Threadlinqs IntelligenceStart free

Threat actorRussiaTracked since 2026-05

Nitrogen

Also known as:LockBitNitrogen GroupNitrogen OperatorsNitrogen Ransomware

As of 2026-07-27, Nitrogen is a Russia-nexus threat actor tracked by Threadlinqs Intelligence across 2 threats spanning ransomware. Also known as LockBit, Nitrogen Group, Nitrogen Operators, Nitrogen Ransomware. ATT&CK coverage spans 78 techniques across 15 tactics in 2 of 2 tracked threats. Most-observed techniques: T1003 (OS Credential Dumping), T1018 (Remote System Discovery), T1021 (Remote Services).

Tracked threats
21 critical · 1 medium
First seen
2026-05-13
Last seen
2026-07-22
ATT&CK techniques
78across 2 of 2 threats
Related CVEs
6Referenced by its activity
Attribution
RussiaNation or origin
Nation: Russia · 2 tracked threat(s) · Categories: RANSOMWARE

Activity timeline

Nitrogen appears in 2 tracked threats between and ; the busiest month was 2026-05 with 1 report.

ATT&CK techniques observed

78 techniques observed across 2 of 2 tracked threats · Discovery (13), Stealth (formerly Defense Evasion) (11), Execution (10), Persistence (6), Initial Access (5), Command and Control (4)
  • T1003 OS Credential Dumping — Credential Accessobserved in 2 of 2 tracked threats
  • T1018 Remote System Discovery — Discoveryobserved in 2 of 2 tracked threats
  • T1021 Remote Services — Lateral Movementobserved in 2 of 2 tracked threats
  • T1036 Masquerading — Stealth (formerly Defense Evasion)observed in 2 of 2 tracked threats
  • T1039 Data from Network Shared Drive — Collectionobserved in 2 of 2 tracked threats
  • T1047 Windows Management Instrumentation — Executionobserved in 2 of 2 tracked threats
  • T1053 Scheduled Task/Job — Persistenceobserved in 2 of 2 tracked threats
  • T1055 Process Injection — Stealth (formerly Defense Evasion)observed in 2 of 2 tracked threats
  • T1059 Command and Scripting Interpreter — Executionobserved in 2 of 2 tracked threats
  • T1070 Indicator Removal — Stealth (formerly Defense Evasion)observed in 2 of 2 tracked threats
  • T1071 Application Layer Protocol — Command and Controlobserved in 2 of 2 tracked threats
  • T1083 File and Directory Discovery — Discoveryobserved in 2 of 2 tracked threats
  • T1105 Ingress Tool Transfer — Command and Controlobserved in 2 of 2 tracked threats
  • T1189 Drive-by Compromise — Initial Accessobserved in 2 of 2 tracked threats
  • T1484 Domain or Tenant Policy Modification — Defense Impairmentobserved in 2 of 2 tracked threats

Tracked threats

Related CVEs

6 CVEs referenced by tracked Nitrogen activity