VMware: Nitrogen ransomware programmers lock themselves out of a payment — key management bug encrypts victims' data forever

Nitrogen Ransomware Bug Destroys Encryption Keys, Leaving Victims and Attackers Empty-Handed

A coding error in a ransomware variant linked to the Nitrogen group has rendered encrypted data permanently unrecoverable, undermining the attackers’ ability to extort victims. The flaw affects Nitrogen’s VMware ESXi ransomware strain, which targets hypervisors critical servers hosting virtual machines (VMs). While hypervisors are often overlooked in security policies, this attack highlights their vulnerability when left unprotected.

The bug occurs during encryption, where 8 bytes (64 bits) of the public key are overwritten with zeros, breaking the key pair. Without a valid public key, the corresponding private key required for decryption cannot be derived, making recovery impossible. Security firm Veeam identified the issue as an off-by-one error, a common programming mistake.

Since no decryption is possible, victims have no incentive to pay the ransom. Their only recourse is restoring from backups or facing permanent data loss. The Nitrogen campaign, active since 2023, has previously targeted North American financial institutions, industrial firms, and game developers, including Red Barrels, the studio behind Outlast.

The incident serves as a rare case of mutually assured destruction in cybercrime, where a developer’s oversight neutralizes the attackers’ leverage and leaves victims with no viable path to recovery.

Source: https://www.tomshardware.com/tech-industry/cyber-security/nitrogen-ransomware-programmers-lock-themselves-out-of-a-payment-key-management-bug-encrypts-victims-data-forever

VMware cybersecurity rating report: https://www.rankiteo.com/company/vmware

"id": "VMW1770515769",
"linkid": "vmware",
"type": "Vulnerability",
"date": "2/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'industry': 'Gaming',
                        'location': 'North America',
                        'name': 'Red Barrels',
                        'type': 'Game development studio'},
                       {'industry': 'Finance',
                        'location': 'North America',
                        'type': 'Financial institutions'},
                       {'industry': 'Industrial',
                        'location': 'North America',
                        'type': 'Industrial firms'}],
 'attack_vector': 'VMware ESXi hypervisors',
 'data_breach': {'data_encryption': 'Yes (flawed, unrecoverable)',
                 'type_of_data_compromised': 'Encrypted data (permanently '
                                             'unrecoverable)'},
 'description': 'A coding error in a ransomware variant linked to the Nitrogen '
                'group has rendered encrypted data permanently unrecoverable, '
                'undermining the attackers’ ability to extort victims. The '
                'flaw affects Nitrogen’s VMware ESXi ransomware strain, which '
                'targets hypervisors critical servers hosting virtual machines '
                '(VMs). The bug occurs during encryption, where 8 bytes (64 '
                'bits) of the public key are overwritten with zeros, breaking '
                'the key pair. Without a valid public key, the corresponding '
                'private key required for decryption cannot be derived, making '
                'recovery impossible. Since no decryption is possible, victims '
                'have no incentive to pay the ransom. Their only recourse is '
                'restoring from backups or facing permanent data loss.',
 'impact': {'data_compromised': 'Permanently encrypted and unrecoverable',
            'operational_impact': 'Permanent data loss if no backups available',
            'systems_affected': 'VMware ESXi hypervisors hosting virtual '
                                'machines'},
 'lessons_learned': 'Hypervisors are critical attack surfaces that require '
                    'robust security measures. Flaws in ransomware code can '
                    "neutralize attackers' leverage, but victims may still "
                    'face permanent data loss without backups.',
 'motivation': 'Financial extortion',
 'post_incident_analysis': {'corrective_actions': 'Restore from backups, '
                                                  'enhance hypervisor security',
                            'root_causes': 'Off-by-one error in ransomware '
                                           'encryption code'},
 'ransomware': {'data_encryption': 'Yes (flawed, unrecoverable)',
                'ransom_paid': 'No (no incentive to pay)',
                'ransomware_strain': 'Nitrogen VMware ESXi ransomware'},
 'recommendations': 'Ensure hypervisors are included in security policies, '
                    'maintain up-to-date backups, and monitor for ransomware '
                    'strains with known vulnerabilities.',
 'references': [{'source': 'Veeam'}],
 'response': {'remediation_measures': 'Restoring from backups',
              'third_party_assistance': 'Veeam (security firm)'},
 'threat_actor': 'Nitrogen group',
 'title': 'Nitrogen Ransomware Bug Destroys Encryption Keys, Leaving Victims '
          'and Attackers Empty-Handed',
 'type': 'Ransomware',
 'vulnerability_exploited': 'Off-by-one error in encryption process'}