New RaaS brands reaching multi-country scale within weeks of launch¶

Signal card · maintained from public sources · last updated 2026-10-26

CategoryThreat-Actor Behaviour

StatusFading

Confidence🟨

First observed2026-09-12

Last updated2026-10-26

Overview¶

Three distinct, newly-observed ransomware/extortion brands have each reached double-digit or multi-country victim counts within weeks of their leak sites going live: Vexy (first seen ~Sep 10), Panzer (live since Aug 5, 16-21 claimed victims across 11 countries by mid-September), and now N0n (first observed claiming victims by Sep 18, four named targets across four countries — Sweden, Turkey, Argentina, Venezuela — in a single day). Promoted from the watchlist (seeded 2026-09-12) on the third independent brand observation, which is the specific "watch for" condition the seed entry named. The question this card tracks: whether new extortion brands are reaching operational scale faster than the historical norm (suggesting lowered barriers — leaked builders, affiliate-recruitment efficiency, commoditized DLS infrastructure) or whether this is three unrelated launches that happen to cluster in one news-monitoring window.

Evidence log¶

2026-09-10/12 — Two newly-observed groups within one week: Vexy (i2k2 Networks, India IT/cloud, first seen ~Sep 10) and Panzer (leak site live since Aug 5, already 16-21 claimed victims across 11 countries by Sep 11, per aggregator tracking). Seeded to the watchlist as a two-brand observation, not yet a named pattern. Ransomware.live — Panzer · GBHackers — Panzer
2026-09-17 — Panzer continues scaling: listed Universität Hamburg (42,000+ students) on its leak site, consistent with the rapid-scale-up pattern already tracked. RedPacket Security
2026-09-18 — Third independent brand, and the fastest multi-country spread of the three. N0n claimed four named victims across four countries in a single day: Transcom WorldWide (Sweden, PayPal support operations, 86.7M connection records claimed), AstraZeneca Türkiye (940MB internal network-security configuration), Ministry of Education — Argentina (network configuration plus 1.08M connection records and a claimed Monero miner), and Inter, Venezuela's largest ISP. All claims are unverified DLS listings with no company confirmation. The specificity of the claimed data (detailed internal network topology — AD/PKI/Netskope/Zscaler tenant maps, VPN/firewall configurations — rather than just bulk record counts) is a distinct claimed-evidence style from Vexy or Panzer's listings, worth tracking as a possible group signature. This is the third independent new-brand observation the Sep-12 watchlist seed named as its promotion trigger. RedPacket Security — PayPal/Transcom · RedPacket Security — AstraZeneca Türkiye · RedPacket Security — Argentina Ministry of Education

Assessment¶

Confidence: 🟨 Moderate. Three independent named brands (Vexy, Panzer, N0n) reaching multi-victim or multi-country scale within weeks of first observation, tracked via a named aggregator (Ransomware.live) and corroborated by independent trade-press/DLS-monitoring coverage (GBHackers, RedPacket Security) for each brand. That clears the bar for a real pattern rather than noise, but no CTI vendor has yet attributed the scale-up to a common cause (shared leaked builder, common affiliate-recruitment pipeline, or a specific enabling infrastructure change) — the three brands could still be independent launches that coincide in this monitoring window rather than a single underlying driver.

Estimate: Likely that at least a fourth new-brand extortion group debuts with comparable early reach within the next quarter, given the pattern has now held for three consecutive brands over ten weeks. Roughly even chance a CTI vendor (ransomware.live, RansomLook, Check Point, Halcyon) publishes attribution tying the scale-up to a specific leaked builder or affiliate-recruitment mechanism rather than treating each brand as independent.

Watch for: a fourth new-brand extortion group debuting with comparable early multi-country reach; CTI attribution connecting two or more of Vexy/Panzer/N0n to a common builder lineage, affiliate network, or infrastructure provider; a slowdown or reversal in the pattern (a new brand that fails to scale, suggesting the prior three were not representative); law-enforcement action against DLS hosting infrastructure that would explain why new brands can stand up operations quickly.

Portfolio relevance: Faster time-to-scale for new extortion brands compresses the window in which a portfolio company's incident-response and threat-intelligence programs have to recognize and prioritize an unfamiliar group name before it has already claimed multiple victims — "we've never heard of this group" is a weaker signal of low risk than it used to be.

Review note (2026-09-25): No fourth new-brand extortion group debuting with comparable early multi-country reach found this window, and no CTI attribution tying Vexy/Panzer/N0n to a common builder or affiliate pipeline. No status or confidence change.

Review note (2026-09-30): Checked for a fourth new-brand extortion group with comparable early multi-country reach; found "Settra" (active since June 2026, ~64-93 victims across ~18 countries by mid-Sep) but its multi-month ramp doesn't match the weeks-to-scale pattern this card tracks, so not counted. No CTI attribution tying Vexy/Panzer/N0n to a common builder/affiliate pipeline found. No status or confidence change.

Review note (2026-10-05): N0n's own scale-up accelerated further: by Sep 22 (four days after first observation) it had posted 13 named victims across 10 countries (US x3, Vietnam x2, Uzbekistan, Mali, Venezuela, Sweden, Türkiye, Argentina, Luxembourg, Brazil; financial services the top-hit sector at 23%) — faster than this card's original "weeks" framing. Strengthens the existing N0n data point rather than adding a fourth brand; still no CTI attribution tying Vexy/Panzer/N0n to a common builder/affiliate pipeline and no fourth qualifying brand found this window. No status or confidence change. Infosecurity Magazine · Ransomware.live — N0n

Review note (2026-10-15): Checked again for a fourth new-brand extortion group with comparable early multi-country reach; GuidePoint's Q3 2026 GRIT report (published Oct 9: record 2,760 victims, more groups/countries than ever) names no specific new rapid-scaling brand, and no CTI attribution tying Vexy/Panzer/N0n to a common pipeline has surfaced. This is the fourth consecutive quiet review (Sep 25/30, Oct 5/15) — 20 days of active checking with no new evidence. One more quiet review cycle (~2026-10-20) crosses the ≥21-day bar and should drop this card to Fading absent a qualifying find before then.

Review note (2026-10-26) — decay verdict. Fifth consecutive quiet review (Sep 25/30, Oct 5/15, now Oct 26) — no fourth new-brand extortion group with comparable weeks-to-scale reach found, and no CTI attribution tying Vexy/Panzer/N0n to a common builder/affiliate pipeline. A Nord Security/ NordStellar dataset surfaced this run naming The Gentlemen and Qilin as the most active groups by volume, but that describes established-brand prolificacy, not a new brand scaling fast — it doesn't qualify as evidence for this card's specific thesis. 31 days of active checking (Sep 25 → Oct 26) with no qualifying find crosses the ≥21-day bar per SIG-12: status moves to Fading. Per DEC-19, this is not a verdict that the original observation was wrong — Vexy/Panzer/N0n's rapid scale-up was real and independently corroborated — only that fresh corroboration of the pattern recurring has stopped arriving. One more evidence-quiet review cycle (~2 weeks) without a qualifying fourth brand archives this as Confidence-decayed.

Sources¶

← All signals