Ransomware group
Nitrogen ransomware: victims and leak site activity
The Nitrogen ransomware group has listed 48 victims on its leak site since September 2024; its latest post is from 3 June 2026. Most affected countries: United States, Canada and Portugal. Most targeted sector: Professional Services.
Total posts
48
First seen
2024-09-30
Latest post
2026-06-03
Countries hit
9
About Nitrogen
Nitrogen began as a malware loader in 2023 used to deliver BlackCat/ALPHV ransomware, then evolved into a fully independent ransomware operator by mid-2024, operating its own strain derived from leaked Conti 2 builder code and conducting double-extortion attacks primarily linked to Eastern European infrastructure.
Most targeted countries
All countries →Most targeted sectors
- Professional Services 14
- Manufacturing 13
- Technology 8
- Hospitality 3
- Retail & E-Commerce 3
- Energy & Utilities 2
- Healthcare 2
- Education 1
- Financial Services 1
- Transportation 1