Cyber Threat Actor: Nitrogen

Nitrogen is a ransomware group that has been publicly identified by the alias Nitrogen and operates as a double‑extortion ransomware gang, encrypting victims’ systems while also exfiltrating data to threaten leakage. The group claimed responsibility for a cyberattack on Foxconn that was disclosed on May 11 2026, stating that it stole over eleven million files, including confidential information from customers such as Apple, Google, and Nvidia, and published sample screenshots of schematics and financial documents as proof of the breach. The attack disrupted some of Foxconn’s North American factories, although production has since resumed according to the company’s statements. No further details about the group’s internal structure, size, or affiliations have been made public in the available reporting.

In the Foxconn incident Nitrogen employed ransomware to encrypt systems and conducted data exfiltration as part of its double‑extortion approach, a tactic that combines encryption with the threat of releasing stolen information unless a ransom is paid. The public sources do not specify the particular malware families, initial access vectors, or tooling used by Nitrogen in this operation, limiting the observable TTP themes to the described encryption and data theft behavior. Consequently, any characterization of the group’s typical infection methods or preferred tools would rely on information not present in the provided material.

The Foxconn attack represents the most notable and publicly reported campaign attributed to Nitrogen to date, illustrating the group’s capacity to target a major electronics manufacturer and affect its production facilities in North America. Aside from this incident, no additional campaigns, attribution to state actors or criminal consortia, or broader targeting patterns have been documented in the sources available. Therefore, the profile remains confined to the confirmed facts surrounding the May 2026 Foxconn breach and the group’s self‑described double‑extortion ransomware activity.