Nitrogen Ransomware Coding Bug Permanently Destroys ESXi Data — Curve25519 Memory Corruption Makes Decryption Mathematically Impossible, Even Attackers Can't Decrypt, Azote Group UNC4696, Malvertising via Google/Bing Ads, Conti 2 Derivative — Threadlinqs Intelligence
As of 2026-05-30, Nitrogen Ransomware Coding Bug Permanently Destroys ESXi Data — Curve25519 Memory Corruption Makes Decryption Mathematically Impossible, Even Attackers Can't Decrypt, Azote Group UNC4696, Malvertising via Google/Bing Ads, Conti 2 Derivative is a critical-severity ransomware threat attributed to Azote Group, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 35 indicators of compromise.
Threat ID: TL-2026-0105 · Severity: CRITICAL · Status: ACTIVE · Category: RANSOMWARE
Attribution: Azote Group · FINANCIAL
Nitrogen ransomware ESXi variant contains a critical Curve25519 memory bug that overwrites 4 bytes of the master public key with zeros during encryption, making decryption mathematically impossible —
Nitrogen ransomware's VMware ESXi variant contains a catastrophic cryptographic implementation bug discovered by Coveware (now Veeam) in February 2026. During file encryption using Curve25519 elliptic curve key exchange with ChaCha8 symmetric encryption, the malware stores the per-file public key as a stack variable at offset rsp+0x20. However, a subsequent QWORD (8-byte) write at rsp+0x1c overlaps and overwrites 4 bytes of the public key with zeros. This corrupted public key was never derived from any private key — it is a malformed value produced by unintended memory corruption. No corresponding private key exists in mathematical reality, making decryption fundamentally impossible by any party, including the threat actors themselves.
Nitrogen ransomware emerged from the leaked Conti 2 builder code and has been active since at least September 2024, operated by the Azote Group (tracked as UNC4696 by Mandiant). The group operates as both an Initial Access Broker and standalone ransomware operator. Initial access is gained through sophisticated malvertising campaigns on Google and Bing search engines, promoting trojanized versions of legitimate IT tools including WinSCP, Advanced IP Scanner, KeePass (via KeeLoader), PuTTY, and AnyDesk. Victims download ZIP/ISO bundles containing legitimate executables that sideload malicious Python DLLs (NitrogenLoader). The infection chain progresses through NitrogenInstaller (persistence via registry Run keys and scheduled tasks) → NitrogenStager (C2 establishment) → deployment of Sliver and Cobalt Strike beacons via Py-Fuscate obfuscated Python scripts → credential harvesting via LSASS dumps → lateral movement via Impacket wmiexec → data exfiltration via Restic → ransomware deployment.
The Windows variant encrypts files with .NBA extension and drops readme.txt ransom notes. The ESXi variant targets VMware hypervisors, where a single compromised host can impact dozens of critical VMs. The DFIR Report documented a complete intrusion where Time to Ransomware was 156 hours (8 days), culminating in BlackCat/ALPHV deployment via PsExec with Safe Mode boot for AV evasion. Nitrogen also exploits truesight.sys (a legitimate RogueKiller AntiRootkit driver listed in LOLDrivers) for BYOVD EDR/AV killing, and uses bcdedit.exe to disable Safe Boot recovery. The group shares code similarities with LukaLocker ransomware. Target sectors include finance, construction, manufacturing, technology, and nonprofits, primarily in the US, UK, Canada, Europe, and Africa. Notable victim: SRP Federal Credit Union (195,000+ customers, December 2024).
Target sectors: Finance, Construction, Manufacturing, Technology, Nonprofit, Government
Target regions: North America, Europe, United Kingdom, Africa
Detections & IOCs
As of 2026-07-20, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 35 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
RANSOMWARE, CRITICAL, threat intelligence, cybersecurity, T1583.001, T1189, T1059.006, T1059.001, T1547.001, T1053.005, T1078.002, T1574.002, T1562.001, T1027