Background
The Nitrogen campaign emerged in 2023 as a new approach to initial access brokering. Instead of phishing emails, technical exploitation of edge devices, or credential stuffing, the Nitrogen operators bought legitimate Google and Bing search advertisements for popular software titles, paid to appear above organic search results, and directed clicks to cloned download sites that delivered trojaned installers. The concept is simple and the execution has proven durable.
By 2026, the operation had evolved and rebranded internally as Azote, while maintaining the same fundamental malvertising methodology. The group operates as an initial access provider, with final-stage ransomware deployment via ALPHV/BlackCat affiliates once they have established a strong enough foothold in victim environments. The Foxconn North America breach, confirmed in early 2026, put the group in a different category from typical IAB operations. Eight terabytes of data including manufacturing schematics, financial records, and business contracts affecting major technology brands made it one of the most significant corporate data theft operations of the year.
How the Attack Chain Works
The malvertising pipeline has several distinct phases, and the group has refined each of them over successive campaigns.
Phase 1: Ad Placement
The group buys search advertisements through legitimate Google Ads and Microsoft Advertising accounts, either obtained through account theft or created with stolen payment credentials. The ads target high-traffic software searches: WinSCP, AnyDesk, Notepad++, PuTTY, Revo Uninstaller, Advanced IP Scanner, and similar utilities commonly downloaded by IT professionals. These titles are chosen deliberately. IT administrators and developers searching for these tools are likely operating in environments with elevated network access and system privileges.
Ad copy mimics official vendor styling. The landing pages hosted on typosquatted or lookalike domains (winscp-download[.]io, anydesk-remote[.]com, etc.) are convincing replicas of the legitimate download pages, sometimes cloning them in their entirety. Victims have no indication they are on a malicious site until after the installer executes.
Phase 2: MSIX Delivery
Downloads from the malvertising landing pages are MSIX packages, the Windows application installer format introduced by Microsoft. MSIX packages can be signed with valid code-signing certificates, which many antivirus products and endpoint security tools treat as a trust signal. The Nitrogen/Azote operators use certificates purchased or stolen from legitimate software companies, giving the MSIX payload a credible signature chain.
During installation, the MSIX package executes legitimate installer components as a decoy while simultaneously deploying malicious components. The decoy install gives the victim a functional copy of the software they intended to download, reducing the likelihood they will investigate further. The malicious components install to user-accessible paths that do not require elevation, allowing execution without triggering UAC prompts.
Phase 3: Python Stager and Cobalt Strike
The first-stage payload is a Python script dropped by the MSIX installer that reaches out to a C2 server and downloads the second-stage Cobalt Strike shellcode. Python is used as the initial execution vehicle because it is often present in developer environments and executes without generating the same AV detections as a compiled executable. The shellcode is decrypted in memory and injected into a legitimate Windows process, establishing a Cobalt Strike beacon.
The Cobalt Strike beacon is the primary post-exploitation tool. From here, the group conducts internal reconnaissance, identifies domain controllers and backup systems, maps file shares, and begins slow data exfiltration. The exfiltration phase is notably patient. In analysed intrusions, the group spent between two and six weeks inside victim networks before triggering ransomware deployment, using that time to exfiltrate as much high-value data as possible to maximise extortion leverage.
Phase 4: Ransomware and Extortion
Final-stage ransomware deployment uses ALPHV/BlackCat, a Rust-based RaaS operation that Nitrogen/Azote operates as an affiliate for. ALPHV/BlackCat encrypts both Windows and Linux systems and uses a multi-extortion model: ransom for decryption keys, separate payment demands to prevent data publication, and occasionally additional threats to notify the victim’s customers or regulators. The group’s patience in the exfiltration phase directly feeds the extortion leverage in this phase.
ALPHV/BlackCat underwent significant disruption in early 2025 following law enforcement operations. The Nitrogen/Azote affiliate relationship appears to have continued with successor operations, with some infrastructure and operational patterns suggesting continuity despite the disruption at the RaaS level.
The Foxconn North America Breach
The Foxconn North America operation is the clearest public demonstration of the group’s capability and targeting ambition. Foxconn, the world’s largest electronics contract manufacturer, has North American operations including data centres, supply chain management facilities, and industrial facilities manufacturing components for major technology companies.
The confirmed details are stark. Eight terabytes of data was exfiltrated before the ransomware deployment. The stolen dataset included approximately 11 million files covering financial records, internal communications, manufacturing process documentation, supplier contracts, and business data connected to Foxconn’s customers. Those customers include companies whose unreleased product designs and supply chain arrangements would be of significant value both for extortion and potentially for industrial intelligence.
ALPHV’s data leak site published samples of the exfiltrated data to demonstrate possession and apply extortion pressure. The publication of samples from a manufacturer at Foxconn’s tier provided external validation of the breach scale. The ransom demand and negotiation outcome have not been publicly confirmed.
For security teams, the Foxconn breach illustrates the compounding impact of the Nitrogen/Azote model. The initial access vector was not a sophisticated zero-day or a targeted spear phishing campaign. It was an employee or contractor searching for a software tool, downloading what appeared to be a legitimate installer, and running it. The attack chain from that initial execution to complete network compromise and data theft is everything the group does between the malvertising click and the ransom note, none of which requires exceptional sophistication once the initial foothold exists.
Operational Patterns
Analysed intrusions attributed to Nitrogen/Azote share consistent operational characteristics.
The group targets organisations with 500 to 10,000 employees. Large enough to afford a ransom payment, small enough not to have extensive security operations capabilities. Manufacturing, professional services, and technology services companies are the most common verticals, likely because employees in those sectors frequently need to download and install software as part of their work.
Dwell time before ransomware deployment averages about four weeks. The group is willing to wait for data exfiltration to complete before triggering encryption, which lengthens the window for detection but maximises the extortion leverage they carry into the negotiation.
Cobalt Strike profiles used by the group have evolved across campaigns. Earlier campaigns used stock Cobalt Strike configurations that were broadly detected. More recent activity shows modified Malleable C2 profiles and updated stager code consistent with ongoing OPSEC development to evade detection improvements.
Detection Priorities
At the endpoint: Suspicious MSIX installations from outside enterprise software management, Python processes spawning from APPDATA or TEMP directories, process injection from Python into legitimate Windows processes (particularly lsass, winlogon, svchost). PowerShell execution with encoded commands after a software install event.
At the network layer: DNS queries to newly registered or recently observed domains from endpoints that have recently installed software. HTTP/HTTPS beaconing with consistent sleep intervals from workstations. Unusual data volumes from endpoints toward cloud storage services (common exfiltration path).
For prevention: Restrict MSIX package installation to packages signed by organisationally approved certificates or sourced from enterprise distribution systems. Block outbound connections from Python interpreter processes to external IPs unless explicitly authorised. Implement DNS filtering to block newly registered domains as a category.
The malvertising entry point is addressable at the endpoint level. Users who search for legitimate software need a way to reach legitimate sources. Enterprise software deployment systems, approved download repositories, and web filtering that blocks suspected malvertising domains (a category several threat intelligence feeds provide) reduce the risk from this entry point significantly.