CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Nitrogen

actor · actor:nitrogen

Ransomware group first observed in 2023 and believed to use a builder based on the Conti ransomware (Barracuda, via The Record); Coveware documented a bug in its ESXi encryptor that leaves files unrecoverable (2026-02-02). Claimed the May 2026 attack on Foxconn's North American factories.

Coverage
1
first 2026-05-13 → last 2026-10-21
Latest activity
2026-05-13
Foxconn confirms a cyberattack on North American factories; Nitrogen claims 8 TB of Apple, Nvidia and other…
Peak priority
notable
1 notable
Targets
manufacturing
sectors: manufacturing · regions: us
Sources cited
4
4 hosts

Defender insights

What each entry about Nitrogen tells a defender to do, newest first.

2026-05-13NOTABLEFoxconn confirms a cyberattack on North American factories; Nitrogen claims 8 TB of Apple, Nvidia and other project data

Exposure

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

related to

Story timeline

  1. 2026-05-13Foxconn confirms a cyberattack on some North American factories after Nitrogen claims theft of 8 TB of customer project data
    active-threatsFoxconn confirms a cyberattack on North American factories; Nitrogen claims 8 TB of Apple, Nvidia and other project data

Hunting pivots

Tags
data-breachransomwaresupply-chain
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • ImpactData Encrypted for Impact

Impact TA0040

T1486Data Encrypted for Impact×1

Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.

Evidence: 2026-05-13/foxconn-confirms-nitrogen-ransomware-crippled-north-american · ATT&CK page ↗

Entries about Nitrogen (1)

2026-05-13 · view entry permalink →

NOTABLEupdatedNATOB2

Foxconn confirms a cyberattack on some North American factories after Nitrogen claims theft of 8 TB of customer project data

Foxconn said some of its factories in North America suffered a cyberattack, that its cybersecurity team activated its response mechanism to keep production and delivery going and that the affected factories were resuming normal production; a spokesperson declined to say how many factories were hit (The Record, 2026-05-12), and Foxconn declined to confirm that any customer's information was taken (The Register, 2026-05-12). The Nitrogen ransomware gang took credit on Monday 2026-05-11 (The Record, 2026-05-12), claiming 8 TB of data comprising more than 11 million files, with confidential instructions, internal project documentation and technical drawings related to projects at Intel, Apple, Google, Dell and Nvidia, among others (The Register, 2026-05-12). Workers at the Mount Pleasant, Wisconsin campus reported a network collapse from Friday 2026-05-01, according to The Cybersec Guru as quoted by 9to5Mac, and AppleInsider reports that a Houston, Texas facility also appears to have been affected (9to5Mac, 2026-05-12). Nitrogen's ransomware is believed to have been created with a builder based on the defunct Conti ransomware, and Barracuda describes the group as first observed in 2023 (The Record, 2026-05-12); Coveware found that a coding mistake in Nitrogen's ESXi encryptor overwrites four bytes of the public key, so files are encrypted with a corrupted key that nobody, the attackers included, can decrypt (Coveware, 2026-02-02).

The affected factories are currently resuming normal production

A spokesperson for the company confirmed the incident but declined to provide specifics on how many factories in North America were impacted.

The Record 2026-05-12

stolen 8 TB of data comprising more than 11 million files

Foxconn declined to confirm that these - or any - customers' information was hoovered up in the digital intrusion.

The Register 2026-05-12

Any ESXi encrypted files that are without viable backups, must be analyzed in conjunction with the corresponding malware that encrypted them to ascertain their status.

Coveware 2026-02-02
Correctionrun 2026-10-21T1148Z-auditaffected_productsbodyclassificationconfidenceevidenceheadlineprioritysourcessourcing_notesummarytechniquestitleentities

Foxconn's statement confirms that some of its North American factories suffered a cyberattack and are resuming normal production; it does not name sites, a start time or how long production stopped, and Foxconn declined to say how many factories were hit or to confirm that customer data was taken (The Record, 2026-05-12; The Register, 2026-05-12). Wisconsin, Ohio, Texas, Virginia, Indiana and several sites in Mexico are where Foxconn has factories, and Foxconn declined to say how many were impacted (The Record, 2026-05-12); the Mount Pleasant outage from 2026-05-01 comes from workers quoted by The Cybersec Guru, and Houston from AppleInsider (9to5Mac, 2026-05-12). Coveware's finding concerns Nitrogen's ESXi encryptor, whose bug leaves files unrecoverable even for the attackers, and its advice is to analyse encrypted files against the specific malware sample before assuming they can or cannot be recovered (Coveware, 2026-02-02).

incident13 May 05:00Zmulti-sourceOpen finding →
Sources: The Register · The Record · 9to5Mac · Coveware

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1

Source distribution

  • 9to5mac.com1 (25%)
  • coveware.com1 (25%)
  • therecord.media1 (25%)
  • theregister.com1 (25%)
All cited sources (4)