n0n ransomware operation lists 93 victims in five weeks

SOCRadar’s Dark Web Profile on n0n Ransomware details a financially motivated data-exfiltration and destructive-extortion operation that emerged on the Dark Web in September 2026. In roughly five weeks, the group listed 93 victims across 27 countries, with the heaviest concentration in the United States and South Korea. By 19 October 2026, total ransom demands reached about $283.7 million.

The operation runs a three-stage extortion process (attack, public exposure on a leak site, and publication of leaked files) and uses per-victim negotiation rooms for victims to access their profiles after paying. A notable tactic in October involved dropping the negotiation entirely for some victims, forcing full payment or public publication within tight deadlines. Some “HONORED” entries (data destroyed after payment) emerged, though on-chain transactions were not validated for those cases.

The group’s initial access vector relies on weak or compromised credentials rather than exploit code.

FortiGate SSL-VPN credential stuffing against hundreds of appliances, alongside RDP/WinRM password sweeps, exposed AWS IAM keys, hijacked hosting-provider sessions, and credentials scraped from SaaS/CI/CD pipelines, are documented in the exposed operator workspace. n0n operates a multi-machine infrastructure, including a central staging node hosting an AI coding agent, a leak-site backend, a loot vault, and a seedbox for torrent distribution.

Its ransomware locker is a lightweight AES-256-CBC encryptor that runs under wrapper scripts; some builds share a single 32-byte key, enabling possible decryptor cross-victim access. The operator’s use of AI-assisted tooling is substantial but remains human-directed rather than autonomous. Evidence points to a multi-operator, large-scale operation with bespoke negotiation and payment mechanics, all aimed at maximising financial impact.