Operator dossier

N0n is a ransomware operator currently active on public leak sites. Darkfield has indexed 103 public victims claimed by this operator between September 18, 2026 and October 13, 2026. N0n is a ransomware group first observed in September 2026 with an apparent financial motivation, having claimed at least 9 victims across a geographically diverse target set spanning Vietnam, the United States, Luxembourg, Brazil, and Argentina. Given the recency of their emergence and the limited volume of publicly documented activity, no verified attribution regarding country of origin, affiliation with known threat actors, or operational infrastructure has been established by CISA, the FBI, Mandiant, or other reputable security research organizations at this time. Their targeting pattern suggests an opportunistic rather than narrowly focused operational approach, with victims identified across the financial services, education, healthcare, government and defense, and general industry sectors, indicating a broad victim selection methodology rather than sector-specific specialization. No specific initial access vectors, malware tooling, encryption methods, or extortion tactics have been publicly attributed to this group in open-source intelligence reporting, and no major high-profile campaigns, record ransom demands, or law enforcement actions have been publicly documented against them. As of the time of this profile, N0n remains a nascent and poorly understood threat actor warranting continued monitoring given their cross-continental targeting scope and presence in sensitive sectors, though the low victim count and absence of corroborating technical reporting limit definitive characterization of their capabilities or long-term operational intent.

Recent disclosures by N0n

Most recent 98 of 103 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for N0n →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status changes from active to dormant when no new disclosure appears for 60 days. Without a disclosure date, activity is unknown. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

N0n

103 victims indexed · first seen 25 days ago · last activity 1 hour ago

103

Victims indexed

#81 of 410 tracked operators

Active period

Sep 2026 → Oct 2026

—

Countries hit

At a glance

Status: active
First seen: 25 days ago
Last activity: 1 hour ago
Onion sites: 1 known endpoint

About

N0n is a ransomware group first observed in September 2026 with an apparent financial motivation, having claimed at least 9 victims across a geographically diverse target set spanning Vietnam, the United States, Luxembourg, Brazil, and Argentina. Given the recency of their emergence and the limited volume of publicly documented activity, no verified attribution regarding country of origin, affiliation with known threat actors, or operational infrastructure has been established by CISA, the FBI, Mandiant, or other reputable security research organizations at this time. Their targeting pattern suggests an opportunistic rather than narrowly focused operational approach, with victims identified across the financial services, education, healthcare, government and defense, and general industry sectors, indicating a broad victim selection methodology rather than sector-specific specialization. No specific initial access vectors, malware tooling, encryption methods, or extortion tactics have been publicly attributed to this group in open-source intelligence reporting, and no major high-profile campaigns, record ransom demands, or law enforcement actions have been publicly documented against them. As of the time of this profile, N0n remains a nascent and poorly understood threat actor warranting continued monitoring given their cross-continental targeting scope and presence in sensitive sectors, though the low victim count and absence of corroborating technical reporting limit definitive characterization of their capabilities or long-term operational intent.

References

1 link

External sources curated by the MISP threat-intel community.

ransomlook.io/group/n0n

Recent victims

Loading recent victims

Onion infrastructure

1 known

http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion

Source

Updated 1 hour ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time N0n posts a victim.

Add N0n to your watchlist — Pro pings you within 5 minutes of any new N0n leak-site post, Telegram callout, or affiliate-rebrand inference.