Loading story…
Incident responders at Coveware reported a critical implementation flaw in the Nitrogen ransomware variant targeting VMware ESXi: the malware encrypts victim files using a corrupted Curve25519 public key, meaning the corresponding private key does not exist and even the threat actor cannot decrypt affected data. As a result, victims without viable backups are unlikely to recover encrypted ESXi systems, and paying a ransom will not yield a working decryptor.
Technical analysis attributes the failure to a stack-variable overlap in the ESXi encryptor: the public key is placed at rsp+0x20, but a subsequent QWORD write at rsp+0x1c overwrites the first four bytes of that key, breaking the public/private key relationship required to derive the shared secret used for file encryption (Curve25519 key exchange feeding a ChaCha8 key). Reporting also notes Nitrogen has operated since 2023 and is assessed to be derived from the leaked Conti 2 builder code, consistent with multiple Conti-based ransomware offshoots.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Veeam published a technical analysis of the Nitrogen ESXi ransomware flaw, describing it as consistent with a common off-by-one programming error. The write-up reinforced that the key corruption makes practical decryption infeasible and leaves backup restoration as the main recovery option.
Coveware published analysis showing Nitrogen's ESXi encryptor contains a critical implementation flaw that corrupts the Curve25519 public key during encryption. The bug means affected ESXi files cannot be decrypted even by the attackers, making ransom payment ineffective for those victims.
Coveware assessed that Nitrogen transitioned into active ransomware extortion around September 2024. This marked its evolution from earlier malware and access-related activity into a full extortion operation.
Nitrogen began operating in 2023 as a ransomware threat actor. Reporting describes it as an offshoot with code lineage tied to the leaked Conti 2 builder.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
tomshardware.com
Open sourcedatabreaches.net
Open sourcescworld.com
Open sourcego.theregister.com
Open sourcecoveware.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Rapid7 reported that a **Kyber ransomware** affiliate deployed two distinct payloads in the same March 2026 intrusion, targeting both **VMware ESXi** infrastructure and **Windows file servers** to maximize operational disruption. The ESXi variant encrypted VMware datastore files, could optionally terminate virtual machines, and defaced SSH and web management interfaces with ransom notes. The Windows variant targeted core file systems and added broader impact features, including killing backup-, database-, and IIS-related services, deleting shadow copies, disabling recovery options, clearing event logs, and testing an experimental **Hyper-V** shutdown capability. The two samples shared the same campaign ID and **Tor-based** negotiation and leak infrastructure, linking them to the same affiliate, but their internals differed sharply. Rapid7 found the ESXi payload falsely advertised post-quantum protection with `Kyber1024`; in practice, it used **ChaCha8** with **RSA-4096** key wrapping. By contrast, the Windows variant, written in **Rust**, appeared to implement the claimed hybrid scheme using **AES-256-CTR**, `Kyber1024`, and **X25519**. Public reporting indicates the group remains relatively new, with limited prior technical analysis and only one victim publicly listed on its extortion site: a large U.S. defense contractor and IT services provider.
Jun 29, 2026
A large-scale **ESXiArgs** ransomware campaign hit internet-exposed VMware ESXi servers by exploiting a long-known vulnerability in the OpenSLP service, with incident responders and national authorities warning that many affected systems had not applied available patches. CERT-FR issued an alert on active exploitation affecting VMware ESXi, while broad reporting described widespread compromises across organizations globally as attackers encrypted virtual machine files and dropped ransom notes on hypervisors. VMware said the attacks did **not** stem from a newly discovered zero-day, but from exploitation of older, already patched weaknesses and insecurely exposed services on unsupported or unpatched ESXi versions. The incident renewed scrutiny of VMware security after earlier warnings that threat actors, including state-backed operators, had abused VMware flaws such as `CVE-2020-4006` for initial access, persistence, and privileged movement inside enterprise environments, underscoring the risk posed by internet-facing virtualization infrastructure that lags on patching and hardening.
Jun 29, 2026
Researchers reported that **VECT 2.0** ransomware can permanently damage files through flaws in its own encryption and decryption logic, leaving victims unable to restore data even if they receive the attackers’ decryptor. Analysis of the Windows variant found that the malware appends the `.vect` extension, targets a wide range of business files on 64-bit systems, and stores too little recovery metadata to reliably reconstruct what happened to each file. Implementation defects reportedly include lost encryption material for large files, buffer-size mismatches affecting mid-sized files, and race conditions caused by shared global buffers across worker threads, resulting in files that may be only renamed, partially encrypted, or structururally corrupted. Separate reporting describes VECT as a **double-extortion ransomware-as-a-service** operation with support for Windows, Linux, and VMware ESXi, using lateral movement, defense evasion, shadow-copy deletion, and safe-mode reboot techniques before encryption. The group is linked in reporting to TeamPCP and possible overlaps with Devman, with alleged access from earlier supply-chain compromises involving Trivy, Checkmarx KICS, LiteLLM, and Telnyx feeding later intrusions. Because a critical flaw in VECT’s ChaCha20-based intermittent encryption can render large-file data unrecoverable, defenders are being urged to treat VECT incidents as both ransomware and destructive data-loss events rather than assuming payment will enable recovery.
Jun 29, 2026