Ransomware Group intelligence
Nitrogen
ActiveTrack Nitrogen with 49 published victims and 2 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Nitrogen is tracked by Breach House as a ransomware group with 49 published victims.
United States is currently the most targeted country in this dataset.
2 known leak locations are currently associated with this group.
Leak Status Distribution
49
- Leaked 2 4.1%
- Pending 47 95.9%
- Deleted 0 0.0%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (2)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 2 | Onion service | Down checked 2h ago | 6lrsxvqscxtznb4fhux5u3vbslbanxjzxzgtokjtfwaitxe4pfgfebad.onion |
| Leak location 1 | Onion service | Down checked 2h ago | nitrogenczslprh3xyw6lh5xyjvmsz7ciljoqxxknd7uymkfetfhgvqd.onion |
Top Activity Sectors (11)
Typical Attacks (8)
▼MITRE ATT&CK does not currently catalogue Nitrogen, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v20.0. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: nitrogen executes PowerShell scripts to run payload deployment and post-compromise actions across infected hosts.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: nitrogen disables antivirus and monitoring tools to prevent detection and persistence of ransomware activity.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1070.004 File Deletion Stealth
What they do: nitrogen deletes Volume Shadow Copies and backup artifacts to eliminate recovery options for victims.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1018 Remote System Discovery Discovery
What they do: nitrogen performs remote system discovery to identify additional hosts and services for compromise.
What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
-
T1135 Network Share Discovery Discovery
What they do: nitrogen uses network share discovery to locate victim file shares and staging directories for encryption targets.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: nitrogen moves laterally through SMB/Windows Admin Shares to encrypt additional systems within the network.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1567.002 Exfiltration to Cloud Storage Exfiltration
What they do: nitrogen exfiltrates sensitive victim data before encryption to support double-extortion demands.
What that means: Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel.
-
T1486 Data Encrypted for Impact Impact
What they do: nitrogen encrypts victim files and backups using its ransomware payload to maximize impact and extortion leverage.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
Ransom Notes (2)
▼The note this group leaves on a compromised machine. Click a filename to read it.
READ_ME_.TXT
========================================================================================
Nitrogen welcome you!
========================================================================================
Take this seriously, this is not a joke! Your company network are encrypted and
your data has been stolen and downloaded to our servers. Ignoring this message
will result in all your data being published on our blog:
http://nitrogenczslprh3xyw6lh5xyjvmsz7ciljoqxxknd7uymkfetfhgvqd.onion
This problem can be solved:
1. Your network and data can will be restored.
2. Your data is stolen and stored on our server, after receive payment it will
be completely removed from our servers.
3. No one is aware about the data leak from your company except you.
If you believe you can handle without us and decrypting your servers and data
using some IT Solution from third-party specialists? They will only make
significant damage to all of your data; every encrypted file will be corrupted
forever. Only our Decryption Tool will make decryption guaranteed. Don't go to
recovery companies, they are essentially just middlemen who will make money off
you.
If you decide not to negotiate with us and find another solution.
We will make huge damage to your business by using all of our experience to make
your partners, clients, employees and whoever cooperates with your company know
about this accident and stop any partnership with you. As a result, You will
suffer great losses and you will must to pay a penalty to the state and to
compensate for lawsuits against your company. Also in case of disclosure of
information about a cyber attack and theft of confidential data of your company
your assets may fall and it will cost you several times more expensive instead
agreeing with us.
Want to go to Government for protection?
Your address them for help will only make the situation worse. They will try to
prevent you from negotiating with us, because the negotiations will make them
look weak and incompetent. After the incident report is handed over to the
government department, you receive get a penalty for this accident and leak
personal data. This will be a huge amount, you can read more about the GDRP
legislation: https://en.wikipedia.org/wiki/General_Data_Protection_Regulation/
In this situation you will not be winners anyway.
So lets get straight to the point.
After we receive your payment you will get the followings:
-Decryption tool for all your systems.
-Detailed penetration overview with main kill chain and security recommendations
-Proof that we have securely deleted your data
-Our word that we will not perform attacks on you in the future.
Now, in order to start negotiations, you need to do the following:
-Install Tor Browser from https://www.torproject.org/download/
-Use Tor Browser open:
gjendw2d6oqjs6nxnwwuc6khpa5g5gzp7pyuiwzamalzzzk6vomm7xid.onion/quick-access/[snip]
-If you have any problems accessing the onion site, use the qTox app to contact us.
ToxID: 9E95D4A886F6678290331E41FED1C9C41C48554905087DEA05E78C8254905C0CB5B705141297
If you do not contact us within 3 days, we will begin publishing your data on all
social networks.
========================================================================================
readme.txt
Nitrogen welcome you! Take this seriously, this is not a joke! Your company network are encrypted and your data has been stolen and downloaded to our servers. Ignoring this message will result in all your data being published on our blog: http://nitrogenczslprh3xyw6lh5xyjvmsz7ciljoqxxknd7uymkfetfhgvqd.onion This problem can be solved: 1. Your network and data can will be restored. 2. Your data is stolen and stored on our server, after receive payment it will be completely removed from our servers. 3. No one is aware about the data leak from your company except you. If you believe you can handle without us and decrypting your servers and data using some IT Solution from third-party specialists? They will only make significant damage to all of your data; every encrypted file will be corrupted forever. Only our Decryption Tool will make decryption guaranteed. Don't go to recovery companies, they are essentially just middlemen who will make money off you. If you decide not to negotiate with us and find another solution. We will make huge damage to your business by using all of our experience to make your partners, clients, employees and whoever cooperates with your company know about this accident and stop any partnership with you. As a result, You will suffer great losses and you will must to pay a penalty to the state and to compensate for lawsuits against your company. Also in case of disclosure of information about a cyber attack and theft of confidential data of your company your assets may fall and it will cost you several times more expensive instead agreeing with us. Want to go to Government for protection? Your address them for help will only make the situation worse. They will try to prevent you from negotiating with us, because the negotiations will make them look weak and incompetent. After the incident report is handed over to the government department, you receive get a penalty for this accident and leak personal data. This will be a huge amount, you can read more about the GDRP legislation: https://en.wikipedia.org/wiki/General_Data_Protection_Regulation/ In this situation you will not be winners anyway. So lets get straight to the point. After we receive your payment you will get the followings: -Decryption tool for all your systems. -Detailed penetration overview with main kill chain and security recommendations -Proof that we have securely deleted your data -Our word that we will not perform attacks on you in the future. Now, in order to start negotiations, you need to do the following: -Install Tor Browser from https://www.torproject.org/download/ -Use Tor Browser open: xqsdbtrtmufdyiqnkrkvosec4gqappf2egcptzqppjtqdevsoadakyqd.onion/quick-access/[snip] -If you have any problems accessing the onion site, use the qTox app(https://github.com/qTox/qTox/releases/download/v1.17.6/setup-qtox-x86_64-release.exe) to contact us. ToxID: 46CA5EEC55A16767B7F8293DB18F753D1BF60C536747EFD115035DDA40948427E1DDFD107F03 If you do not contact us within 3 days, we will begin publishing your data on all social networks.
Ransom-note text from RansomLook, licensed CC BY 4.0.
Victims (49)
Search, filter and paginate the victim timeline for Nitrogen. Showing 1–49 of 49.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | Walbro id35244 View details | United States | Manufacturing / Engineering | pending | ||
|
Walbro is a global market leader in engine management and fuel systems for the Outdoor Power Equipment, Recreational, Marine, and Personal Transportation markets, and a leading supplier of high pressure aluminum die casting to various industries. Walbro manufactures carburetors, electronic fuel injection systems, ignition systems, fuel tanks, fuel pumps, valves and fuel storage and distribution systems, and offers value-added machining, electronics and assembly capabilities. |
||||||
| Ransomware | Pyramid id29592 View details | United States | Construction / Real Estate | pending | ||
|
Ownership and management of shopping center. Development and redevelopment of real estate properties. Leasing of space to retail chains, restaurants, and entertainment venues |
||||||
| Ransomware | FOXCONN id29046 View details | Taiwan, Province of China | Manufacturing / Engineering | pending | ||
|
The world's largest contract electronics manufacturer, whose operations are officially divided into four key segments: consumer electronics, cloud and networking products, computing equipment, as well as components and other products. |
||||||
| Ransomware | ENENSYS Technologies id27447 View details | France | Services | pending | ||
|
One of the leaders in video stream optimization, security, and content monetization. Offers advanced solutions for efficient video delivery across all digital ecosystems. |
||||||
| Ransomware | DeWalch Technologies, Inc id26640 View details | United States | IT | pending | ||
|
DeWalch Technologies, Inc. is a vertically integrated engineering and manufacturing company with operations in four key verticals: security, energy, manufacturing, and digital. |
||||||
| Ransomware | PCCA id26414 View details | United States | Healthcare / Pharma | pending | ||
|
PCCA supports the creation of personalized medicine and innovative products, as well as pharmaceutical compounding. |
||||||
| Ransomware | LumioDental id26223 View details | United States | Healthcare / Pharma | pending | ||
|
A company that manages a network of dental clinics. |
||||||
| Ransomware | QualiChem Metalworking id25847 View details | United States | Manufacturing / Engineering | pending | ||
|
QualiChem, Inc. manufactures some of the most advanced metalworking fluids available in the world. |
||||||
| Ransomware | Connor Co id25845 View details | United States | Manufacturing / Engineering | pending | ||
|
TThe company operates in the wholesale trade of engineering materials and equipment.. |
||||||
| Ransomware | Durashiloh id25598 View details | United States | Manufacturing / Engineering | pending | ||
|
The company specializes in the development, engineering, and manufacturing of various components and systems for the automotive industry and other sectors. |
||||||
| Ransomware | Whitfield Welding Inc id25597 View details | Canada | Communication / Marketing | pending | ||
|
Specializing in instrumental welding (TIG, Micro TIG, MIG), microlaser welding, laser cladding, laser hardening, laser engraving, stress relieving, and mechanical processing. |
||||||
| Ransomware | Walters Group Inc id24809 View details | United States | Manufacturing / Engineering | pending | ||
|
Specializing in the production of structural steel and construction. |
||||||
| Ransomware | AvtechTyee id24452 View details | United States | IT | pending | ||
|
AvtechTyee is a company operating in the aerospace and defense industries. |
||||||
| Ransomware | Golden Artist Colors id24412 View details | United States | Communication / Marketing | pending | ||
|
A major manufacturer of art materials for professional artists and designers: acrylic paints, oils, watercolors, pastels and other media/materials. |
||||||
| Ransomware | Black Hills Bentonite id23646 View details | United States | Manufacturing / Engineering | pending | ||
|
An American company founded in 1947. It mines and processes sodium bentonite, a natural clay used in well drilling, metal casting, and pond and landfill sealing. |
||||||
| Ransomware | Phillips Printing Company id23491 View details | United States | Communication / Marketing | pending | ||
|
This is a commercial printing house that deals with design, offset and digital printing. |
||||||
| Ransomware | Heffner Toyota & Lexus id22309 View details | Canada | Retail / E-commerce | pending | ||
|
Heffner is a family-owned Toyota and Lexus dealership offering a full range of services, including vehicle sales, maintenance, body repair, and detailing. |
||||||
| Ransomware | Ocean Edge Resort & Golf Club id21875 View details | United States | Hospitality / Food & Beverage / Tourism | pending | ||
|
Ocean Edge Resort & Golf Club is a 429-acre resort in Brewster, Cape Cod (Massachusetts) featuring a historic mansion, luxury villas, golf, private beach access, and a wide range of dining, wellness, and recreational options. |
||||||
| Ransomware | F&P Georgia Mfg Inc id21567 View details | United States | Manufacturing / Engineering | pending | ||
|
Tier-1 supplier of suspension components to the automotive industry. |
||||||
| Ransomware | Palm Bay International id21336 View details | United States | Services | leaked | ||
|
One of the largest importers and distributors of wines and spirits in the U.S. market. |
||||||
| Ransomware | C3 Group id21195 View details | United States | Manufacturing / Engineering | pending | ||
|
C3 Group is a large, well-established engineering company offering a wide range of services, from restoration and industrial injection to water treatment and geotechnical projects. |
||||||
| Ransomware | Progressive Auto Group id21153 View details | United States | Communication / Marketing | pending | ||
|
Sale of new cars of famous brands: Chevrolet, Chrysler, Dodge, Jeep, Ram. Sale of used cars, budget cars. Service and repair. Registration of loans, leasing. |
||||||
| Ransomware | Kirkor Architects and Planners id20946 View details | Canada | Construction / Real Estate | pending | ||
|
Specialising in large multi-functional residential and mixed-use projects, high-rise buildings, retail complexes, building conversions, public space and infrastructure improvements. |
||||||
| Ransomware | Coweta County School System id20215 View details | United States | Education | pending | ||
|
The Coweta County School System (CCSS) is the primary educational organization in Coweta County, Georgia, United States. It serves more than 23,000 students in grades pre-kindergarten through 12th grade and includes 34 educational institutions. |
||||||
| Ransomware | Seneca Gaming & Entertainment id19576 View details | United States | Communication / Marketing | pending | ||
|
The corporation operates Class III casino gaming properties in Western New York. Seneca Gaming & Entertainment focuses on providing a variety of gaming and entertainment experiences at its three locations: Irving, Salamanca, and Oil Spring. |
||||||
| Ransomware | Stadtwerke Schwerte GmbH id19355 View details | Germany | Communication / Marketing | pending | ||
|
Stadtwerke Schwerte is a municipal utility company based in Schwerte, Germany. It primarily provides essential services to local residents and businesses. |
||||||
| Ransomware | M'AR De AR Hotels id19354 View details | Portugal | Hospitality / Food & Beverage / Tourism | pending | ||
|
M'AR De AR Hotels is a hotel group in Portugal, offering a range of accommodations primarily in the southern region of the country. The group aims to deliver a luxurious yet comfortable experience for guests, with a focus on personalized service, elegant designs, and proximity to key tourist destinations. |
||||||
| Ransomware | Global Media Group id19238 View details | Portugal | Communication / Marketing | pending | ||
|
Global Media Group (Global Media) is a Portuguese media holding company, owning a portfolio of print and online media outlets, including newspapers and radio stations. |
||||||
| Ransomware | SIRIUS S.R.L. id18846 View details | Italy | IT | leaked | ||
|
Sirius is a company that specializes in energy automation, particularly in the management and remote control of renewable energy plants. The company provides services such as software development, commissioning, training, and ongoing technical support. |
||||||
| Ransomware | AKTO id18845 View details | United States | Education | pending | ||
|
A French company specializing in digital learning and training solutions. It focuses on providing tools and services to improve corporate training, ensuring that companies can effectively upskill their employees. |
||||||
| Ransomware | Kilgore Industries id16144 View details | United States | Public Sector | pending | ||
|
Headquartered in Houston, Texas, Kilgore Industries, LP designs, builds and installs HVAC, mechanical, electrical and plumbing systems in the United States |
||||||
| Ransomware | A Beautiful Pools Inc id16142 View details | United States | Construction / Real Estate | pending | ||
|
A Beautiful Pools, based in Texas, specializes in designing, building, and maintaining custom swimming pools for residential and commercial properties. |
||||||
| Ransomware | Fireproof Contractors Inc id16141 View details | United States | Communication / Marketing | pending | ||
|
Fireproof Contractors, Inc. specializes in commercial fireproofing, thermal and acoustical insulation, waterproofing, and firestop services. |
||||||
| Ransomware | Locke Solutions , LLC id15996 View details | United States | Services | pending | ||
|
Locke Solutions, based in Houston, Texas, is a company that primarily provides construction services and building materials. The company specializes in offering a variety of construction solutions, particularly in areas such as structural concrete, pre-cast concrete, building systems, and engineering design services. |
||||||
| Ransomware | CW Lighting, LLC id15995 View details | United States | Communication / Marketing | pending | ||
|
CW Lighting is a lighting manufacturer representative serving the Houston, Texas area. |
||||||
| Ransomware | Tejas Office Products, Inc. id15988 View details | United States | Communication / Marketing | pending | ||
|
Tejas Office Products is a company based in Houston, Texas, specializing in office supplies and related products. They offer a range of services and products designed to support office environments, including office furniture, equipment, technology, and supplies. |
||||||
| Ransomware | Mission Constructors , Inc. id15957 View details | United States | Construction / Real Estate | pending | ||
|
Mission is a Houston-based corporation providing construction management, design/build, value engineering and construction services throughout the state of Texas. |
||||||
| Ransomware | SRP Federal Credit Union id15877 View details | United States | Finance / Legal / Insurance | pending | ||
|
SRP Federal Credit Union is a member-owned financial institution that offers a variety of financial products and services, including savings accounts, loans, credit cards, and mortgages.. |
||||||
| Ransomware | Ottawa Valley Handrailing Company Ltd id14984 View details | Canada | Communication / Marketing | pending | ||
|
An internationally-recognized company, Ottawa Valley Handrailing (OVH) has been offering high quality, custom stair and rail products worldwide for over 30 years. Serving builders, developers, architects, interior designers, and homeowners, OVH excels at providing unequalled customer service and exceptional products. |
||||||
| Ransomware | Red Barrels id14574 View details | Canada | Hospitality / Food & Beverage / Tourism | pending | ||
|
Red Barrels Inc. is a Canadian video game developer based in Montreal. The company was founded by Philippe Morin, David Chateauneuf and Hugo Dallaire in 2011. The three were previously developers for Ubisoft Montreal and EA Montreal, but founded the company after the origination of an original intellectual property by Dallaire in 2010. After leaving their respective workplaces, the team's online presence began in July 2012 and a trailer for the game that became Outlast. |
||||||
| Ransomware | Akromold id14554 View details | United States | Communication / Marketing | pending | ||
|
Akromold is a leading manufacturer specializing in molds for rubber and silicone products. They offer a range of products, including injection molds, cold runners, compression and transfer molds, and contract machining services. Their facility is located in Goderich, Ontario, and they have a strong focus on quality manufacturing solutions for various industries. |
||||||
| Ransomware | Labib Funk Associates id14553 View details | Egypt | Construction / Real Estate | pending | ||
|
Labib Funk + Associates is a design and architecture firm specializing in a variety of projects, including commercial, institutional, multifamily, mixed-use, and hospitality developments. They offer services in seismic retrofitting and affordable housing and have completed notable projects like the Intuit Dome, Lakers Training Facility, and NFL Media HQ. The firm's portfolio showcases a wide range of architectural work, emphasizing innovation and functionality. |
||||||
| Ransomware | Research Electronics International id14552 View details | United States | Communication / Marketing | pending | ||
|
REI specializes in the design and manufacture of electronic test equipment for security applications. The company was founded in 1983 in Cookeville, Tennessee, U.S.A. by Bruce Barsumian, who later partnered with Tom Jones (GM) in 1995. In June 2019 REI became an Electronic Technologies subsidiary of HEICO Corporation (Hollywood, FL, USA). REI customers include government agencies, law enforcement organizations, corporate security personnel, and TSCM professionals worldwide that have a need and responsibility to protect sensitive information. |
||||||
| Ransomware | IDEALEASE INC id14534 View details | United States | Services | pending | ||
|
https://www.idealease.com/ Idealease is a leading provider of commercial truck leasing, rental, and maintenance solutions, serving businesses of all sizes across various industries. With a focus on reliability and customer satisfaction, Idealease offers flexible lease and rental options, along with comprehensive maintenance programs to keep fleets operating efficiently. Their expert team ensures that businesses receive tailored solutions that meet their specific transportation needs, backed by nationwide support and a commitment to safety and compliance. By partnering with Idealease, companies can optimize their fleet management, reduce operational costs, and focus on their core business operations with confidence. |
||||||
| Ransomware | Control Panels USA id14533 View details | United States | Communication / Marketing | pending | ||
|
Control Panels USA is a premier provider of custom control panel solutions, serving a diverse range of industries including water treatment, manufacturing, energy, and more. With a strong emphasis on quality, precision, and reliability, they specialize in designing, engineering, and manufacturing control panels that meet the specific requirements of each project. Their expertise spans across various types of panels, including UL-listed, PLC, HMI, and SCADA systems, ensuring seamless integration and optimal performance. Control Panels USA is committed to delivering top-tier products and services, offering comprehensive support from initial concept to installation, and helping clients achieve efficient and safe operations. |
||||||
| Ransomware | Spectrum Industries id14532 View details | India | IT | pending | ||
|
Spectrum Furniture is a leading manufacturer of innovative and high-quality furniture solutions designed for educational, corporate, and healthcare environments. Specializing in technology-friendly furnishings, Spectrum offers a wide range of products including lecterns, desks, charging carts, and collaborative furniture tailored to support modern learning and working spaces. With a focus on durability, functionality, and user comfort, their products are crafted to enhance both the user experience and the integration of technology. Spectrum Furniture is known for its commitment to quality, ergonomic design, and the ability to customize solutions that meet the unique needs of clients, fostering productive and flexible environments. |
||||||
| Ransomware | Magenta Photo Studio id14531 View details | Canada | Communication / Marketing | pending | ||
|
Magenta Photo is a premier photography company specializing in capturing life's precious moments with creativity and elegance. Offering a wide range of photography services, including family portraits, newborn photography, professional headshots, and more, Magenta Photo is dedicated to providing high-quality, personalized experiences for every client. Their team of skilled photographers focuses on creating a comfortable and enjoyable environment, ensuring that each session results in stunning, timeless images. |
||||||
| Ransomware | Brechbuhler Scales Inc id14530 View details | United States | Communication / Marketing | pending | ||
|
Brechbuhler Scales Inc. is a leading provider of weighing solutions, offering a wide range of products and services to meet the needs of various industries. With a focus on precision, quality, and innovation, the company specializes in providing scales and weighing systems for commercial, industrial, and laboratory use. Their expert team is committed to delivering customized solutions, from installation and calibration to ongoing maintenance and support, ensuring accuracy and reliability in every application. Brechbuhler Scales Inc. has established a reputation for excellence, catering to clients with state-of-the-art equipment and unparalleled customer service. |
||||||
| Ransomware | MDSi INC id14529 View details | United States | Services | pending | ||
|
MDSI (Material Design Systems, Inc.) is a leading provider of innovative material handling and storage solutions, catering to businesses across various industries. With a commitment to optimizing workflow and enhancing operational efficiency, MDSI specializes in designing, engineering, and installing custom storage systems, including mezzanines, pallet racking, conveyor systems, and more. Their team of experts works closely with clients to develop tailored solutions that maximize space, improve safety, and streamline processes. MDSI stands out for its dedication to quality, exceptional customer service, and delivering turnkey solutions that help businesses achieve their productivity and storage goals. |
||||||