Nitrogen Ransomware Attacks Encrypts Files With .NBA Extension

Nitrogen is a recently observed ransomware campaign that uses malicious search ads to lure victims to fake installers for legitimate tools (e.g., AnyDesk, Cisco AnyConnect, WinSCP), which deploy a trojan that persists via registry keys, leverages Cobalt Strike and Meterpreter for lateral movement, encrypts files with a .NBA extension, and conducts double-extortion by threatening to publish stolen data; the activity has predominantly impacted manufacturing, financial services, and technology organizations in the USA, Canada, and the UK.