N0n Ransomware: Data Extortion and Incident Response

The n0n ransomware group is an extortion operation first observed posting victims on its Tor leak site on September 18, 2026. Despite the ransomware label, n0n has no publicly known encryptor: the group posts claims of stolen data and threatens to publish it. Its largest batch to date listed 38 organizations at once, nearly all in ports, shipping, and logistics.

If n0n has listed your organization, Proven Data's incident response team can help verify the claim and contain any active intrusion.

N0n ransomware at a glance

What is n0n ransomware?

N0n is an extortion group that threatens to publish stolen data unless victims pay.

Some researchers describe the group as a data-theft extortion operation, while others see it as a double-extortion ransomware group that threatens to destroy backups. The public evidence best supports the first.

No forum recruitment or sign of a rebrand from an earlier group has been reported. By October 22, the leak site had announced an upcoming release covering "more than 500 organizations" from what it called its largest breach, with no names or samples, and said the group would open to affiliates. The group's origin is unknown, and no public government advisory names n0n.

N0n should not be confused with unrelated threats that have similar names, and have similar IOCs, such as:

• Non, a 2019 ransomware strain that appends .non to files;
• a Phobos ransomware variant whose extension ends in .Non;
• the NoName group, also tracked as CosmicBeetle;
• and dAn0n, a data-extortion actor that posted victims in 2024.

N0n's maritime listings: 38 organizations in one batch

N0n posted the maritime batch on October 12, 2026: 38 organizations from 18 countries and territories, including 12 in South Korea. Nearly all were terminal and port operators, shipping lines, logistics firms, and port IT providers. Unlike the anonymous listings n0n had posted since October 5, these listings named victims from the start. Each carried a publication deadline seven days out: October 19, 2026, all but one at 13:27 UTC.

Other n0n listings show no amount, but each maritime listing came with a payment page: a settlement amount in US dollars with its Bitcoin equivalent and a dedicated Bitcoin address.

The page promised a transaction without contact: "payment is verified automatically on the bitcoin network. your data is destroyed and this page is removed the moment the full amount arrives. no registration, no contact, no negotiation." Victims who preferred to negotiate had to pay a one-time fee of 10% of the demand to open a private negotiation room.

As first posted, listed amounts ranged from $400,000 to $400 million per organization and totaled roughly $1.22 billion. The group later lowered the five highest demands, bringing the total to about $276 million. The amounts did not match the data volume: one logistics firm was asked for $14 million for 60 MB, while an Indonesian port logistics provider's 2.4 GB was priced at $2.4 million.

Compromised Data and Vendor Supply Chain Links

The listings describe mostly small, operational data: EDI archives, container gate and cargo records, invoices and other commercial records, terminal system configuration, and database scripts, plus internal credentials in two listings. N0n reportedly gets in with infostealer credentials, yet a check of infostealer logs found none for many of the maritime domains. Analysts reviewing the maritime listings suspect a single source rather than 38 separate intrusions, but this remains unconfirmed.

One maritime security analysis identified at least 21 of the 38 as publicly documented customers of CyberLogitec, a Korean maritime software vendor, and found the vendor's name or product names in seven of 85 sample file names. It tentatively traced the data to a single support and project archive linked to CyberLogitec, split by customer. It reported no signs of fabrication but could not say how n0n obtained the data.

Claims Verification and Affected Party Responses

Victim listings on ransomware leak sites represent unverified claims made by the threat actor. Treat them as unconfirmed unless company disclosures, SEC filings, regulatory notifications, or law enforcement confirm them.

Korean media reported these responses:

• CyberLogitec confirmed that the Korean terminal and shipping companies named in early press reports are its customers and sent them a precautionary notice. After the release, it said the customers' solutions are fully network-separated, so there is no problem.
• Dongkuk Steel called the listing the attackers' one-sided claim and said it had not confirmed any actual damage.
• HMM, which operates the listed terminal in Algeciras, Spain, said it had found no damage and that the sample files n0n posted do not exist in the terminal's systems.
• An unnamed listed company dismissed the data as unimportant five-year-old emails.
• KISA, South Korea's national internet security agency, began notifying listed Korean port companies of an intrusion; an IT manager at one said the company had received the notice and was still assessing the damage.

Deadline Expiration, Data Publication, and Broader Exposure

After the deadlines, the site marked all 38 listings as published and added download links. Korean media reported archives uploaded for all 12 Korean companies; files from two appeared to include contracts, business plans, and vessel schedules. The group called this a first release, with more to follow until a settlement. No releases have been reported for the other 26 listings as of October 23.

Exposure may reach beyond the 38 names. EDI messages often carry data about other carriers and trading partners, so organizations that n0n has not listed could still be exposed.

Does n0n encrypt files or destroy backups?

No public evidence shows that n0n encrypts files or destroys backups. As of October 23, no n0n malware sample, ransom note, or encrypted file extension has been published.

The widely reported claim that n0n destroys backups and shadow copies traces to two of the more than 100 organizations it has listed: its listings for an IT services firm in Mali and a retail software vendor in Uzbekistan claimed that "all backups and shadow copies are encrypted or destroyed." Both were among n0n's first 13 listings, so early reports presented threats to destroy backups as typical of the group.

In total, 10 listings have claimed some form of disruption:

• network blackouts or severed connectivity at five organizations listed on the first day;
• cloud data "under our destructive control; deletion has begun" at an e-commerce company;
• servers at a cloud hosting company, described in one version of the listing as "paused and intact" and in another as removed along with their backups;
• client surveillance feeds shut off and administrator access "reset by us" at a surveillance systems integrator;
• the backup and shadow copy claim above, in two listings.

If these claims are real, removed servers, deleted cloud data, and reset administrator access are consistent with administrative control of victim systems rather than a deployed encryptor. Such actions do not require malware, and no public report documents tampering with EDR or other security tools.

Backups appear more often as stolen data than as destroyed infrastructure: three listings, the two above and the cloud hosting company's, claimed to have destroyed backups, while at least seven advertised backup archives among the stolen files, including four weekly backups from a medical practice.

How n0n's leak site and extortion work

N0n extorts victims through a single Tor leak site signed "no js | no mercy." The homepage opens with "Your data has a deadline" and asks company representatives to enter a personal key to reach a negotiation room. Until October 22, the site said the key came from a ransom note; no such note has been made public.

The leak site sorts listings into four statuses:

• Pending exposure: the victim appears only as "Company #N" with a sector and location while a countdown runs for one to three days.
• Exposed: the listing carries the victim's name and a new countdown of about four days to publication. Several anonymous listings were renamed within hours of their deadlines passing.
• Leaked: the site says it has published the data; public reports describe actual releases for at least 15 victims, including the 12 Korean companies in the maritime batch.
• Honor: the group lists organizations it says paid in time; the homepage says they are "remembered with respect."

Because trackers record renamed and reposted listings as new entries and keep listings the group has removed, their totals overstate the number of victims. On October 23, 2026, the site's own counter showed 106 organizations, while ransomware.live had recorded 150 entries.

Only the maritime listings showed a price; one early listing instead invited the victim to "settle in their private negotiation room."

The group also applies pressure through third parties. A listing for a Luxembourg investment platform threatens to deliver investor data "to the tax authorities of the investors' countries," and one for a retail software vendor warned that "their clients will know exactly whose software failed them."

Who n0n targets

Within its first month, n0n's listings shifted from scattered organizations worldwide to maritime firms and US businesses. The September listings spanned unrelated sectors and countries, from a Venezuelan internet provider and an Argentine government ministry to a Luxembourg investment platform and a Vietnamese betting operator. After the maritime batch, most new victims were in the United States, now the country with the most listings on the leak site.

Four kinds of listings stand out for what they put at risk:

• Large data volumes: listings offer "46,902 order files (108 GB) with customer personal data" from a sports e-commerce company and 86.7 million connection records from agent sessions at an outsourced customer support provider for a global payments company.
• Patient data: US healthcare listings include an endocrinology practice, an eye care practice, a dental laboratory, and a surgery center. Listings for the first three advertise patient data, including patients' Social Security numbers at the endocrinology practice.
• Employee records: a construction firm's listing offers employee W-2 forms with Social Security numbers.
• Client data: listed service providers include a retail software vendor, a cloud hosting company with 167 tenant accounts, a bookkeeping and tax practice, a surveillance systems integrator, and an MSP. Their listings put client data at stake, not just the providers' own.

As of October 23, 2026, no listed organization has publicly confirmed a breach of its own systems. An Australian neurology practice came closest to a public confirmation: it said that the claim "relates to an incident affecting the environment of a third-party technology provider" and that forensic experts were verifying it.

N0n's TTPs and MITRE ATT&CK mapping

No n0n intrusion has been publicly analyzed, so the table rests on two threat intelligence reports, the leak site, the group's listings, three analyses of the maritime batch, and news reports. "Reported" means stated by researchers without incident evidence; "Claimed by n0n" means listing text only.

One leak-site tracker shows a 10-technique ATT&CK mapping for n0n, including T1486 Data Encrypted for Impact. The mapping mixes the group's claims with analyst assessment: none of its techniques rests on a malware sample or an investigated intrusion. The table omits T1486: no listing claims victims' files were encrypted, only backups. Network blackouts and other claimed outages stay unmapped: the listings name no method that would fit a technique.

N0n IOCs and detection opportunities

N0n has two public network indicators: its Tor leak site, nongzecb[...]tpusnad[.]onion, and a clearnet mirror, n0n[.]to, which no longer resolves. No file hashes have been published as of October 23, 2026. Threat intelligence firm CYFIRMA has released Sigma and YARA hunting rules, mostly for n0n's likely techniques, but none has been validated against n0n activity. Each maritime listing carried its own Bitcoin address, which this article does not reproduce.

Detection has to rely on behavior. Based on reported and claimed activity, hunt for:

• sign-ins to VPN, remote access, and cloud services with credentials that appear in infostealer logs or a listing's samples, especially from new devices, locations, or IP ranges;
• vendor and support accounts (file transfer, EDI, remote support) logging in off-schedule or downloading unusual volumes of data;
• RDP sessions from hosts that do not normally use RDP, or from external addresses;
• large or unusual outbound transfers, and archives staged on file servers beforehand;
• bulk administrative actions: virtual machines paused or deleted, mass deletion in cloud storage, shadow copies or backup jobs deleted, or administrator passwords changed outside change control.

What to do if n0n lists your organization

First, start an emergency incident response with Proven Data and involve breach counsel and your cyber insurer in parallel: n0n's countdowns last only days, many policies require prompt notice, and decisions in the first hours determine what you can prove later.

Verify the claim and contain any intrusion

• Capture the listing: screenshots, the countdown, sample file names, and any demand or Bitcoin address shown. The group has rewritten several listings since posting them.
• Have responders retrieve and hash the sample files in an isolated environment, handle them as confidential personal data, and compare them with your own records.
• Establish where that data is stored: your own network, a cloud service, or a vendor's systems. In several n0n cases, the data may have come from a vendor rather than the listed organization.
• Do not pay any fee to open a negotiation room, enter a personal key on the leak site, or contact the group yourself; counsel and the response team must decide whether to engage with the threat actor.
• If the intruder could still be active, isolate affected hosts and disable compromised accounts. Keep isolated systems powered on to preserve memory evidence, and power down only hosts you cannot disconnect.
• Before rebuilding anything, capture memory and disk images, and export identity provider, VPN, and remote access logs. Preserve ransomware evidence with a chain of custody to support regulatory, insurance, and legal work.
• Reset credentials that appear in infostealer logs, credentials for vendor and support accounts, and any passwords, keys, or tokens found in the samples or named in the listing, then revoke active sessions.
• Take RDP off the internet and review recent remote sign-ins for unknown IP addresses and devices.
• Take a known-good backup copy offline and reset administrator credentials for backup, hypervisor, and cloud consoles.

Scope the data and start the notification clocks

• Identify the data types the listing describes and the samples contain, such as health records or Social Security numbers; they determine which notification rules apply.
• Review firewall, proxy, and file-access logs for large outbound transfers in the months before the listing, and ask any vendor that holds the data for its own log review.
• US organizations should report the incident to the FBI through IC3, including any Bitcoin address shown in the listing, and to CISA.

Counsel decides which of these deadlines apply:

HIPAA covers unsecured protected health information, and business associates must notify the covered entity within 60 days of discovering the breach. State breach laws can also apply, notably when Social Security numbers are exposed, and several require notice within 30 days.

In South Korea, for incidents since October 1, 2026, online service providers must notify users without delay when an intrusion leaks or may leak their data. Since September 2026, organizations must also notify everyone potentially affected within 72 hours when unauthorized access suggests a leak, but they cannot tell whose data was exposed, or when some people's data is confirmed leaked, and others' may have leaked too.

Prepare for the publication deadline

• Draft customer, partner, and regulator statements before the countdown ends.
• Warn staff and partners about targeted phishing: invoices, support tickets, and staff details in the stolen data make convincing lures.

Is there a n0n decryptor, and how do you recover from a n0n ransomware attack?

There is no n0n decryptor, and because the group has no publicly known encryptor, recovery is unlikely to depend on one. No More Ransom lists no tool for n0n either. The free decryptor for Non, the unrelated 2019 strain, does not apply to n0n.

If the disruption n0n claims is real, recovery most likely means regaining administrative control and restoring what was removed: rebuilding removed servers, recovering cloud data from soft delete or versioning while retention allows, and restoring from clean backups. Check that backups are unaltered before relying on them; if they are incomplete or damaged, ransomware data recovery services can help recover their contents.

Restore only after closing the access path and rotating credentials; otherwise, the intruder can reuse the same accounts. If the access path runs through a vendor, closing it means cutting that vendor's access or issuing it new credentials.

Magdy Abdelaziz, Proven Data's Head of DFIR, is seeing more cases where the attacker "entered through a trusted vendor or MSP," and explains: "That changes containment because we also have to validate the trust relationship that delivered the access."

Should you pay n0n?

Paying n0n is not advisable: it cannot undo the theft, and the stolen data still requires notification and harm reduction. The only public terms, on the maritime payment pages, promised deletion once the full amount arrived. None of the pages' Bitcoin addresses had received funds by October 23, and all 11 organizations the site lists as having paid are unnamed, so nothing confirms any payment or deletion.

Payment also carries sanctions risk. A US Treasury advisory on ransomware payments warns that civil penalties can apply to anyone subject to US jurisdiction even when they did not know the recipient was sanctioned. N0n's operators remain unidentified, so no one can rule out that risk.

DO NOT PAY THE RANSOM. Decisions about ransom payment carry legal, operational, and financial consequences, including potential OFAC sanctions exposure, and should be assessed with qualified legal counsel and an incident response team before any decision to engage with or pay the threat actor. That assessment must not delay containment, evidence preservation, required reporting, or recovery.

Security checklist

• Enforce phishing-resistant MFA on every remote access path. Infostealer credentials, n0n's reported way in, often come with session cookies that bypass MFA, so revoke existing sessions once MFA is enforced.
• Monitor infostealer logs. Rotate any employee or vendor credential the moment it appears there, and revoke its active sessions.
• Restrict RDP to managed jump servers. RDP is one of n0n's reported lateral movement methods, and no server or workstation should accept it from the internet.
• Inventory and monitor vendor access. List vendor support and remote access accounts, require MFA on them, rotate shared or long-lived credentials, and alert on off-schedule use. Ask which vendors keep copies of your data: one vendor breach can expose many of its customers at once.
• Protect backups from theft and destruction. N0n advertises backup archives as stolen data and claimed in three listings that it destroyed victims' backups, so encrypt the archives, use separate credentials for backup consoles, and keep offline or immutable copies.
• Alert on bulk administrative actions in hypervisor, cloud, and identity consoles. The disruption n0n claims could be carried out through administrative control of victim systems, without an encryptor, so endpoint tools alone may miss it.
• Alert on large outbound transfers. Data theft is the core of n0n's model, and staging and outbound transfer are where you can catch it on your own network.