Foxconn Cyberattack: Nitrogen Ransomware Claims 8TB Data Theft

Foxconn confirmed that some of its North American facilities were impacted by a cyberattack, with the Nitrogen ransomware group claiming responsibility and alleging the exfiltration of over 8 terabytes of sensitive data. This incident, which occurred prior to May 13, 2024, highlights the escalating threat of supply chain targeting by ransomware groups that use double-extortion tactics. Foxconn has not publicly confirmed the scope of the claimed data exfiltration, though it has confirmed the cyberattack itself.

What Happened

Taiwanese electronics manufacturer Foxconn confirmed that some of its North American operations were hit by a cyberattack. The Nitrogen ransomware group, which emerged in September 2024, claimed responsibility for the intrusion, stating the attack happened prior to May 13, 2024.

Nitrogen claims they exfiltrated over 8TB of data, comprising more than 11 million files from Foxconn's networks. The group alleges this data includes confidential instructions, internal project documentation, and technical drawings for major Foxconn clients such as Apple, Google, Dell, and Nvidia; Foxconn has not confirmed the nature or extent of any data exfiltration.

Foxconn’s cybersecurity team immediately activated response measures, focusing on operational continuity. The company reported that affected factories are now resuming normal production, indicating successful restoration efforts, as detailed by Security Affairs. However, Foxconn has not publicly corroborated the exact scope of the data exfiltration claimed by the Nitrogen group, though the company did confirm the cyberattack itself.

Arctic Wolf security researchers were among the first to report Nitrogen taking credit for the attack. No specific Indicators of Compromise (IOCs) or detailed attack chain information for this particular incident have been released publicly by Foxconn.

Why It Matters

This is a direct hit on a critical nexus of the global technology supply chain. Foxconn’s extensive client list means a successful data exfiltration could impact several of the world’s largest tech companies. The 8TB of claimed stolen data, if verified by Foxconn, represents a goldmine of intellectual property and competitive intelligence.

Nitrogen's method of operation is concerning. The group specializes in double-extortion, first encrypting files for ransom, then threatening to leak stolen data. Nitrogen has a documented history of exploiting vulnerable drivers to disable endpoint security solutions, a technique known as "Bring Your Own Vulnerable Driver" (BYOVD). This tactic allows them to bypass defenses like SentinelOne, often making initial detection difficult.

For security teams, the attack against Foxconn highlights the risk posed by adversaries specifically targeting supply chain entities rather than directly attacking large enterprises. The potential exposure of client project data demonstrates the ripple effect a breach at one critical supplier can have across an entire industry.

Technical Breakdown

Nitrogen's typical approach to disabling security software is insidious. Attackers find a legitimate service technician’s keycard, but it has a known flaw that allows them to bypass the system's logging or disable its alarms without setting off any alerts. They don't need to break into the system; they use a legitimate, albeit flawed, credential to neutralize a defense.

In previous attacks, Nitrogen ransomware exploited CVE-2023-52271 in Topaz Antifraud's driver, as reported by Infosecurity Magazine. This driver, signed by a legitimate certificate, offered a pathway to execute malicious code with kernel privileges, effectively allowing Nitrogen to disable or modify antivirus tools before executing their primary ransomware payload.

This technique maps directly to several MITRE ATT&CK tactics:

• T1562.001 Disable or Modify Tools: By exploiting vulnerable drivers, Nitrogen achieved the ability to disable antivirus and EDR solutions like CrowdStrike Falcon, clearing the path for their operations.
• T1041 Exfiltration Over C2 Channel: The alleged exfiltration of 8TB of data implies the use of command and control channels to transfer sensitive files off Foxconn's network.
• T1486 Data Encrypted for Impact: This is the core ransomware function, encrypting victim files to demand ransom.
• T1490 Inhibit System Recovery: Ransomware groups often delete shadow copies and backups to prevent easy system restoration, maximizing impact and pressure to pay.

From a NIST SP 800-53 perspective, this incident shows failures in several controls:

• SI-3 Malicious Code Protection: The successful bypass of antivirus software indicates that existing protections, or the configuration thereof, were insufficient against BYOVD attacks.
• SI-4 System Monitoring: The nature of BYOVD attacks means that legitimate drivers might be abused, making anomaly detection crucial for system monitoring to catch such sophisticated compromises.
• IR-4 Incident Handling: Foxconn’s swift activation of response initiatives is an example of an operational incident handling process, despite the initial breach.

Historical Context

Foxconn has a history of being targeted by ransomware. In 2024, a subsidiary, Foxsemicon, also fell victim to a ransomware attack. While details are sparse, the repeated targeting of Foxconn and its affiliates suggests persistent interest from threat actors in its role in global manufacturing. The 2020 Foxconn attack on its Mexico facility by the DoppelPaymer ransomware group, which demanded a $34 million ransom (the payment status has not been publicly disclosed), further illustrates this ongoing trend. These earlier incidents, particularly the DoppelPaymer attack, were also focused on data encryption and significant ransom demands, similar to Nitrogen's double-extortion model today. What's different now is the increasing sophistication of initial access and defense evasion, as seen with the BYOVD technique.

Data at a Glance

Our Take

We're seeing a clear trend: threat actors are pushing deeper into the supply chain, not just for operational disruption, but for strategic data theft. The Nitrogen group's use of BYOVD tactics to disable security tooling is a significant threat to even well-resourced organizations. It means our traditional EDR and AV deployments, while still crucial, need to be complemented by robust driver integrity checks and kernel-level monitoring, or they risk being outmaneuvered from below. Teams need to pivot from simply detecting malware to preventing the abuse of legitimate system components.

The CVEDaily Take

Foxconn confirmed a cyberattack, but their silence on the Nitrogen group's claim of 8TB of exfiltrated client data is a critical detail. We think Foxconn is understating the potential impact because the specific mention of Apple, Google, Dell, and Nvidia technical drawings implies a significant breach of intellectual property, even if only a fraction of the claimed 8TB is verified. Organizations must review all critical supplier contracts for data handling and breach notification clauses immediately. Has your team performed a recent tabletop exercise simulating a supply chain data breach with your most critical manufacturing partners?

FAQ

Q: Did Foxconn confirm the data exfiltration claimed by Nitrogen ransomware?
A: Foxconn confirmed a cyberattack on its North American facilities but has not publicly confirmed the 8 terabytes of data exfiltration or the specific types of client data claimed by the Nitrogen ransomware group, as reported by BleepingComputer.

Q: What is "Bring Your Own Vulnerable Driver" (BYOVD) and why is it effective?
A: BYOVD is a technique where attackers use legitimate, but vulnerable, signed drivers to gain kernel-level privileges, as demonstrated by Nitrogen's use of CVE-2023-52271 in a Topaz Antifraud driver (Infosecurity Magazine). This allows them to disable security software like antivirus or EDR solutions with high privileges, making their subsequent malicious activities harder to detect or prevent.

Q: What steps can organizations take to mitigate BYOVD attacks?
A: To mitigate BYOVD attacks, organizations should implement strong driver enforcement policies (e.g., Windows HVCI), regularly audit for and block known vulnerable drivers, and enhance endpoint detection and response (EDR) solutions to monitor for kernel-mode activity and suspicious driver loading. Solutions like Veeam for immutable backups also reduce the impact of successful ransomware attacks.