Threat Intelligence Report October 28 - November 3 2025

Nitrogen Ransomware

Threat Summary

Nitrogen ransomware is a double-extortion threat group active since mid-to-late 2024. The group became notorious for exploiting malvertising vectors to deliver payloads that disable security tooling and encrypt systems using the .NBA extension. As of 31 October 2025, Nitrogen had claimed over 34 publicly named victims on its dark web leak site. It continues to target organizations across financial, manufacturing, legal, and IT sectors.

Tactics, Techniques, and Procedures (TTPs)

Initial Access

• T1189 - Drive-by Compromise: Poisoned Google/Bing ads impersonate software like WinSCP, AnyDesk, etc.
• T1583.008 - Acquire Infrastructure: Malvertising: Threat actors create fake download portals mimicking legitimate software.
• T1204.002 - User Execution: Malicious File: Victim executes ISO-packaged installer leading to DLL sideloading.
   

Execution

• T1218 - Signed Binary Proxy Execution: DLL sideloading via legitimate software like Advanced_IP_Scanner.exe.
• T1059 - Command and Scripting Interpreter: Malicious Python execution via bundled pythonw.exe.
   

Persistence

• T1053 - Scheduled Task/Job: Registry keys or scheduled tasks created for payload execution.
• T1547.001 - Registry Run Keys/Startup Folder: Persistence using Windows Run keys.
   

Privilege Escalation

• T1068 - Exploitation for Privilege Escalation: Use of known vulnerable drivers.
   

Defence Evasion

• T1562.001 - Disable or Modify Tools: Uses truesight.sys to terminate AV/EDR.
• T1562.009 - Safe Mode Boot Modification: Executes bcdedit.exe to disable Safe Boot.
• T1027 - Obfuscated Files or Information: Obfuscated Python and sideloaded components.
   

Credential Access

• T1003.001 - LSASS Memory: Harvesting credentials from memory.
   

Discovery

• T1057 - Process Discovery: Enumerates processes for EDR detection.
• T1007 - System Service Discovery
   

Lateral Movement

• T1021.002 - SMB/Windows Admin Shares
• T1021.001 - Remote Services: RDP
   

Command and Control

• T1071.001 - Web Protocols: HTTP/S over non-standard ports (e.g., 8443, 10443).
   

Exfiltration

• T1041 - Exfiltration Over C2 Channel: Exfiltration of sensitive files before encryption.
   

Impact

• T1486 - Data Encrypted for Impact: Ransomware encrypts data using .NBA extension.
• T1490 - Inhibit System Recovery: Deletes shadow copies and disables recovery.

MITRE ATT&CK Mapping Table

Indicators of Compromise (IOCs)

• File Extensions: .NBA
• Ransom Note: readme.txt, READ_ME_.TXT
• Mutex: nvxkjcv7yxctvgsdfjhv6esdvsx
• Tox IDs:
  • 46CA5EEC55A16767B7F8293DB18F753D1BF60C536747EFD115035DDA40948427E1DDFD107F03
  • 088B7708F2C1557B6023B1102FFC5C36C023FF4883CB073F26A33B73832C9268993ED58B817E
• Hashes:
  • 55f3725ebe01ea19ca14ab14d747a6975f9a6064ca71345219a14c47c18c88be
• C2 Infrastructure IPs/Ports:
  • 185.216.70.236:8443
  • 194.180.48.149:8443
  • 194.180.48.18:10443
  • 171.22.28.245:41337
  • 194.169.175.132
  • 193.42.33.29
• Malicious Domains:
  • xn--wnscp-tsa[.]net (homograph for WinSCP)
• Tor Comm Links

http://nitrogenczslprh3xyw6lh5xyjvmsz7ciljoqxxknd7uymkfetfhgvqd.onion

Support Chat

http://ws6uapok34o3uvn3v6nru574urlvlbn5u3pi2xzyg765vpv2fixcm4ad.onion

Crystal Eye 5.5 Mitigation Strategy

1. Initial Access Mitigations
   • Block ads and unauthorised browser install on endpoints.
   • Monitor for ISO execution from downloads folder.
   • Prevent drive-by downloads using browser hardening and policy restrictions.
2. Persistence & Lateral Movement
   • Implement CE segmentation policies: restrict SMB/WinRM/PsExec to jump boxes only.
   • Log scheduled task and Run key creation to CE SIEM with alerting.
3. Defence Evasion & Recovery Inhibition
   • Block known vulnerable driver hashes and verify code signing.
   • Monitor for bcdedit.exe commands disabling Safe Boot.
   • Isolate hosts on vssadmin or wevtutil execution.
4. Command & Control/Exfiltration
   • Disable QUIC, monitor JA3/SNI for rclone/WinSCP and suspicious TLS tunnels.
   • Block exfil services (MEGA, Dropbox, Syncthing) at DNS/Surge layers.
5. Backup & Recovery
   • Keep backups offline/immutable with no Internet egress.
   • Verify restores quarterly under test conditions.

Ransomware Victims Worldwide

The United States once again dominated global ransomware targeting this week, accounting for 55.83% of all reported victims. Its massive digital footprint, economic value, and concentration of critical industries continue to make it the world’s most targeted region.

The United Kingdom (5.83%) and Canada (5.34%) followed as the next most affected nations, reaffirming persistent targeting across North America and Western Europe. These countries remain attractive due to high data density and the likelihood of ransom negotiations.

France (4.37%) and Germany (2.91%) represented the top European mainland targets, followed by Spain (2.43%) and the United Arab Emirates (2.43%), demonstrating ransomware’s balanced focus across Western economies and strategic Middle Eastern hubs.

Other mid-tier victims included Australia (1.46%), Malaysia (1.94%), Turkey (1.46%), Italy (0.97%), Netherlands (0.97%), India (0.97%), and Singapore (0.97%), illustrating sustained campaigns against digitally advanced Asia-Pacific nations.

A broad long-tail of isolated incidents (each 0.49%) extended across Saudi Arabia, Brazil, South Korea, China, Japan, New Zealand, Mexico, Israel, Poland, Vietnam, Indonesia, Nigeria, Colombia, Ecuador, Ukraine, Kuwait, Sweden, Finland, Morocco, and Konsise. While these numbers are individually small, they highlight ransomware’s continued global expansion and opportunistic victimisation across every continent.