Ransomware Intelligence / Groups / n0n
Ransomware group
n0n
- 22claims, 7 days
- 168claims, 30 days
- 193claims, 90 days
- 2026-09-18first seen
- 2026-11-04last seen
These are claims posted by the group on its leak site, counted when we first see them. They are not confirmed incidents, and we never name a victim.
Activity, last 26 weeks
New leak-site claims per week.
In the news
Recent stories in the security press that name n0n, newest first.
- Crim spent $7K+ on AI services in extortion attacks, then left evidence for all to see
- N0n ransomware: what you need to know
- Emerging Ransomware Gang Uses Backup Destruction Threats to Pressure Victims
Headlines are shown as the publisher wrote them and link to the original story. They are third-party reporting, not SecuritySnares findings. How stories are picked
Sectors claimed, last 90 days
- Technology 39
- Transportation and logistics 32
- Retail 26
- Healthcare 18
- Manufacturing 18
- Professional services 18
- Financial services 12
- Critical infrastructure 9
- Media and entertainment 5
- Construction 4
- Hospitality 3
- Nonprofit 3
- Other 3
- Unclassified 1
- Government 1
- K-12 education 1
Countries claimed, last 90 days
- United States 100
- South Korea 14
- Brazil 7
- Canada 5
- Indonesia 4
- United Arab Emirates 3
- Australia 3
- Spain 3
- United Kingdom 3
- Netherlands 3
- Vietnam 3
- Argentina 2
- BG 2
- Switzerland 2
- China 2
Vulnerabilities n0n exploits
Our sources do not attribute specific vulnerabilities to n0n .
70% of successful ransomware attacks use remote encryption (Microsoft, 2024): files on protected servers are encrypted over the network from a device the attacker controls. Read our remote encryption briefing →
Newest vulnerabilities used by any ransomware group (CISA KEV)
| Added | CVE | Vendor / product | Vulnerability |
|---|---|---|---|
| 2026-08-18 | CVE-2026-59310 | Broadcom VMware vCenter | Broadcom VMware vCenter Path Traversal Vulnerability |
| 2026-08-05 | CVE-2026-63077 | JetBrains TeamCity | JetBrains TeamCity Deserialization of Untrusted Data Vulnerability |
| 2026-07-29 | CVE-2026-20316 | Cisco Secure Firewall Management Center (FMC) | Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability |
| 2026-07-14 | CVE-2026-15410 | SonicWall SMA1000 Appliances | SonicWall SMA1000 Appliances Code Injection Vulnerability |
| 2026-07-14 | CVE-2026-15409 | SonicWall SMA1000 Appliances | SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability |
| 2026-07-01 | CVE-2026-45659 | Microsoft SharePoint Server | Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability |
| 2026-06-25 | CVE-2026-12569 | PTC Windchill and FlexPLM | PTC Windchill and FlexPLM Improper Input Validation Vulnerability |
| 2026-06-12 | CVE-2026-35273 | Oracle PeopleSoft Enterprise PeopleTools | Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability |
Tactics and techniques
MITRE ATT&CK techniques reported for n0n by Ransomware.live, in attack order.
- Initial Access
- Execution
- Persistence
- Lateral Movement
- Collection
- Impact
- Defense Impairment
- Stealth
Track n0n in the weekly brief
One email a week: which groups are active in your sector, what they are exploiting, and what to patch. Drafted from the data on this site and read by a human before it goes out. No sales follow-up.
Data sources: CISA KEV, Ransomchats, RansomLook, Ransomware.live, security news outlets · updated 12 hours ago
Sector, country and ransom-demand figures are SecuritySnares estimates made with a language model. Leak-site listings are claims by threat actors and are not independently verified; leak-site victims are never named unless they have disclosed the incident themselves. News headlines are the publishers' own reporting, shown as written and linked to the original. Methodology