Emerging Ransomware Gang Uses Backup Destruction Threats to Pressure Victims
New ransomware gang n0n threatens to destroy backups and has listed more than a dozen victims.
CyberXTron reported a new ransomware group, n0n, first observed on September 18, 2026, whose Tor leak site listed more than a dozen victims by September 22. The group uses double extortion and explicitly threatens to encrypt or destroy backups and shadow copies if victims do not pay. Financial services made up 23% of confirmed victims, with technology, retail, and education at 15% each; the United States is the top target, with claims also in Vietnam, Uzbekistan, Brazil, Sweden, and Luxembourg. Intrusions begin with credentials taken by third-party infostealers, followed by privilege escalation and data staging, and some stolen data has already been released.
- n0n surfaced in mid-September and listed over a dozen victims.
- The gang threatens to encrypt or destroy backups and shadow copies.
- Attacks start with credentials stolen by infostealer malware.
- Financial services accounts for 23 percent of confirmed victims.
- Some countdown timers expired and stolen data was published.
- ATT&CK
- T1078 Valid AccountsT1074 Data StagedT1486 Data Encrypted for ImpactT1490 Inhibit System Recovery
- Threat actors
- n0n
- Malware
- n0n
- Organizations
- CyberXTron
From the original article
2 min read at infosecurity-magazine.com
Ransom notes by n0n ransomware claim to take double extortion to a new level of danger for victims
By Danny Palmer · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.