HOMETHREATSNitrogen Loader
APT / THREAT GROUP

Nitrogen Loader

1
victims
2
aliases
Last seen:Mar 17, 2026

Intelligence Profile

Malware family tracked by Malpedia. ID: win.nitrogen

Threat Analysis

Nitrogen Loader is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

Ransomware Victims (1)

CTIWATCH tracks 1 organizations claimed as victims by Nitrogen Loader on its data leak site, with attack dates, sectors and countries.

View full victims list →

External References

→https://labs.withsecure.com/content/dam/labs/docs/W_Intel_Research_KeePass_Trojanised_Malware_Campaign.pdf
→https://news.sophos.com/en-us/2023/07/26/into-the-tank-with-nitrogen/
→https://thedfirreport.com/2024/09/30/nitrogen-campaign-drops-sliver-and-ends-with-blackcat-ransomware/
→https://www.esentire.com/blog/nitrogen-campaign-2-0-reloads-with-enhanced-capabilities-leading-to-alphv-blackcat-ransomware
→https://www.esentire.com/blog/persistent-connection-established-nitrogen-campaign-leverages-dll-side-loading-technique-for-c2-communication

Quick Facts

TypeAPT / Threat Group
Aliases2

Also Known As

win.nitrogenNitrogen Loader

External Intelligence

Malpedia: win.nitrogen

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Nitrogen Loader Victims (1)·Geopolitics Map·Search Nitrogen Loader