N0n ransomware

N0n (written with a zero) has no known encryptor: there is no published file extension, ransom note filename or note text, so an incident shows up as a leak-site listing or an extortion demand rather than as locked files. It is a data-extortion group that began posting victims on a Tor leak site in September 2026, although it is tracked alongside ransomware gangs. Its listings carry publication deadlines, and some come with a Bitcoin payment page that promises automatic deletion on receipt of the full amount, with a fee charged to open negotiation instead. Claims span dozens of countries, with a large October 2026 batch naming port terminal operators, shipping lines and logistics firms; analysts suspect much of that batch came from a single third-party software support archive rather than separate intrusions, and several named companies disputed the claims. Access is reported to come from stolen credentials. It is unrelated to the 2019 Non ransomware that appends .non, to Phobos files ending in .Non, and to the NoName group.

Decryptor: Decryptor availability has not been recorded. Checked 2026-10-28.

Data exfiltration risk: Likely — The group's leak site claims stolen data and posts samples, but no forensic report has confirmed the thefts and several named companies dispute them.

Do this first: Compare the leak-site sample files against your own systems and third-party software vendors' support archives before treating the listing as a breach of your network.