nitrogen ransomware group

Nitrogen began as a malware loader in 2023 used to deliver BlackCat/ALPHV ransomware, then evolved into a fully independent ransomware operator by mid-2024, operating its own strain derived from leaked Conti 2 builder code and conducting double-extortion attacks primarily linked to Eastern European infrastructure.

Claims in 7 days: 0
Claims in 30 days: 1
Reported techniques: 15

Listings on leak sites are claims by criminals. They are unverified and can be false. coldbraid shows counts here, not names.

Where it claims victims

Country	Claims in 60 days
United States	1

Sectors

Sector	Claims in 60 days
Manufacturing	1

Reported techniques

Drive-by Compromise Command and Scripting Interpreter User Execution Scheduled Task/Job Exploitation for Privilege Escalation Obfuscated Files or Information System Binary Proxy Execution OS Credential Dumping System Service Discovery Process Discovery Remote Services Automated Collection Automated Exfiltration Exfiltration Over C2 Channel Application Layer Protocol

Ransomware tracker