Overview
Nitrogen is a ransomware operation that evolved from a specialised malware delivery service into a full-scale extortion group. The group’s defining characteristic is its initial access methodology: malvertising campaigns that target IT professionals searching for legitimate remote access and system administration tools, intercepting that traffic with trojanised installers that deliver the Nitrogen loader before executing the ransomware payload.
The group first appeared in 2023 as an initial access broker and loader service, then transitioned to operating its own ransomware strain by September 2024. Nitrogen’s encryptor is built on leaked Conti 2 builder code — the same codebase that spawned multiple ransomware operations following the Conti dissolution. The February 2026 broken decryptor incident — in which a coding error left victims unable to recover files even after paying the ransom — created significant operational problems for the group and attracted attention from threat intelligence researchers.
Nitrogen operates a double-extortion model: files are encrypted, and exfiltrated data is threatened for publication on the group’s leak site if payment is not received.
Initial Access: Malvertising and SEO Poisoning
Nitrogen’s distinctive initial access technique targets the search behaviour of IT administrators. The group places paid advertisements or manipulates search engine results to serve trojanised installers when users search for:
- AnyDesk — remote desktop software
- WinSCP — SFTP and file transfer client
- Advanced IP Scanner — network discovery tool
- PuTTY — SSH client
- FileZilla — FTP client
The technique exploits the trust that IT professionals place in search results for tools they use regularly. A network administrator searching for “WinSCP download” clicks the top result — which appears legitimate and includes the correct branding — and receives a ZIP or ISO file containing both the legitimate tool and the Nitrogen loader. The tool installs successfully, providing no indication to the victim that anything is wrong.
This approach is effective for two reasons. First, IT professionals with system administration access are high-value targets — compromising one IT account typically provides credentials and access to many systems. Second, the target’s legitimate use of the tool means the initial compromise is difficult for security teams to distinguish from normal software installation activity.
The delivery vehicle has evolved over time. Early campaigns used ZIP archives with DLL sideloading; later campaigns switched to ISO image files, which bypass Windows Attachment Mark-of-the-Web security warnings (since ISOs do not propagate MOTW to their contents when mounted). As Windows addressed ISO MOTW bypass behaviour, the group shifted to signed installers and alternate packaging formats.
Technical Execution Chain
Following successful initial access via the trojanised installer, the Nitrogen execution chain follows a consistent pattern:
Stage 1 — Loader execution: The Nitrogen loader DLL executes via sideloading against a legitimate application binary included in the installer package. The loader establishes a foothold, performs basic anti-analysis checks, and contacts the threat actor’s infrastructure for Stage 2 delivery.
Stage 2 — Cobalt Strike beacon: The loader retrieves and executes a Cobalt Strike beacon in memory. The beacon provides the threat actor with an interactive C2 session. Nextron Systems documented this specific two-stage pattern — Nitrogen loader delivering Cobalt Strike — in their April 2025 analysis. The beacon is typically staged from compromised infrastructure to avoid direct attribution to the threat actor’s owned infrastructure.
Stage 3 — Hands-on-keyboard intrusion: Following Cobalt Strike delivery, the threat actor conducts manual intrusion activity: credential harvesting using tools like Mimikatz or similar, lateral movement to identify domain controllers and backup systems, and data exfiltration before encryption.
Stage 4 — Ransomware deployment: The Nitrogen encryptor is deployed after the threat actor has completed data theft and positioned themselves for maximum impact. The encryptor targets Windows systems and, in campaigns targeting larger organisations, VMware ESXi hypervisors.
The February 2026 Broken Decryptor Incident
In February 2026, The Register reported that Nitrogen’s decryptor tool contained a coding error that prevented victim file recovery even after payment. The bug was identified when multiple victims who paid the ransom reported that decryption failed. The group was unable to provide a working decryptor to resolve the issue.
This incident has implications for organisations facing a Nitrogen ransomware attack:
Payment does not guarantee recovery. The documented decryptor failure demonstrates operational immaturity in Nitrogen’s software development. Even if payment is made and a decryptor is delivered, the technical risk of continued data loss is elevated above average for this group.
Negotiation leverage shifts. The group’s credibility as a reliable decryption provider is damaged. Incident responders and ransomware negotiators dealing with Nitrogen should factor the broken decryptor history into risk calculations and recovery planning.
The incident follows a pattern seen with other groups using builder-derived code: the encryption implementation works correctly, but the corresponding decryption tooling is undertested and fails in edge cases related to file types, sizes, or volume configurations.
Targeting and Sector Focus
Nitrogen’s victim profile reflects the initial access methodology. Malvertising targeting IT professionals generates initial access in organisations where IT staff have significant system privileges — which tends to be mid-market and enterprise environments rather than small businesses with minimal IT function.
Documented Nitrogen victims span manufacturing, legal services, technology, and professional services sectors, predominantly in North America and Western Europe. Halcyon AI documented a manufacturing sector targeting campaign in which Nitrogen conducted multiple simultaneous attacks against manufacturers, consistent with the group’s opportunistic approach of converting initial access into ransomware deployment based on victim network value rather than targeted sector selection.
Victim selection appears primarily financial: organisations with revenue and data assets sufficient to make ransom payment economically rational. The group does not appear to avoid regulated sectors or critical infrastructure, and healthcare and financial services victims appear in the observed victim set.
MITRE ATT&CK Mapping
| Phase | Technique | ID |
|---|---|---|
| Initial Access | Drive-by Compromise (malvertising) | T1189 |
| Execution | User Execution: Malicious File | T1204.002 |
| Persistence | DLL Side-Loading | T1574.002 |
| Defense Evasion | Masquerading: Match Legitimate Name | T1036.005 |
| Credential Access | OS Credential Dumping | T1003 |
| Discovery | Network Service Discovery | T1046 |
| Lateral Movement | Remote Services | T1021 |
| Collection | Data from Local System | T1005 |
| Exfiltration | Exfiltration Over Web Service | T1567 |
| Impact | Data Encrypted for Impact | T1486 |
Defensive Recommendations
Block malvertising vectors. DNS filtering and web proxy categorisation that blocks newly registered domains and known malvertising infrastructure reduces exposure. Ad-blocking at the network proxy level for corporate browsing prevents the initial malvertising click.
Software allowlisting for administrative tools. IT administrator systems should only be permitted to run software from approved sources — vendor-signed binaries from known good hashes or a curated internal repository. Installation of IT tools from arbitrary internet sources should be blocked at the endpoint.
MOTW enforcement. Ensure Windows Attachment Services Mark-of-the-Web propagation is enforced and that the BlockContentFromMicrosoftUpdate and related Group Policy settings are configured. ISO and IMG mounting from internet sources should be restricted.
Monitor for Cobalt Strike IOCs. Nitrogen’s Stage 2 payload is a Cobalt Strike beacon. Organisations with endpoint detection tools should have Cobalt Strike detection tuned, particularly for in-memory execution patterns that do not touch disk.
Backup immutability. Nitrogen’s deployment of ESXi-targeting ransomware variants means backup infrastructure residing on virtualised storage is at risk. Immutable backup copies stored offline or in a separate cloud account with Object Lock are required for reliable recovery.
Decryptor failure contingency planning. Given the documented February 2026 decryptor failure, incident response plans should include contingency procedures for decryption failure even in payment scenarios: shadow copies, Veeam or equivalent backup recovery, and forensic preservation of encrypted volumes before any decryption attempt.