New n0n Ransomware Threatens to Destroy Victims’ Backups

A newly identified ransomware group, named n0n, is threatening to encrypt or destroy victims’ backup infrastructure and shadow copies if they refuse to pay. Cybersecurity researchers at CyberXTron said they first observed the group’s activity on 18 September 2026, and that its Tor-based leak site had listed information on more than a dozen victims by 22 September. The group uses double extortion, stealing sensitive data before demanding payment, while adding the threat of disrupting recovery altogether.

Financial services organisations account for 23% of confirmed victims, followed by technology, retail and education at 15% each. Healthcare, defence and professional services organisations have also been targeted. Although the US is the most frequently claimed location, victims have also been reported in Vietnam, Uzbekistan, Brazil, Sweden and Luxembourg.

Some countdown timers have expired and stolen data has been published, indicating that at least some victims have refused to pay; the available reporting does not confirm that n0n destroyed their backups.

CyberXTron’s analysis says the attacks begin with credentials stolen by third-party infostealer malware. The attackers use those credentials to enter corporate networks, escalate privileges and access administrative tools to prepare stolen data for extortion.

The researchers urged organisations to treat n0n as an active threat and recommended multifactor authentication for external access, limiting exposure of VPN, RDP and other remote interfaces, least-privilege controls, network segmentation, and monitoring for lateral movement or misuse of privileged accounts.