Skip to content
brandefense.io
Request A Demo

Search Ransomware Intelligence

Jump to a group, country, industry or search victims.

Inactive · #106 by victimsRansomware group

Nitrogen

As of Oct 19, 2026, Nitrogen has listed 48 confirmed victims on its leak site since Sep 30, 2024, 0.1% of all victims tracked by Brandefense. Its most targeted country is United States (70.8% of its victims) and its most targeted sector is Manufacturing.

Nitrogen began as a malware loader in 2023 used to deliver BlackCat/ALPHV ransomware, then evolved into a fully independent ransomware operator by mid-2024, operating its own strain derived from leaked Conti 2 builder code and conducting double-extortion attacks primarily linked to Eastern European infrastructure.

Is My Company Listed?Follow NitrogenRequest IOC Feed

Follow and IOC feeds are part of the Brandefense platform.

Confirmed Victims
48
Rank By Victims
#106
Last Leak-Site Post
Jun 3, 2026
Top Country
United States
Top Sector
Manufacturing

Victims Posted Per Month.

Nitrogen confirmed victims per month
MonthConfirmed victims
November 20251
December 20253
January 20264
February 20263
March 20261
April 20260
May 20261
June 20261
July 20260
August 20260
September 20260
October 2026 (month in progress)0
Updated continuously · figures as of Oct 19, 2026

Latest Nitrogen Victims.

Search all 48 →
Latest confirmed leak-site victims claimed by Nitrogen
VictimCountryIndustryData claimedPosted
Pyramid
pyramidmg.com
USUnited StatesConstructionNot stated
FOXCONN
foxconn.com
USUnited StatesTechnologyNot stated
ENENSYS Technologies
enensys.com
FRFranceTelecommunicationsNot stated
DeWalch Technologies, Inc
dewalch.com
USUnited StatesManufacturingNot stated
PCCA
pccarx.com
USUnited StatesPharmaceuticalsNot stated
LumioDental
lumiodental.com
USUnited StatesHealthcareNot stated

MITRE ATT&CK.

24 techniques across 8 tactics
Reconnaissance2
  • T1012
    Query Registry
  • T1082
    System Information Discovery
Initial Access6
  • T1078
    Valid Accounts
  • T1190
    Exploit Public-Facing Application
  • T1203
    Exploitation for Client Execution
  • T1204
    User Execution
  • T1204.001
    User Execution: Malicious Link
  • T1204.002
    User Execution: Malicious File
Execution4
  • T1055
    Process Injection
  • T1059
    Command and Scripting Interpreter
  • T1140
    Deobfuscate/Decode Files or Information
  • T1218
    System Binary Proxy Execution
Persistence3
  • T1112
    Modify Registry
  • T1547.001
    Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
  • T1550
    Use Alternate Authentication Material
Privilege Escalation1
  • T1068
    Exploitation for Privilege Escalation
Defense Evasion6
  • T1027
    Obfuscated Files or Information
  • T1070
    Indicator Removal
  • T1490
    Inhibit System Recovery
  • T1553.002
    Subvert Trust Controls: Code Signing
  • T1562
    Impair Defenses
  • T1562.001
    Impair Defenses: Disable or Modify Tools
Discovery1
  • T1083
    File and Directory Discovery
Impact1
  • T1486
    Data Encrypted for Impact
MITRE ATT&CK® technique names © The MITRE Corporation, reproduced with permission.

Arsenal.

  • NitrogenMalware

Indicators Of Compromise.

4 indicators tracked by Brandefense
  • Hash55f3725ebe01ea19ca14ab14d747a6975f9a6064ca71345219a14c47c18c88be
  • Hash278f22e258688a2afc1b6ac9f3aba61be0131b0de743c74db1607a7b6b934043
Full indicator feedGet every indicator for Nitrogen on the Brandefense platform.Request A Demo
Samples are defanged so they cannot be opened by accident.
Threat intelligence updated Oct 19, 2026.

Who Nitrogen Targets.

Sectors

  1. Manufacturing816.7%
  2. Consulting48.3%
  3. Construction36.2%
  4. Media and Entertainment36.2%
  5. Technology36.2%

Countries

  1. USUnited States3470.8%
  2. CACanada714.6%
  3. FRFrance24.2%
  4. PTPortugal24.2%
  5. DEGermany12.1%
Shares are of this group's confirmed victims.

History.


  1. First confirmed victim listed on its leak site

  2. Busiest month on record: 9 confirmed victims

  3. First seen in Brandefense data

  4. Most recent leak-site post

Get Real-Time Alerts, IOC Feeds And Takedowns.

The Brandefense platform watches every leak site for your company, vendors and executives, and acts on what it finds.

Request A Demo

Figures as of Oct 19, 2026. Confirmed leak-site claims collected by Brandefense technologies and validated by Brandefense analysts.

Listed on a leak site means a ransomware group has claimed the company; it is not a confirmed breach. To request a correction or removal, contact Brandefense.