HOMETHREATSNitrogen Loader
MALWARE FAMILY

Nitrogen Loader

Internal ID: win.nitrogen
48
victims
1
campaigns
1
aliases
Last seen:Mar 17, 2026

Intelligence Profile

Malware family identifying win.nitrogen. Origin and technical characteristics tracked via Malpedia.

Threat Analysis

Nitrogen Loader is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

Ransomware Victims (48)

CTIWATCH tracks 48 organizations claimed as victims by Nitrogen Loader on its data leak site, with attack dates, sectors and countries.

View full victims list →

Known Campaigns

Nitrogen — Active Campaign March 2026

Nitrogen is conducting an active ransomware campaign targeting organizations across 2 countries. Primary targets: Technology. 2 confirmed victims recorded in the last 45 days. Campaign status: ACTIVE (last activity 19 Mar 2026).

🎯 Technology
LOW2026

External References

→https://labs.withsecure.com/content/dam/labs/docs/W_Intel_Research_KeePass_Trojanised_Malware_Campaign.pdf
→https://news.sophos.com/en-us/2023/07/26/into-the-tank-with-nitrogen/
→https://thedfirreport.com/2024/09/30/nitrogen-campaign-drops-sliver-and-ends-with-blackcat-ransomware/
→https://www.esentire.com/blog/nitrogen-campaign-2-0-reloads-with-enhanced-capabilities-leading-to-alphv-blackcat-ransomware
→https://www.esentire.com/blog/persistent-connection-established-nitrogen-campaign-leverages-dll-side-loading-technique-for-c2-communication
→https://www.nextron-systems.com/2025/04/29/nitrogen-dropping-cobalt-strike-a-combination-of-chemical-elements/

Quick Facts

TypeMalware Family
Aliases1

Also Known As

win.nitrogen

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Nitrogen Loader Victims (48)·Geopolitics Map·Search Nitrogen Loader