In May 2026, employees at a Foxconn factory in Wisconsin watched their Wi-Fi fail and their screens go dark, forcing some of them back to pen and paper just to keep production moving. Days later, a new name appeared on a dark web leak site: Nitrogen, a ransomware operation claiming to have quietly stolen 8 terabytes of data and more than 11 million files, including confidential project drawings belonging to some of the biggest names in tech, including Apple, Google, Nvidia, Intel, and AMD.

Nitrogen was not a completely new threat. Researchers traced its ransomware back to a leaked builder from Conti, one of the most notorious ransomware operations, with likely ties to the ALPHV/BlackCat ecosystem that fragmented after the 2023 takedown. This is what modern ransomware really looks like. It is not a lone hacker, but an evolving criminal business that reuses leaked code, operates through an affiliate model, and can compromise a global supply chain within days.

By the end of this room, you'll understand how to identify that criminal business at every stage of an attack, long before its name ever appears on a leak site.

Learning Objectives

• Explain what ransomware is and why it remains one of the most impactful cyber threats facing organizations today
• Differentiate traditional ransomware operations from the modern Ransomware as a Service (RaaS) affiliate model
• Identify the pre-encryption activities performed by ransomware operators and understand why this stage provides the best opportunity for detection and response
• Analyze ransom notes and ransomware encryptors to extract valuable forensic evidence and threat intelligence
• Use industry-standard tools and Indicators of Compromise (IOCs) to identify the ransomware family or threat group responsible for an attack
• Investigate a simulated ransomware incident from initial analysis through ransomware attribution

Prerequisites

This room focuses on investigating ransomware operations within an Active Directory environment. Before starting this room, you should have a basic understanding of:

• Windows Active Directory concepts, including domains, users, groups, GPOs, and domain controllers
• Basic Windows forensic concepts, such as event logs, file system artifacts, and execution traces
• Common ransomware attack stages, including initial access, lateral movement, and encryption
• Using Eric Zimmerman's tools

Recommended rooms:

• Active Directory Basics
• Analysing Data Collection
• Uncovering Attacker Infrastructure
• Detecting Exfiltration Methods

Machine Access

Before proceeding, start the lab by clicking the Start Machine button below. You will then have access to the VM, which already has DFIR tools ready to execute, and all evidence files are provided in the directory C:\Users\DFIRUser\Desktop\Evidence.

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting the Lab Machine, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.

Lab machine

Status:Off

Start Lab Machine

If you prefer to connect using your own VPN-connected machine, please use the credentials below to RDP in: