Skip to content

— N0n

Threat-actor battle card · maintained from public sources · last updated 2026-10-17

CategoryRansomware
AttributionUnknown
First seenMid-September 2026
StatusActive
Primary targetsFinancial Services, Technology/IT services, Business Process Outsourcing, Government, Healthcare; US, Sweden, Argentina, Vietnam, Uzbekistan, Brazil, Luxembourg

Overview

N0n is a fast-growing extortion group first observed in mid-September 2026, with 20+ claimed victims across at least seven countries in its first five weeks of activity. Financial services is the single largest claimed-victim sector (roughly 23% of listings per SCWorld). The group is not yet on the Tier-1 leaderboard (claimed-volume trackers have not yet enumerated it against the ransomware.live/RansomLook methodology this card's leaderboard uses), but its volume and a distinctive tradecraft choice — see below — make it worth tracking now rather than waiting for a leaderboard placement. Not victim-enumerated against the Tier-1 leaderboard methodology yet; rank/l3m/ytd left null pending that reconciliation, never a placeholder string.

Tradecraft

  • Backup/shadow-copy destruction rather than encryption-first extortion — N0n leans on harvested infostealer credentials to access victim environments, then focuses on destroying backups and shadow copies to remove the recovery path, rather than running a traditional file-encryption payload first. SCWorld
  • Claims are frequently framed around volume of "connection records" / internal network maps (AD, PKI, VPN/Zscaler/Netskope configuration data) rather than classic PII dumps, consistent with a credential-and-infrastructure-access-first playbook. Infosecurity Magazine
  • Publication deadlines observed so far have run short, roughly 4 days to 2 days from listing.
  • No named initial-access CVE or confirmed affiliate structure sourced yet — leave as unknown pending named vendor reporting.

Notable victims

All DLS claims below are unverified and uncorroborated by the named companies unless stated otherwise; see data/victims.jsonl for the full, growing log (11 claims as of Oct 17 2026). - Transcom WorldWide (PayPal support operations, Sweden/BPO) — claimed Sep 18, 2026; 86.7M "connection records" alleged (Citrix/AAA session logs, internal AD/PKI/Netskope/Zscaler maps); claim-only, source metadata disputed between trackers (country listed as Sweden by one aggregator, Tunisia/Netherlands by others) — treat with extra caution. RedPacketSecurity - Chibitek (US, NJ, managed-IT/cybersecurity services) — claimed Oct 7, 2026; publication deadline Oct 11; aggregator mirrors the group's own leak-site status as "exposed" as of Oct 11, not independently reviewed. SOCRadar - AstraZeneca Türkiye, Fanatics, Inter, STOKR, Precision Facades Ltd, and others — claimed Sep 18–Oct 1, 2026, all unverified; see tracker.

Assessment

N0n is a new entrant worth watching for a specific reason: its backup-destruction-over-encryption approach is a tradecraft choice that, if it spreads to other groups, would blunt the standard "restore from backup, don't pay" defense that has been the industry's primary ransomware countermeasure for several years. At 20+ claimed victims in five weeks it is growing faster than most groups do in their first quarter, though none of its individual victim claims have been independently confirmed by a named company, regulator, or authoritative incident responder as of this writing — every figure above is a claim, not a confirmed breach. No CISA/FBI/NCSC advisory names the group yet. Likely (words-of-estimative-probability) that N0n either consolidates into a recognized mid-tier operator over the next quarter or is absorbed/rebranded, consistent with the typical lifecycle of fast-emerging 2025-2026 groups; too early to assess which.

Sources

⏳ Ongoing cases

Follow-through on this desk: of 6 clock(s) run out — 1 leaked · 5 outcome unknown. All cases →

No open case right now — see Ongoing Attacks for resolved ones.

🗂️ Attacks & victims

All disclosed victims attributed to this actor, newest first.

October 2026

Oct 19 Santos Brasil N0n Ransomware · Transportation & Logistics · Brazil N0n claims Brazil's largest container-terminal operator as one of 12+ port/terminal operators across 18 countries listed in the same wave; no proof samples seen and N0n's own trackers have repeatedly flagged its listings as possibly fabricated or inflated -- treat with extra skepticism. Santos Brasil has made no public statement. · Sources: Breachsense · MundoMaritimo
Oct 18 SMIC US Company N0n Ransomware · technology (semiconductors) · USA N0n claims to have taken corporate files, payroll and financial documents from this Sunnyvale, CA entity described as the US arm of Semiconductor Manufacturing International Corporation; single-source claim, unconfirmed by the company. Both ransomware.live and RedPacket Security's own reporting note N0n's listings have included unverified or possibly fabricated victim claims -- treat this one as low-confidence even by DLS-claim standards. · Sources: RedPacket Security
Oct 14 Interior Technologies N0n Ransomware · physical security services · USA N0n ransomware group claimed Interior Technologies, a US smart-building and surveillance-systems integrator, alleging gateway configuration data and surveillance feeds taken. No company statement or independent corroboration beyond the aggregator listing; treat as an unverified claim. · Sources: DeXpose
Oct 07 Chibitek N0n Ransomware · IT services · USA N0n ransomware group claimed Chibitek, a New Jersey managed-IT and cybersecurity-services provider, alleging client financial records, network credentials and internal documents taken; a roughly four-day publication deadline was set for Oct 11. No independent corroboration -- SOCRadar found no supporting infostealer-log evidence -- and no company statement. Treat as an unverified claim. · Sources: SOCRadar
Oct 01 Houston Thyroid & Endocrine Specialists N0n Ransomware · healthcare · USA Houston, TX endocrinology practice; claim listed, no scope disclosed, no confirmation. · Sources: GalaxyWarden

September 2026

Sep 28 Precision Facades Ltd N0n Ransomware · Manufacturing · United Kingdom UK facade-engineering/construction firm listed on N0n's leak site; claim covers a full file server (finance/accounts, audits, bank mandates, board papers, tender/project data), publication deadline Oct 2 2026. Unverified claim, no company confirmation. · Sources: Ransomware.live · DeXpose
Sep 22 FinSoft (Kolibri retail back-office software) N0n Ransomware · technology & software · Uzbekistan N0n listed FinSoft, an Uzbek retail back-office software vendor, on its leak site, claiming client databases and platform data for 10+ retail chains (sales, stock, pricing, financial records) and threatening to publish one client database per day starting with 'keddo'. No company confirmation. DLS claim only. · Sources: SOCRadar
Sep 22 AFRICA-TECH N0n Ransomware · professional services · Mali N0n listed AFRICA-TECH, a Malian IT-services/document-processing firm, on its leak site, claiming client documents (scans, attestations, insurance/embassy files) and shared business folders, and claiming backups/shadow copies were destroyed. No company confirmation. DLS claim only. · Sources: RedPacket Security
Sep 20 Fanatics N0n Ransomware · consumer & retail · USA N0n listed Fanatics, the global sports e-commerce platform, on its leak site Sep 20, claiming 46,902 order files (~108GB) of customer PII, AP invoices, bank transaction records and tax-exemption certificates, with a Sep 23 01:01 UTC deadline. No company confirmation. DLS claim only. · Sources: RedPacket Security · SOCRadar
Sep 20 Inter N0n Ransomware · telecom · Venezuela N0n listed Inter, Venezuela's largest ISP, on its leak site, claiming 15.3M subscriber connection records and network maps, with a Sep 20 deadline. No company confirmation. DLS claim only. · Sources: Brinztech
Sep 18 Transcom WorldWide (PayPal support operations) N0n Ransomware · Business Process Outsourcing · Sweden N0n claims 86.7 million connection records showing PayPal support-agent Citrix/AAA sessions and internal AD/PKI/Netskope/Zscaler maps across eight sites; unverified, no company confirmation · Sources: https://www.redpacketsecurity.com/n0n-ransomware-victim-paypal-support-operations-transcom-worldwide/
Sep 18 AstraZeneca Turkiye N0n Ransomware · Pharmaceuticals · Turkey N0n claims 940MB internal network-security configuration across three sites plus 1.35M connection records; unverified DLS claim, Sep 21 deadline · Sources: https://www.redpacketsecurity.com/n0n-ransomware-victim-astrazeneca-turkiye/
Sep 18 Ministry of Education (Argentina) N0n Ransomware · Government · Argentina N0n claims network-security configuration plus 1.08M connection records tied to national library, school-book selection, scholarship and credential-validation systems, and evidence of a Monero miner inside the network; unverified DLS claim · Sources: https://www.redpacketsecurity.com/n0n-ransomware-victim-ministry-of-education-argentina/
Sep 18 STOKR (digital securities platform) N0n Ransomware · Financial Services · Luxembourg N0n listed STOKR, a Luxembourg-regulated digital securities platform for issuers, investors and intermediaries, on its leak site Sep 18 with a Sep 20 22:40 UTC deadline, claiming a KYC investor register (names, emails, countries, wallet addresses, tax IDs), identity-to-crypto-wallet mapping for KYC-accepted investors across seven countries, and an internal admin directory; the group says it will also deliver investor data to the tax authorities of investors' home countries. N0n is an emerging group; ransomware.live advises treating its claims cautiously pending corroboration. No company confirmation. DLS claim only. · Sources: Ransomware.live · RedPacket Security

← All threat actors · Full victim database →