Group profile0 claimed in last 30d2 total tracked

nitrogen

Forward this

Nitrogen is a newly logged entry on ransomware tracking infrastructure as of early June 2026, with two claimed victims posted on the same day, both appearing to reference an entity named Pyramid, one attributed to a US location. The claim volume is minimal and the sector breakdown is absent, making pattern analysis premature at this stage. The group is described by external sources as having originated as a malware loader in 2023, reportedly used to distribute BlackCat/ALPHV payloads before allegedly transitioning into an independent ransomware operator building on leaked Conti source code, though those characterizations should be read as claimed history rather than verified fact. If the Conti-derived lineage holds, operators in this mold typically disable security tooling and leverage legitimate remote access utilities to move laterally before deploying encryption, practices well documented in that builder's known derivatives. Whether Nitrogen represents a genuinely active new campaign or a rebranding exercise remains unclear given the thin evidence base so far.

Brief by The Nexus · Jun 27 · 15:08 UTC

Nitrogen began as a malware loader in 2023 used to deliver BlackCat/ALPHV ransomware, then evolved into a fully independent ransomware operator by mid-2024, operating its own strain derived from leaked Conti 2 builder code and conducting double-extortion attacks primarily linked to Eastern European infrastructure.

First seen: Jun 3 · 00:00 UTCLast seen: Jun 3 · 16:16 UTCTracked since: 2024-09-30

Sectors hit

Unspecified1

Countries hit

United States1

MITRE ATT&CK · observed TTPs11 tactics

Tactics and techniques attributed to NITROGEN by ransomware.live's curated TTP catalog. Identifiers link to the canonical MITRE ATT&CK reference for each tactic or sub-technique.

TA0001Initial Access
- T1189Drive-by Compromise
TA0002Execution
- T1059Command and Scripting Interpreter
- T1059.001Command and Scripting Interpreter: PowerShell
- T1204.002User Execution: Malicious File
TA0003Persistence
- T1053Scheduled Task/Job
- T1053.005Scheduled Task/Job: Scheduled Task
TA0004Privilege Escalation
- T1068Exploitation for Privilege Escalation
TA0005Defense Evasion
- T1027Obfuscated Files or Information
- T1218System Binary Proxy Execution
TA0006Credential Access
- T1003.001OS Credential Dumping: LSASS Memory
TA0007Discovery
- T1007System Service Discovery
- T1057Process Discovery
TA0008Lateral Movement
- T1021.001Remote Services: Remote Desktop Protocol
- T1021.002Remote Services: SMB/Windows Admin Shares
TA0009Collection
- T1119Automated Collection
TA0010Exfiltration
- T1020Automated Exfiltration
- T1041Exfiltration Over C2 Channel
TA0011Command and Control
- T1071Application Layer Protocol
- T1071.001Application Layer Protocol: Web Protocols

Recent claimed victims

Jun 3 · 18:49 UTC

Pyramid

Covered · Daily Mail →Two tourists spark fury by scaling ancient Mexican pyramid before they are detained and barracked by enraged locals

Source ↗

United StatesJun 3 · 16:16 UTC

Pyramid

www.pyramidmg.comCovered · Daily Mail →Two tourists spark fury by scaling ancient Mexican pyramid before they are detained and barracked by enraged locals

Source ↗