Nitrogen — Ransomware Profile
Nitrogen began as a malware loader in 2023 used to deliver BlackCat/ALPHV ransomware, then evolved into a fully independent ransomware operator by mid-2024, operating its own strain derived from leaked Conti 2 builder code and conducting double-extortion attacks primarily linked to Eastern European infrastructure.IntelFusions coverage (1)
- Phishing now starts most intrusions as attackers beat MFA 2026-07-29 · Cyber Incidents
Recent claimed victims
- Pyramid 2026-06-03
- FOXCONN 2026-05-11
- ENENSYS Technologies 2026-03-19
Vendor research
- CONTI's Carbon Copy – Nitrogen Ransomware Analysis SECUINFRA Falcon Team
- Nitrogen: same players play again! GLIMPS
- Analysis of the Ransomware Nitrogen StreamScan
- Nitrogen Ransomware on a Manufacturer Attack Spree Halcyon
- Nitrogen Ransomware Exposed: How ANY.RUN Helps Uncover Threats to Finance ANY.RUN