Nitrogen
Nitrogen began as a malware loader spread through malicious ads for IT tools and is now a ransomware brand with a leak site. A flaw in its ESXi encryptor means those files cannot be decrypted even if a victim pays.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
Nitrogen targets the people who hold the keys. Sophos and Barracuda describe ads for tools such as WinSCP, AnyDesk, Cisco AnyConnect and PuTTY that lead to trojanised installers, aimed at IT professionals and other technical users.3,1
Paying may not bring ESXi data back. Coveware found that a coding error in the ESXi encryptor corrupts the public key used to lock files, so no matching private key exists, as reported by Bitdefender and BleepingComputer.4,2
Barracuda lists the UK among victim countries, without detail.1 In May 2026, a major electronics manufacturer confirmed that some of its North American factories had suffered a cyber attack, after Nitrogen claimed it. The firm did not address the group's data theft figures.2
Staff with admin rights are the target here, so we would restrict how IT tools are obtained. For ESXi, we would plan on the basis that the ransom is not a recovery option.
How It Attacks
Combines Sophos's 2023 loader analysis with Barracuda's later ransomware reporting.3,1 Details may have changed.
- 1
Bait With Ads
Search ads lead to lookalike or compromised sites offering IT tools.
- 2
Run the Installer
A trojanised installer sideloads a malicious DLL.
- 3
Establish a Foothold
Persists through registry run keys or scheduled tasks and bypasses UAC.
- 4
Bring in Follow-On Tools
Loads post-exploitation tools such as Cobalt Strike and Sliver.
- 5
Steal and Encrypt
Exfiltrates data before encryption, then clears event logs. ESXi hosts are also targeted.
Key Techniques
Our mapping of the behaviour Sophos and Barracuda describe.3,1 ATT&CK v20 has no entry for this group.
| ID | Technique | Tactic | What It Looks Like |
|---|---|---|---|
| T1583.008 | Malvertising | Resource Development | Buys ads for IT tools in search results. |
| T1204.002 | Malicious File | Execution | User runs a trojanised installer. |
| T1574.001 | DLL | Stealth | Sideloads a malicious DLL. |
| T1548.002 | Bypass User Account Control | Privilege Escalation | Reported by Sophos. |
| T1547.001 | Registry Run Keys / Startup Folder | Persistence | Persists through a run key. |
| T1053.005 | Scheduled Task | Persistence | Persists through a scheduled task. |
| T1552.006 | Group Policy Preferences | Credential Access | Searches for stored password values. |
| T1685.005 | Clear Windows Event Logs | Defense Impairment | Removes forensic artefacts. |
| T1486 | Data Encrypted for Impact | Impact | Own ransomware, and earlier BlackCat. |
Tools Observed
Post-Exploitation
Ransomware
Vulnerabilities
The sources we reviewed do not tie a CVE to Nitrogen. The ESXi flaw is a bug in the criminals' own code.4
Defences That Matter
Control Software Sources
- Be wary of search ads and consider ad blockers that also block search engine ads.3
- Provide IT tools through an approved internal catalogue.
Restrict Disk Images
- Consider restricting virtual file system mounting through Group Policy.3
- Consider disabling auto-mounting of ISO, VHD and IMG files.3
Remove Stored Credentials
- Search for credentials stored in the registry and fix them.3
Protect ESXi Recovery
- Keep hypervisor backups separate and offline, as paying may not restore ESXi data.
- Test recovery of virtual machines.
Where Do Your Admins Get Their Tools?
We can help you reduce malvertising risk and test your ESXi recovery plans.
Sources
- Barracuda: Nitrogen ransomware: From staged loader to full-scale extortion, 7 November 2025, updated 3 September 2026
- BleepingComputer: report on an electronics manufacturer confirming an attack on North American factories, 13 May 2026
- Sophos X-Ops: Into the Tank with Nitrogen, updated 26 July 2023
- Bitdefender: Nitrogen ransomware ESXi bug makes decryption impossible even after payment, 5 February 2026
- AhnLab ASEC: May 2026 Threat Trend Report on Ransomware, 19 June 2026
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.