A new ransomware strain, dubbed Nitrogen, has emerged as a significant threat over the past four months, targeting organizations across industries including construction, financial services, manufacturing, and technology.

The ransomware has been particularly active in the USA, Canada, and the UK, leveraging advanced tactics to infiltrate networks and extort victims.

Nitrogen employs a sophisticated attack chain that begins with initial access through malicious advertisements on Google and Bing search engines.

These ads redirect victims to fake software download sites impersonating legitimate applications such as AnyDesk, Cisco AnyConnect, and WinSCP, SOPHOS observed.

Once downloaded, the trojanized installers deploy Nitrogen malware, which establishes persistence using registry keys and facilitates further malicious actions through tools like Cobalt Strike and Meterpreter shells.

After gaining a foothold in the victim’s network, Nitrogen executes its ransomware payload. The malware encrypts files using strong encryption algorithms and appends the .NBA extension to affected files.

It drops a ransom note named `readme.txt` in multiple directories, warning victims of data theft and encryption. The note threatens to publish stolen data on a dark web blog if the ransom is not paid promptly.

Advanced Evasion Techniques

Nitrogen incorporates several anti-analysis mechanisms to evade detection. These include:

Debugger and virtual machine detection: Preventing analysis in controlled environments.
Code obfuscation: Using techniques like stack strings to hinder reverse engineering.
System discovery: Enumerating system information and Portable Executable (PE) sections to identify high-value targets.

Nitrogen’s ransom note emphasizes the severity of the attack by combining encryption with data exfiltration—a hallmark of double-extortion ransomware.

Victims are warned against seeking help from third parties or law enforcement, with claims that such actions could lead to irreversible data loss or legal penalties under regulations like GDPR.

The attackers offer decryption tools, proof of data deletion, and security recommendations upon payment while using fear tactics to pressure compliance.

Nitrogen has shown a particular focus on critical sectors where downtime can have cascading effects.

Manufacturing remains one of the most impacted industries globally, while financial services and technology firms are also frequent targets.

The USA has been the most affected geography, accounting for over 50% of incidents in recent months. Organizations are advised to adopt robust cybersecurity measures to defend against Nitrogen ransomware:

Regularly update software and patch vulnerabilities.
Implement multi-factor authentication (MFA) for all critical systems.
Conduct employee training to recognize phishing attempts.
Use endpoint detection and response (EDR) solutions to identify malicious activities early.

As ransomware groups like Nitrogen continue to evolve their tactics, proactive defense strategies remain crucial for minimizing risks and ensuring operational resilience.

Investigate Real-World Malicious Links, Malware & Phishing Attacks With ANY.RUN – Try for Free

The post Nitrogen Ransomware Attacks Encrypts Files With .NBA Extension appeared first on Cyber Security News.