Loading threat actor…
n0n, also styled N0n, is a financially motivated ransomware and data-extortion operation that emerged publicly in September 2026. Its name contains a zero between two lowercase n characters. It targets organizations internationally across maritime transport and logistics, information technology, telecommunications, retail, healthcare, financial services, government and education. No definitive geographic or national attribution has been established. Documented intrusions rely on weak or compromised credentials rather than demonstrated vulnerability exploitation. Initial-access methods include credential stuffing against FortiGate SSL-VPN appliances, weak RDP and WinRM credentials, exposed AWS access keys, compromised hosting portals and reused administrative browser sessions. Operators collect browser passwords, session cookies, mailbox contents and emailed multifactor authentication codes. Persistence mechanisms include hidden administrator accounts, scheduled tasks, SSH authorized keys and covert proxies. The operation uses remote-management interfaces and scripts for execution and lateral movement and has disabled endpoint protection during documented activity. n0n combines data exfiltration with encryption, destructive deletion of data and backups, and manipulation of firewall policies to block traffic. Its encryptors include Windows, Linux and PowerShell variants using AES-256-CBC; examined builds contain hardcoded encryption keys without per-victim derivation. Human operators use AI coding agents to write and debug attack scripts, rather than operating a demonstrated fully autonomous attack system. The group maintains a Tor leak site with publication deadlines and private negotiation rooms. Extortion includes threatened disclosure, ransom demands and pressure on victims' customers, service providers, unions and media outlets. On October 12, 2026, it published a coordinated batch of 38 purported maritime, port and logistics victims across 18 countries. Leak-site listings and claimed settlements do not independently establish separate successful compromises or ransom payments.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
50 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
3 malware families Mallory has associated with this actor across public reporting.
19 indicators attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.