nitrogen
First seen September 30, 2024Active49 claimed victims
The claims below are reproduced as posted by nitrogen on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Nitrogen began as a malware loader in 2023 used to deliver BlackCat/ALPHV ransomware, then evolved into a fully independent ransomware operator by mid-2024, operating its own strain derived from leaked Conti 2 builder code and conducting double-extortion attacks primarily linked to Eastern European infrastructure.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Walbro | October 12, 2026 | ransomware_live | — |
| Pyramid | June 3, 2026 | ransomware_live | — |
| FOXCONN | May 11, 2026 | ransomware_live | — |
| ENENSYS Technologies | March 19, 2026 | ransomware_live | — |
| DeWalch Technologies, Inc | February 18, 2026 | ransomware_live | — |
| LumioDental | February 5, 2026 | ransomware_live | — |
| Connor Co | January 27, 2026 | ransomware_live | — |
| QualiChem Metalworking | January 27, 2026 | ransomware_live | — |
| Whitfield Welding Inc | January 19, 2026 | ransomware_live | — |
| Durashiloh | January 19, 2026 | ransomware_live | — |
| Walters Group Inc | December 16, 2025 | ransomware_live | — |
| AvtechTyee | December 5, 2025 | ransomware_live | — |
| Golden Artist Colors | December 3, 2025 | ransomware_live | — |
| Black Hills Bentonite | November 6, 2025 | ransomware_live | — |
| Phillips Printing Company | October 29, 2025 | ransomware_live | — |
| Heffner Toyota & Lexus | September 12, 2025 | ransomware_live | — |
| Ocean Edge Resort & Golf Club | August 20, 2025 | ransomware_live | — |
| F&P Georgia Mfg Inc | August 6, 2025 | ransomware_live | — |
| Palm Bay International | July 23, 2025 | ransomware_live | — |
| Progressive Auto Group | July 15, 2025 | ransomware_live | — |
| Kirkor Architects and Planners | July 3, 2025 | ransomware_live | — |
| Coweta County School System | May 24, 2025 | ransomware_live | — |
| Seneca Gaming & Entertainment | April 26, 2025 | ransomware_live | — |
| M'AR De AR Hotels | April 25, 2025 | ransomware_live | — |
| Stadtwerke Schwerte GmbH | April 25, 2025 | ransomware_live | — |
| Global Media Group | April 18, 2025 | ransomware_live | — |
| AKTO | March 31, 2025 | ransomware_live | — |
| SIRIUS S.R.L. | January 30, 2025 | ransomware_live | — |
| C3 Group | December 24, 2024 | ransomware_live | — |
| Fireproof Contractors Inc | December 17, 2024 | ransomware_live | — |
| A Beautiful Pools Inc | December 17, 2024 | ransomware_live | — |
| Kilgore Industries | December 17, 2024 | ransomware_live | — |
| Tejas Office Products, Inc. | December 11, 2024 | ransomware_live | — |
| CW Lighting, LLC | December 11, 2024 | ransomware_live | — |
| Locke Solutions , LLC | December 11, 2024 | ransomware_live | — |
| Mission Constructors , Inc. | December 10, 2024 | ransomware_live | — |
| SRP Federal Credit Union | December 5, 2024 | ransomware_live | — |
| Ottawa Valley Handrailing Company Ltd | October 25, 2024 | ransomware_live | — |
| Red Barrels | October 3, 2024 | ransomware_live | — |
| Labib Funk Associates | August 10, 2024 | ransomware_live | — |
| Research Electronics International | July 20, 2024 | ransomware_live | — |
| Akromold | July 20, 2024 | ransomware_live | — |
| IDEALEASE INC | June 8, 2024 | ransomware_live | — |
| MDSi INC | June 5, 2024 | ransomware_live | — |
| Magenta Photo Studio | June 2, 2024 | ransomware_live | — |
| Spectrum Industries | June 1, 2024 | ransomware_live | — |
| Brechbuhler Scales Inc | May 14, 2024 | ransomware_live | — |
| Control Panels USA | May 1, 2024 | ransomware_live | — |
| PCCA | March 29, 2023 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).