Researchers at CyberXTron identified a new ransomware operation that adds explicit threats to encrypt or destroy backups and shadow copies, targeting mainly US firms and using stolen credentials for initial access.
n0n operates a double-extortion model that includes explicit threats to encrypt or destroy backups and shadow copies, raising recovery risk for victims.
Financial services are the most targeted sector (23%), with technology, retail and education each representing 15% of observed victims.
Defensive priorities: enforce MFA, reduce exposure of internet-facing services, apply least-privilege and network segmentation, isolate backups and monitor internal access.
# What happened Researchers at CyberXTron reported a newly observed ransomware crew calling itself n0n. The group was first spotted on September 18, 2026. By September 22 its Tor-hosted leak site showed information on more than a dozen victims. CyberXTron published a blog about the activity on September 23.
n0n uses a double-extortion approach: attackers steal sensitive corporate data and threaten publication unless a ransom is paid. The group takes that model further by explicitly threatening to encrypt or destroy backups and shadow copies, aiming to remove the victim's ability to recover without paying.
# How n0n gains access and operates Attackers appear to start with compromised credentials harvested by third-party infostealer malware. Those credentials provide initial access to corporate networks. From there the intruders escalate privileges and take control of administrative tools to move laterally, stage data exfiltration and prepare the environment for extortion.
The group also applies psychological pressure with countdown timers on leak pages. Some timers reached zero and the attackers released stolen data, demonstrating they will publish data if demands are not met.
# Who's being targeted
# Why the backup threat matters Threatening to encrypt or destroy backups and shadow copies changes the victim calculus. Even well-prepared organizations that maintain backups face the risk that those recovery points will be damaged or rendered unusable. That threat increases operational disruption and can force organizations to consider paying to regain access to both primary systems and backups.
# Concrete defensive steps CyberXTron recommends immediate attention to credential hygiene, access monitoring and backup isolation. Specific actions include:
# What this signals for defenders n0n's approach combines credential-based access with deliberate preparation to neutralize recovery options. That sequence—credential theft, privilege escalation, admin-tool misuse, data staging, backup tampering threats—creates a compound risk beyond simple file encryption. Organizations should prioritize hardening of identity and access controls, restrict management interfaces, and treat backup isolation as a high-priority control.
# Short takeaway Treat n0n as an active double-extortion threat that explicitly targets recovery capability. Focus on credential protection, reduced external exposure, least privilege, segmentation and physical and logical isolation of backups to reduce the chance of catastrophic recovery loss.
The Cofense Phishing Defense Center (PDC) team has recently investigated a newly emerged Ransomware-as-a-Service (RaaS) operation organized by the Global Group, a financially motivated cybercriminal group running a Ransomware-as-a-Service (RaaS) platform. Targeting high-value, large-scale enterprises across different i
Settra ransomware is emerging as a serious threat to Windows networks after investigators linked it to two recent intrusions involving remote-management software and recovery-blocking actions. The operation encrypts files, leaves victims with ransom notes, and tries to make both investigation and restoration more diffi
A newly observed ransomware operation dubbed SETTRA is abusing the legitimate MeshAgent remote monitoring and management platform for persistence while using recovery-inhibition and defense-evasion techniques to maximize the impact of Windows encryption attacks. Huntress investigated two SETTRA incidents in July and Se
A newly identified ransomware operation tracked as Galago has emerged with apparent operational links to the Panzer ransomware group, raising concerns of an expanding double-extortion ecosystem targeting organizations worldwide. Researchers began directly monitoring Galago’s dark leak site (DLS) on 15 September 2026. A
Panzer ransomware has emerged as a new Ransomware-as-a-Service (RaaS) operation, publishing 16 alleged victims across 11 countries while combining data theft with file encryption. Documented by CyberXtron, its dedicated leak site was first observed active on August 5, 2026, and its early victim list includes organizati
Microsoft has linked a ransomware affiliate to attacks that ended with four different ransomware families. The group, tracked as Storm-2570, repeatedly used the same methods to take control of networks, steal data and prepare systems for encryption. The changing ransomware name often concealed a familiar operator. Stor
Loading more related stories...
Open the app view to save this story, compare related coverage, and continue from the same source.