Leak-site post naming Nitrex Chemicals India, captured by ThreatCluster

Nitrex Chemicals India

orion

Ransomware leak-site victim intelligence

Views
47,196
Posted
Aug 5, 2026
Country
India
Industry
Chemicals

Summary

Written by ThreatCluster from victim profile, leak post, screenshot, ransom note

Orion's leak post identifies Nitrex Chemicals India Ltd as the victim, and the post is published. The ransom note on the page states, "We only seek money. No morals, no political stance Your data is only secure IF you pay us." A victim profile lists Nitrex’s legal name, nitrex.in domain, and India as the country, and the page describes the company as a leading manufacturer of industrial nitrocellulose. The page does not disclose data categories, quantities, or other specifics about data assets.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Domains
nitrex.in

What was taken

We only seek money. No morals, no political stance Your data is only secure IF you pay us

Ransom note

Published by the group on their leak site, reproduced verbatim.

We only seek money. No morals, no political stance Your data is only secure IF you pay us

Leak-site images (11)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture
Directory listing of computers with columns for Name, Type, and Description, all entries labeled as "Computer."
onion leak page 44 KB
Screenshot of a directory listing in a management console, showing "Domain Controllers" with entries for "Computer" and "Default First..." along with their types and descriptions.
onion leak page 40 KB
Directory listing of files and folders, including items like "Backup," "Cert2022," and various log files with different extensions.
onion leak page 42 KB
Directory listing of files including a file folder and an EDB file with size details.
onion leak page 26 KB
Screenshot of a file directory showing a single PST file named "devit.pst" with its size and date modified.
onion leak page 18 KB
Directory listing of files including global.asax, web.config, and web.config.bak, with their respective sizes and timestamps.
onion leak page 25 KB
Directory listing of files including global.asax, web.config, and web.config.bak with their respective sizes and timestamps.
onion leak page 25 KB
Directory listing of files and folders, including "Cert," "Logs," "Script," and various document files with extensions like .txt and .xml.
onion leak page 44 KB
Directory listing of files including text documents and security certificates with various extensions like .txt, .cer, and .zip.
onion leak page 32 KB
Directory listing of CSV files including Mailbox items and user data, with timestamps and file sizes.
onion leak page 36 KB