Nitrogen Dropping Cobalt Strike – A Combination of 'Chemical Elements'

The Nitrogen ransomware group has expanded its operations from North America to Africa and Europe since September 2024. They utilize malvertising tactics, disguising malicious payloads as legitimate software like WinSCP. The group employs DLL sideloading for initial access, followed by Cobalt Strike for lateral movement and post-exploitation activities. The analysis reveals their use of a compromised host as a pivot system and attempts to cover tracks by clearing Windows logs. The investigation uncovered Cobalt Strike configurations through pattern analysis, byte-level XOR decryption, and custom YARA rules. Crash dump analysis using Windows Error Reporting artifacts and WinDBG proved crucial in identifying in-memory indicators of Cobalt Strike beacons and related structures.

Pulse ID: 68152a24acebea26273bad51
Pulse Link: https://otx.alienvault.com/pulse/68152a24acebea26273bad51
Pulse Author: AlienVault
Created: 2025-05-02 20:25:08

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Africa #CobaltStrike #CyberSecurity #Europe #ICS #InfoSec #Malvertising #Nitrogen #NorthAmerica #OTX #OpenThreatExchange #RAT #RansomWare #SideLoading #WinSCP #Windows #bot #AlienVault

Dans le petit monde de l'informatique de la Fonction Publique, il y a des outils qui reviennent très souvent, autant chez les collègues que chez nos prestataires :

#dbeaver
#draw_io
#filezilla
#notepad++
#winscp

  en connais tu d'autres à poartager, ou des alternatives plus effaces à ceux ci-dessus ?

#logicielslibres #logiciellibre