Nitrogen Ransomware Hits Foxconn North America; 8TB of Client IP Including Apple, Nvidia, Google Schematics Exfiltrated

The Nitrogen ransomware group posted Foxconn on its dark web leak site on May 11 and Foxconn confirmed the breach on May 12, acknowledging cyberattacks at its facilities in Mount Pleasant, Wisconsin and Houston, Texas that caused roughly 11 days of production disruption. Nitrogen claims to have exfiltrated more than 8TB across 11 million+ files including confidential technical drawings, circuit board layouts, and project documentation tied to Apple, Nvidia, Google, Intel, Dell, and AMD; AppleInsider subsequently confirmed over 30 genuine Apple server schematics from 2025–2026 in the sample set. Nitrogen is believed to be a Conti 2 code offshoot, and researchers at Coveware have flagged a bug in its ESXi encryptor that may make recovery impossible even for paying victims.

Nitrogen is believed to be a Conti 2 code offshoot, and researchers at Coveware have flagged a bug in its ESXi encryptor that may make recovery impossible even for paying victims.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the high severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.