"n0n Ransomware" Emerges as a New Threat Group With Destructive Extortion Claims

Executive Summary

n0n is a financially motivated cyber extortion group that emerged in September 2026, first seen on September 18, 2026, with activity tracked through September 22, 2026. The group operates a double-extortion model, combining data theft with threats to destroy or encrypt victims' backup and shadow-copy infrastructure, publishing victims to a dedicated Tor-hosted leak site ("no js | no mercy") when payment deadlines are not met.n0n has published 13 victims to date across 10 identified countries, spanning sectors including financial services, education, retail & e-commerce, technology, and healthcare/pharmaceuticals. Of these 13 listings, 2 remain active with pending payment deadlines and 11 have already had data leaked after deadlines expired.

Threat Profile

Group Overview

n0n operates a paid data-theft-and-extortion model, combining exfiltration of sensitive corporate data with explicit threats to destroy or encrypt victims' backups and shadow copies in order to halt business operations if settlement is not reached. The group relies on compromised credentials sourced from third-party infostealer malware to gain initial access to corporate networks, then uses administrative tools within the environment to manipulate and stage data ahead of extortion demands.

Operational Characteristics

The infographic depicts n0n as a data-theft-and-extortion operation that uses stolen credentials obtained from infostealer malware for initial network access, followed by data staging and exfiltration targeting client/customer databases, platform data, documents, and Active Directory information. The group applies extortion pressure by threatening to encrypt or destroy backups, disrupt business operations, and publicly release stolen data through its dark-web leak site, where victims are listed with countdown deadlines and details of the data at risk. n0n also provides a personal-key-based negotiation portal for victim representatives.

Victimology

Overview

Geographical Distribution

Victims span 10 identified countries: United States (3), Vietnam (2), Uzbekistan (1), Mali (1), Venezuela (1), Sweden (1), Türkiye (1), Argentina (1), Luxembourg (1), and Brazil (1). This spread shows a lead concentration in the United States, with a secondary cluster in Vietnam, but no dominant regional focus, consistent with an opportunistic targeting pattern.

Sector Targeting

Based on the 13 confirmed victim listings, Financial Services accounts for the largest share at 23% (3 victims). Technology, Retail & E-Commerce, and Education each account for 15% (2 victims each). Government & Defense, Healthcare, Professional Services, and Other each represent 8% (1 victim each). This distribution shows activity across multiple industries, with no single sector accounting for a majority of the identified victims.

Case Detail: Retail software vendor / IT services · Uzbekistan (Active Listing)

n0n's listing page for  includes a "What will be published if no settlement is reached" notice, stating the group holds client databases belonging to 10+ retail chains connected to the platform (named examples include Keddo, Marc, Lancaster, and Comf_rus), along with the back-office platform and API service data itself. The listing further states that  business operations are fully stopped, and that nothing restores operations without settlement, because all backups and shadow copies are encrypted or destroyed.

Case Detail: IT services / document services · Mali (Active Listing)

n0n's listing page for  (IT services / document processing) includes a "What will be published if no settlement is reached" notice, stating the group holds client documents including scans, attestations, insurance records, embassy files, and shared business folders. The listing states that operations are fully stopped, and that nothing restores without settlement, because all backups and shadow copies are encrypted or destroyed  matching the same operational-disruption pattern seen in the Retail software vendor / IT services · Uzbekistan

Both active-listing case details reinforce the same finding: n0n's model is not data-theft-only. Across both  cases, the group states plainly that it encrypts or destroys backups and shadow copies to fully halt victim operations, in addition to exfiltrating client data for leak-site pressure  consistent double-extortion behavior rather than an extortion-only approach.

Technical Analysis

Initial Access: n0n elies on compromised credentials obtained from third-party infostealer malware to gain unauthorized access to corporate networks, rather than exploiting a specific vulnerability or developing custom access tooling.

Execution, Discovery, and Lateral Movement: Observed/associated TTPs include use of command and scripting interpreters for execution, abuse of valid accounts and remote services (including RDP) for lateral movement, and use of legitimate administrative tools to manipulate and stage victim data.

Collection and Exfiltration: n0n exfiltrates sensitive corporate data  including full client/customer databases, back-office and API service data, client documents (scans, attestations, insurance and embassy files), shared business folders, and Active Directory mappings  prior to issuing extortion demands, using this stolen data as leverage.

Encryption and Impact: n0n's own victim notices state that backups and shadow copies are encrypted or destroyed to prevent operational recovery without settlement, halting business operations entirely   across both the active listings. Associated TTPs also reference defense evasion techniques (impairing defenses, obfuscating files), inhibiting system recovery, service stops, and persistence via valid accounts and autostart execution mechanisms  consistent with deliberate backup/recovery-targeting behavior alongside data theft.

Leak Site and Infrastructure Analysis

n0n operates a Tor-hosted data leak site (DLS) under the tagline "no js | no mercy," available at the time of this report with no CAPTCHA gating and no indication of law-enforcement seizure. The site's homepage carries the message: victims that lose control of their networks face a public data release when the countdown ends without payment, while those who "honored their deadline" (paid) are listed with respect. Victim representatives are directed to use a personal key from their ransom note to access a dedicated negotiation room.

The site structure includes:

MITRE ATT&CK TTPs

Indicators of Compromise (IOCs)

No file hashes, IP addresses, malware samples, or additional network indicators have been independently confirmed for n0n at the time of this report. This activity is being actively monitored, and this section will be updated as verified IOCs become available.

Mitigations & Recommendations

1. Initial Access Hardening

2. Identity & Credential Protection

3. Network Security & Lateral Movement Control

4. Endpoint Protection & Threat Monitoring

5. Data Protection & Exfiltration Prevention

6. External Exposure & Leak Monitoring

7. Backup & Recovery Strategy

8. Incident Response & Extortion Readiness

Conclusion

n0n represents an emerging, credential-driven double-extortion threat that has moved quickly since its September 18, 2026 debut, claiming 13 victims across 10 countries and a wide spread of industries within roughly one week. n0n's own victim notices  across both the active listings state that the group encrypts or destroys backups and shadow copies to fully halt business operations, combined with exfiltration of client data, documents, and platform information for leak-site pressure. With a structured leak site offering active, leaked, and honor-based victim tracking with dual download formats, and 11 of 13 listings already past deadline and leaked, organizations  particularly those relying on third-party support providers, IT/document-processing vendors, and outsourced operations with access to sensitive infrastructure  should treat n0n as an active and credible double-extortion threat requiring prompt attention to credential hygiene, access monitoring, and backup isolation.