Loading story…
The newly observed n0n ransomware group is conducting double-extortion attacks that pair data theft with threats to encrypt or destroy victims' backups and shadow copies if ransom demands are not met. First identified by CyberXTron on September 18, the group had launched a Tor-based leak site and listed more than a dozen alleged victims by September 22; some countdowns expired with stolen data subsequently released.
n0n reportedly gains initial access through credentials stolen by third-party infostealer malware, escalates privileges, and abuses administrative access to prepare systems and data for extortion. Financial-services organizations are its primary targets, particularly in the United States, though reported victims also span technology, retail, education, healthcare, defense, and professional-services sectors worldwide. Organizations should prioritize credential hygiene, monitor privileged-access activity, and maintain isolated, protected backups.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
CyberXTron published details describing n0n's use of credentials stolen by infostealer malware for initial access, followed by privilege escalation and administrative access to stage victim data for extortion.
By this date, n0n had established a Tor-hosted leak site and listed more than a dozen alleged victims. The group threatened to release stolen data and to encrypt or destroy backups and shadow copies if ransoms were unpaid.
CyberXTron first observed activity from the newly emerged n0n ransomware group, which operates a double-extortion scheme.
Some victim countdown timers on n0n's leak site expired and stolen data was released, indicating that at least some victims did not pay the ransom.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ransomware operations are increasingly **industrialized**, shifting from simple file encryption to multi-stage extortion that combines **encryption**, **data theft/leak threats**, **DDoS**, and in some cases direct pressure on third parties such as customers, partners, or regulators. This “quadruple extortion” model has been associated with major groups including **ALPHV/BlackCat**, **CL0P**, and **LockBit**, reflecting a broader trend toward scalable, high-tempo campaigns designed to maximize coercion and revenue. At the same time, incident-response reporting indicates some **zero-day-driven, downstream mass data-theft extortion** campaigns—popularized by **CL0P** against widely used file-transfer platforms—are becoming less effective at driving payments, as organizations better understand that paying for “data suppression” does not remove notification obligations or meaningfully reduce litigation and re-extortion risk. Separately, GuidePoint assessed with high confidence that the new “**0APT**” leak site’s claimed victim list is largely **fabricated** (or recycled from other groups) and likely intended to enable opportunistic extortion, re-extortion, or affiliate fraud; organizations named by 0APT were advised to validate impact via concrete indicators (e.g., ransom note, encryption, direct communication) before treating the posting as evidence of compromise.
Jun 29, 2026
The **REvil/Sodinokibi** ransomware operation broadened its playbook by combining network-wide encryption with data theft, public leak threats, and dark-web auctions of stolen files. The gang threatened to publish or sell data taken from victims including **GEDIA Automotive Group** and other unnamed companies, sometimes releasing samples such as an Active Directory **AdRecon** report or promising daily disclosures of employee and financial records. REvil also launched an auction site to monetize stolen data from non-paying victims, with opening bids such as **$50,000** in **Monero**, extending the pressure tactics already used in high-profile corporate extortion cases. Intrusions tied to REvil also showed increasingly targeted post-compromise activity. Symantec observed attackers using **Cobalt Strike**, PowerShell, remote access tools, and account creation to move laterally, disable defenses, and deploy ransomware, while also scanning some victim networks for **point-of-sale software** that could enable payment-card theft or prioritize systems for encryption. Reported victims included a New York airport, a New Jersey synagogue, and organizations in services, food, and healthcare, while Microsoft said human-operated ransomware crews were exploiting exposed **RDP**, vulnerable internet-facing systems, and flaws such as **`CVE-2019-19781`** and **`CVE-2019-11510`** before spending weeks or months inside networks prior to encryption.
Aug 15, 2026
Sophos reported that the **Snatch** ransomware operators are compromising Windows environments and rebooting infected machines into **Safe Mode** before encrypting files, a tactic designed to bypass many security products that do not run in that state. The malware installs itself as a Windows service named `SuperBackupMan`, alters Safe Mode boot settings, deletes Volume Shadow Copies, and encrypts data with a victim-specific five-character file extension. Investigated intrusions showed the attackers gaining initial access by brute-forcing exposed remote services such as **RDP**, then moving laterally across enterprise networks, conducting reconnaissance, stealing data, and deploying tools including **Cobalt Strike**, custom malware, and legitimate administrative utilities. Sophos linked the activity to the self-described **"Snatch Team"** and cited signs of affiliate-style recruitment on Russian-language criminal forums, while incident data from Coveware indicated at least 12 negotiations over several months with ransom demands ranging from **$2,000 to $35,000 in Bitcoin** against organizations in the United States, Canada, and parts of Europe.
Aug 15, 2026