Nitrogen Active
Malvertising-based initial access0
Total Victims
2024-09-01
First Seen
N/A
Last Seen
21
Known TTPs
16.9d
Avg Delay
0
Negotiations
ONION URLS
nitrogenczslprh3xyw6lh5xyjvmsz7ciljoqxxknd7uymkfetfhgvqd.onion
6lrsxvqscxtznb4fhux5u3vbslbanxjzxzgtokjtfwaitxe4pfgfebad.onion
TOOLS
Malvertising
Cobalt Strike
FILE EXTENSIONS
.nitrogen
ACTIVITY TIMELINE
TOP SECTORS
TOP COUNTRIES
ACTIVITY HEATMAP
| Date | Victim Name | Country | Sector | Status |
|---|---|---|---|---|
| No victims recorded | ||||
| Technique ID | Technique Name | Tactic |
|---|---|---|
| T1039 | Data from Network Shared Drive | Collection |
| T1560.001 | Archive via Utility | Collection |
| T1090 | Proxy | Command and Control |
| T1573.002 | Asymmetric Cryptography | Command and Control |
| T1003.001 | LSASS Memory | Credential Access |
| T1110.003 | Password Spraying | Credential Access |
| T1555.003 | Credentials from Web Browsers | Credential Access |
| T1027 | Obfuscated Files or Information | Defense Evasion |
| T1049 | System Network Connections Discovery | Discovery |
| T1059.001 | PowerShell | Execution |
| T1204.001 | Malicious Link | Execution |
| T1204.002 | Malicious File | Execution |
| T1041 | Exfiltration Over C2 Channel | Exfiltration |
| T1567.002 | Exfiltration to Cloud Storage | Exfiltration |
| T1486 | Data Encrypted for Impact | Impact |
| T1078 | Valid Accounts | Initial Access |
| T1098 | Account Manipulation | Persistence |
| T1136.001 | Local Account | Persistence |
| T1547.001 | Registry Run Keys | Persistence |
| T1068 | Exploitation for Privilege Escalation | Privilege Escalation |
| T1548.002 | Bypass UAC | Privilege Escalation |
No YARA rules
No ransom notes