nitrogen Ransomware
Monitorado desde 30/09/2024
0
vítimas registradas
0
nos últimos 30 dias
0
CVEs
—
Última atividade
Nitrogen began as a malware loader in 2023 used to deliver BlackCat/ALPHV ransomware, then evolved into a fully independent ransomware operator by mid-2024, operating its own strain derived from leaked Conti 2 builder code and conducting double-extortion attacks primarily linked to Eastern European infrastructure.
Vulnerabilidades citadas para este grupo
CVEs associadas ao grupo pelo ransomware.live. Fichas ainda não publicadas aparecem sem link.
Nenhuma CVE associada a este grupo nas fontes.
Táticas e técnicas (MITRE ATT&CK)
Initial Access
T1189 Drive-by Compromise Execution
T1059 Command and Scripting InterpreterT1059.001 Command and Scripting Interpreter: PowerShellT1204.002 User Execution: Malicious File Persistence
T1053 Scheduled Task/JobT1053.005 Scheduled Task/Job: Scheduled Task Privilege Escalation
T1068 Exploitation for Privilege Escalation Defense Evasion
T1027 Obfuscated Files or InformationT1218 System Binary Proxy Execution Credential Access
T1003.001 OS Credential Dumping: LSASS Memory Discovery
T1007 System Service DiscoveryT1057 Process Discovery Lateral Movement
T1021.001 Remote Services: Remote Desktop ProtocolT1021.002 Remote Services: SMB/Windows Admin Shares Collection
T1119 Automated Collection Exfiltration
T1020 Automated ExfiltrationT1041 Exfiltration Over C2 Channel Command and Control
T1071 Application Layer ProtocolT1071.001 Application Layer Protocol: Web Protocols Vítimas divulgadas em sites de vazamento, segundo o ransomware.live. Não exibimos nomes de vítimas. · Ver no ransomware.live