n0n Ransomware Decryption & Data Recovery

SOCRadar describes n0n as a financially motivated data-theft extortion group that emerged in September 2026, likely based in Russia. Before the October wave it had posted 21 victims across 17 countries in investment, telecoms, retail, education and pharmaceuticals.

The 12 October maritime batch. n0n posted 38 organisations at once: container terminals and port operators, port IT, EDI and terminal-system providers, shipping lines and ship operators, agencies and logistics firms, plus adjacent crane and steel companies, across 18 countries and territories. South Korea accounted for the most, 12; the list also includes port and shipping organisations in mainland China, Hong Kong and Taiwan. The whole batch was set to be exposed on 19 October at 13:27 UTC, unlike the staggered deadlines the group used before. Demands reviewed by SOCRadar ranged from $2.4 million to $14 million.

Scale. According to HackerFeeds, by 21 October n0n had posted 125 victims for the month - 17.4% of all postings, more than any other group.

Reliability. When SOCRadar published, none of the listed maritime organisations had publicly confirmed a breach, and earlier claims against several well-known companies had not been confirmed by those companies either. Leak-site numbers are the group's own claims, not verified intrusions.

n0n does not encrypt files, so there is no extension and no ransom note file; identification rests entirely on the extortion side:

• The organisation appears on n0n's dark web leak site, first anonymised as "Company #N" and then named, with a countdown, one to three days later.
• The page carries the volume of stolen data and samples. In the maritime batch these are mostly EDI messages, manifests, gate records, terminal configuration and invoices, from tens of megabytes to a few gigabytes.
• Payment is demanded in Bitcoin to a unique address per victim, with the option of a 10% "entry fee" to open a private negotiation room.

If the contact comes directly by email or messaging, check it against these features and the leak-site page, and be alert to scammers using the n0n name.

SOCRadar's group profile. n0n logs in with credentials harvested by infostealers, then manipulates data with administrative tools; it has taken Active Directory mappings and legal documents.

Likely entry for the maritime batch. The data sets are small and scoped to single applications, and when SOCRadar checked stealer logs many of the maritime victims had no credential matches. It therefore infers that a platform these organisations share or use to exchange data - a terminal operating system, an EDI integration or a file-transfer product - is the more likely source than 38 separate intrusions. That is inference, not confirmed, and SOCRadar notes no evidence linking n0n to MOVEit (2023) or Cleo (2024).

For port and logistics companies, investigation cannot stop at their own network: ask the vendors of any shared platform whether they are investigating.

No public report has observed n0n encrypting files. SOCRadar's ATT&CK mapping lists encryption and recovery-inhibition techniques, but its write-up says the group avoids traditional ransomware deployment and concludes it should be "treated as a data-theft extortion operation with the access to cause damage".

Response therefore centres on scoping the exfiltration, meeting notification duties and removing access - and as long as the intruders' access remains, later damage cannot be ruled out, so it has to be taken back.