Loading malware…
n0n is a ransomware family associated with a financially motivated extortion operation targeting organizations across multiple countries and industries. Its lightweight locker uses AES-256-CBC encryption and includes Windows, Linux and PowerShell variants, with an additional OpenSSL-based encryption stage for firewall appliances. Each encryptor build uses a single hardcoded encryption key without per-victim derivation. Accompanying wrapper scripts stop services, delete volume shadow copies and wipe free space to impede recovery.
The n0n operation combines encryption with data theft and threats to publish stolen information. Some documented attacks destroyed data and backups instead of deploying the locker. Initial access has relied on weak or compromised credentials, including credential stuffing against FortiGate SSL-VPN appliances, weak RDP and WinRM credentials, exposed AWS access keys and compromised administrative browser sessions. Associated tooling collects browser passwords, session cookies, mailbox contents and emailed MFA codes. Operators maintain access using hidden administrator accounts, privileged scheduled tasks, SSH authorized keys and covert proxies, and use remote administration mechanisms for execution and lateral movement.
Targets have included cloud and managed-service providers, retail, telecommunications, government, pharmaceuticals, education, maritime transport and logistics. Extortion tactics include publishing stolen data and contacting victims' customers and other third parties. The operation has also manipulated firewall policies and deleted cloud-hosted data to increase pressure on victims. Operators used an AI coding agent to develop and debug attack scripts, while retaining human direction of attacks.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
SOCRadar has uncovered the live workspace (i.e., open directory) of a threat actor tied to the n0n ransomware group, which exposed the operation's full workflow as of September 2026.
2 distinct techniques documented for this family, organized by ATT&CK tactic.
Locker and audit runs as SYSTEM tasks every 5-10 minutes
Locker and audit runs as SYSTEM tasks every 5-10 minutes
Locker and audit runs as SYSTEM tasks every 5-10 minutes
n0n locker (Windows/Linux) and the OpenSSL stage on FMC appliances
17 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.