Threat Actor Investigation n0n

Executive Summary

This report profiles n0n, a financially motivated data-theft extortion group that emerged in September 2026. It examines the group’s activity, victimology, tactics, techniques, and procedures (TTPs), extortion practices, and potential risks to organizations.

As of October 19, 2026, the largest public tracker reviewed recorded 120 listed victims across 28 countries, reflecting rapid growth since the group’s emergence. Notably, on October 12, n0n listed 38 organizations across the global maritime and logistics sectors in a single wave, spanning 18 countries. Although stolen credentials associated with infostealer malware appear to be an important initial access method, analysis of the maritime campaign suggests that the 38 listings may originate from exposure through a shared application or vulnerability rather than independent network intrusions. This hypothesis is supported by similarities in the claimed datasets, their relatively limited size, and the absence of identified infostealer credential matches for many affected organizations. Overall Assessment: n0n represents an emerging extortion threat characterized by rapid expansion of its public victim list, opportunistic targeting, and potential exploitation of shared technology infrastructure. Organizations with exposed credentials, insufficiently secured remote access, or dependencies on third-party service providers may face increased exposure.

Most reported compromises and data-theft claims remain independently unverified. Organizations should prioritize credential security, external attack surface management, third-party risk assessment, and continuous monitoring for potential data exposure.

Threat Actor Profile

Profile

n0n (also written N0N) is a financially motivated extortion group first observed on September 18, 2026. No affiliation with other threat actors has been identified. The group operates as a data-theft extortion actor: it steals data and threatens to publish it unless the ransom is paid. No file encryption has been observed, and its leak-site listings refer only to stolen data. Observed ransom demands range from $2.4 million to $25 million. n0n does not open a communication channel with its victims. Instead, it publishes an individual ransom note for each victim on its Tor-based data leak site, alongside a countdown to the publication of the stolen data.

Activity Timeline

n0n has moved fast. In about one month of activity, it has listed roughly 120 victims on its leak site. The group posted 10 victims on its first day, September 18, and fewer than 20 by the end of September. In October the pace accelerated sharply, with listings arriving in large waves: about a dozen on October 11, 38 maritime and logistics organizations on October 12, and about 40 more between October 15 and 19. Payment deadlines of one to seven days add pressure on victims and leave little time to respond.

Deadlines in the listings we reviewed run from one to seven days. A cloud hosting provider received three days, listings on October 5 had one to two days, and the October 12 port listings had seven. All data below is claimed by the actor and unverified.

Many listings claim operational and configuration data, such as network-security configurations, Active Directory mappings, database scripts, and credentials, not only customer records. That material can support follow-on intrusion. This is our reading of the listings, not a claim by the group.

Victimology

Insights: n0n’s victim list is wide rather than deep. Transportation tops the sector count almost entirely because of the single October 12 wave. Outside that wave, the group hits whatever it can reach, across healthcare, technology, manufacturing and financial services. The same wave explains South Korea’s second place behind the USA, since many of the listed maritime firms are Korean. The most consequential pattern is the share of service providers among the victims: managed IT, cloud, customer support and port IT firms hold other companies’ data, so a single listing can expose many downstream organizations.

Tactics, Techniques, and Procedures

The table maps techniques that associated to n0n to the defensive focus we recommend.

Assessment and Outlook

Based on n0n’s reported access method and victim list, we assess that the following types of organizations are the most likely targets:

• Organizations whose credentials appear in infostealer logs, especially credentials for remote access such as VPN, RDP, and webmail.
• Organizations that expose remote access services without multi-factor authentication.
• Service providers that hold client data, such as managed IT, hosting, and customer support providers, since a single intrusion can expose many clients.
• Port, shipping, and logistics organizations, given the October 12 wave.

This assessment rests on tracker data and public research. Because most listings are unverified actor claims, we rate our confidence as moderate.

Recommendations

Immediate Actions

• Secure exposed credentials. Reset passwords for accounts that appear in recent infostealer logs, and enforce multi-factor authentication (MFA) on every external access point, including virtual private network (VPN), Remote Desktop Protocol (RDP), webmail and admin portals. Stolen credentials are n0n’s main access route.
• Clean the infected devices. Find and remediate the devices behind the infostealer logs. A password reset alone will not stop the credentials from being stolen again.
• Patch internet-facing systems. Patch known exploited vulnerabilities, starting with remote access and edge devices. This closes entry routes other than stolen credentials that any extortion group can use.

Ongoing Measures

• Reduce RDP exposure. Check for RDP exposed to the internet and close it where it is not needed. n0n moves over RDP once inside a network.
• Protect backups. Make sure backups are immutable or offline, test a restore, and confirm that a compromised domain administrator account cannot delete them. Alert on shadow copy deletion and mass service stops. Technique mappings and early reporting point to threats against backups and recovery.
• Harden Active Directory. Monitor privileged accounts, apply administrative tiering, and alert on new RDP sessions, obfuscated scripts, large archive creation and security tool tampering. One analyst source reports that the group exfiltrates Active Directory mappings.
• Review suppliers that hold your data. Assess third parties with access to your data, especially IT, hosting and customer support providers. Many n0n victims are service providers that hold client data.
• Monitor for exposure. Watch leak sites and criminal channels for your brands and domains, and track new credential leaks. This gives early warning of exposure or targeting.

About Check Point Exposure Management

Check Point’s exposure management changes the game.

We combine billions of internal telemetry points with billions of external signals from the open, deep, and dark web to deliver a unified intelligence fabric. This provides clear visibility across the full attack surface, including brand risk.

The industry is moving from fragmented feeds to real context and real priorities. We support that shift through active threat validation, confirmation of compensating controls, and deduplication across tools, so teams can focus on what actually matters.

With safe-by-design remediation, fixes aren’t just assigned, they’re implemented. Every fix is validated before enforcement, enabling measurable risk reduction without downtime.

Gartner predicts organizations adopting continuous threat exposure management with mobilization will see 50% fewer successful attacks by 2028. We’re leading that shift with action, not just tickets, and Fortune 500 organizations across major industries already rely on Check Point Exposure Management.

For more information visit: https://www.checkpoint.com/exposure-management/