union, Canadian game developer Red Barrels, and U.S. real estate company Pyramid. Early Nitrogen campaigns used Google and Bing malvertising and fraudulent software-download pages impersonating legitimate IT tools, including WinSCP, AnyDesk, Cisco AnyConnect, and TreeSize Free. Trojanized installers combined legitimate decoy applications with malicious Python components. Observed techniques include DLL sideloading and preloading, scheduled-task and registry-based persistence, attempted CMSTPLUA UAC bypass, and transacted process hollowing. Operators have used Meterpreter, Cobalt Strike, Sliver, and Pyramid for command-and-control and post-exploitation. Their activity includes domain and account reconnaissance, credential discovery, lateral movement through PsExec and WMIC, data exfiltration using Restic, and evasion through AMSI, ETW, and WLDP bypasses and sleep obfuscation. Nitrogen claimed responsibility for a cyberattack affecting Foxconn's North American factories and alleged theft of approximately 8 TB of data comprising more than 11 million files. Foxconn confirmed operational disruption but did not confirm the claimed theft volume or exposure of customer information. Some Nitrogen ESXi ransomware versions contain encryption-key handling defects that can make encrypted files irrecoverable even when victims obtain the attackers' decryption material.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
46 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
3 malware families Mallory has associated with this actor across public reporting.
6 indicators attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.