Ransomware Group intelligence
N0n
ActiveTrack N0n with 132 published victims and 1 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
N0n is tracked by Breach House as a ransomware group with 132 published victims.
United States is currently the most targeted country in this dataset.
1 known leak locations are currently associated with this group.
Leak Status Distribution
132
- Leaked 93 70.5%
- Pending 39 29.5%
- Deleted 0 0.0%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (1)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Onion service | Up checked 4h ago | nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion |
Top Activity Sectors (14)
Typical Attacks (8)
▼MITRE ATT&CK does not currently catalogue N0n, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v20.0. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: N0n executes malicious payloads through PowerShell scripts to stage ransomware components.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: N0n disables security tools by terminating antivirus processes and modifying Windows Defender settings.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1070.004 File Deletion Stealth
What they do: N0n deletes Volume Shadow Copies and backup directories via vssadmin commands to prevent recovery.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1083 File and Directory Discovery Discovery
What they do: N0n uses file and directory discovery via PowerShell to enumerate critical data paths before encryption.
What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: N0n moves laterally through SMB shares using stolen credentials to access additional networked systems.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1486 Data Encrypted for Impact Impact
What they do: N0n encrypts victim files using AES-256 encryption with custom ransomware binaries targeting business documents.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1490 Inhibit System Recovery Impact
What they do: N0n inhibits system recovery by corrupting restore points and disabling backup service processes.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
-
T1491.001 Internal Defacement Impact
What they do: N0n performs internal defacement by replacing victim web content with ransom notices on accessible servers.
What that means: An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems.
Victims (132)
Search, filter and paginate the victim timeline for N0n. Showing 101–132 of 132.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | Company #20 id33712 View details | — | — | pending | ||
|
cannabis operator · Michigan, USA | [PENDING EXPOSURE: data publishes 2026-10-13 09:40 UTC] |
||||||
| Ransomware | Company #19 id33713 View details | — | — | pending | ||
|
confectionery & telehealth · New York, USA | [PENDING EXPOSURE: data publishes 2026-10-13 09:40 UTC] |
||||||
| Ransomware | Company #14 id33714 View details | Canada | — | pending | ||
|
Financial services · Canada | [HONORED: settled 2026-10-07 17:00 UTC · before their deadline] |
||||||
| Ransomware | Company #29 id33703 View details | United States | — | pending | ||
|
smart building & surveillance integration · California, USA | [PENDING EXPOSURE: data publishes 2026-10-14 18:00 UTC] |
||||||
| Ransomware | Company #28 id33704 View details | United States | — | pending | ||
|
architecture & design · Florida, USA | [PENDING EXPOSURE: data publishes 2026-10-14 12:00 UTC] |
||||||
| Ransomware | Company #27 id33705 View details | Australia | — | pending | ||
|
neurology practice · New South Wales, Australia | [PENDING EXPOSURE: data publishes 2026-10-13 12:37 UTC] |
||||||
| Ransomware | Company #26 id33706 View details | United States | — | pending | ||
|
cannabis operator · Michigan, USA | [PENDING EXPOSURE: data publishes 2026-10-13 09:40 UTC] |
||||||
| Ransomware | Company #25 id33707 View details | United States | — | pending | ||
|
confectionery & telehealth · New York, USA | [PENDING EXPOSURE: data publishes 2026-10-13 09:40 UTC] |
||||||
| Ransomware | Company #5 id33700 View details | United States | — | pending | ||
|
smart building & surveillance integration · California, USA | [PENDING EXPOSURE: data publishes 2026-10-14 18:00 UTC] |
||||||
| Ransomware | Company #4 id33699 View details | United States | — | pending | ||
|
architecture & design · Florida, USA | [PENDING EXPOSURE: data publishes 2026-10-14 12:00 UTC] |
||||||
| Ransomware | Chibitek id33529 View details | United States | — | leaked | ||
|
managed IT services (MSP) · USA | Complete client financial records held by this managed IT provider (accounting, inventory, payroll data); Client network credentials and configuration secrets; Internal company documents | [NOT PAID — EXPOSED: leak 2026-10-11 04:43 UTC] |
||||||
| Ransomware | Company #3 id33462 View details | United States | — | pending | ||
|
IT managed services · United States | [PENDING EXPOSURE: data publishes 2026-10-07 00:46 UTC] |
||||||
| Ransomware | Company #2 id33463 View details | Canada | — | pending | ||
|
Financial services · Canada | [PENDING EXPOSURE: data publishes 2026-10-06 15:00 UTC] |
||||||
| Ransomware | Company #1 id33464 View details | United States | — | pending | ||
|
data publishes 2026-10-06 12:00 UTC |
||||||
| Ransomware | Houston Thyroid & Endocrine Specialists id33358 View details | United States | Healthcare / Pharma | leaked | ||
|
Healthcare - Endocrinology (US) · Houston, Texas | 14,441 patient document scans from a Houston endocrinology practice: lab results, medical summaries, diagnoses, insurance records, day sheets; Protected health information of thousands of patients including SSNs, dates of birth, and clinical data; Billing and claims records with financial data | [ACTIVE: deadline 2026-10-04 12:00 UTC] |
||||||
| Ransomware | MCAP — MortgageHub commercial lending platform id33332 View details | Canada | Finance / Legal / Insurance | pending | ||
|
Mortgage securitization and servicing (Canada) · Canada | The complete MortgageHub borrower database of a major Canadian mortgage company: seven years of records with social insurance numbers, dates of birth, full addresses, and complete loan and payment histories; The daily commercial servicing book: the full national portfolio of active commercial mortgages with balances, interest rates, credit scores, insurer policy numbers, arrears, and investor reporting fields; The full backup archive of the platform, 2019 through today | [ACTIVE: deadline 2026-10-03 15:00 UTC] |
||||||
| Ransomware | Precision Facades Ltd id33265 View details | United Kingdom | Construction / Real Estate | leaked | ||
|
Facade engineering and construction (UK) · United Kingdom | The complete company file server of a UK facade engineering contractor: finance and accounts records, audits, bank mandates, board papers, budgets and business plans; Project and tender data: current tender workload, tender tracker and sales forecasts; Confidential commercial records: SHEQT confidential folder and the costing database; Director-level sale and management documents | [ACTIVE: deadline 2026-10-02 05:32 UTC] |
||||||
| Ransomware | Dediserve Ltd id33226 View details | United Kingdom | IT | leaked | ||
|
Cloud infrastructure provider (iomart group) · Dublin, Ireland / FRA1 Frankfurt DC | The complete customer register of the FRA1 cloud — 167 tenant accounts with infrastructure details; Disk images of tenant servers: a regulated forex broker's portal (payment gateway configuration, trading-account records), a payment services provider's systems including its internal password vault, and a production real-estate platform; The provider's internal operations mailbox and monitoring configuration | All 46 FRA1 servers are paused and intact - restorable automatically within the hour of settlement. | [ACTIVE: deadline 2026-10-01 05:16 UTC] |
||||||
| Ransomware | TapClicks (marketing analytics platform) id33160 View details | United States | IT | pending | ||
|
Marketing analytics / SaaS · United States | The complete platform source code (97,000+ commits with full history); The multi-tenant instance management system with production architecture; A customer's full marketing database: 354 advertising platform datasets, client lists, user accounts with password hashes, ad-platform connection credentials | Everything is real, complete and verifiable. | [ACTIVE: deadline 2026-09-28 01:59 UTC] |
||||||
| Ransomware | AFRICA-TECH (IT services / document processing) id33069 View details | Mali | IT | leaked | ||
|
IT services / document services · Mali | Client documents: scans, attestations, insurance and embassy files, shared business folders | Operations are fully stopped. Nothing restores without settlement — all backups and shadow copies are encrypted or destroyed. | [ACTIVE: deadline 2026-09-25 16:00 UTC] |
||||||
| Ransomware | FinSoft (Kolibri retail back-office software) id33047 View details | Uzbekistan | IT | leaked | ||
|
Retail software vendor / IT services · Uzbekistan | Client databases of 10+ retail chains (keddo, marc, lancaster, comf_rus, ek, cr, bas_at, bas_juk, bas_nov, bas_zar): sales, stock, pricing, financial records; Back-office platform and API service data | One client database publishes per day after the deadline, starting with keddo. Their clients will know exactly whose software failed them. | [ACTIVE: deadline 2026-09-25 01:06 UTC] |
||||||
| Ransomware | Fanatics (global sports commerce platform) id33003 View details | United States | Retail / E-commerce | leaked | ||
|
Sports commerce / e-commerce · United States | Complete order history: 46,902 order files (108 GB) with customer personal data; Accounts-payable invoices of league and brand partners; Customer balances, bank transaction archive, customer tax exemption certificates; The fraud-prevention data set | Their cloud data estate is under our destructive control; deletion has begun. | [ACTIVE: deadline 2026-09-23 01:01 UTC] |
||||||
| Ransomware | Inter (Venezuela's largest internet provider) id32981 View details | Venezuela, Bolivarian Republic of | Telecommunications | leaked | ||
|
Telecommunications / ISP · Venezuela | Subscriber connection records: 15,300,000+ entries, tens of thousands of subscriber addresses with the services they contacted; Complete internal network map across all regional operations; Core infrastructure configuration evidence | Network traffic remains severed until settlement. | [ACTIVE: deadline 2026-09-20 18:39 UTC] |
||||||
| Ransomware | PayPal support operations (Transcom WorldWide) id32971 View details | Sweden | Telecommunications | leaked | ||
|
Outsourced customer support / financial services · Netherlands / Tunisia | 86.7M connection records: daily support-agent sessions into PayPal corporate Citrix/AAA systems; Complete infrastructure map: internal AD, PKI, Netskope/Zscaler tenants, all 8 sites | All 8 sites are enforcing a network blackout until settlement. | [ACTIVE: deadline 2026-09-21 03:01 UTC] |
||||||
| Ransomware | Ministry of Education — Argentina id32972 View details | Argentina | Public Sector | leaked | ||
|
Government / education · Argentina | Complete network-security configuration of the ministry network; 1.08M connection records: national library (BNM), school-book selection platform, scholarship systems (becasprogresar), titulosvalidez, certificadosinfd, sitrared; Evidence of the Monero cryptocurrency miner operating inside the ministry network | The ministry network is under a total blackout until settlement. | [ACTIVE: deadline 2026-09-21 03:01 UTC] |
||||||
| Ransomware | Argentem Creek Partners (investment firm) id32973 View details | United States | Services | leaked | ||
|
Investment management / private credit · United States | Full corporate network evidence: 2.5M+ connection records, complete internal systems map (Active Directory, SharePoint, MSP tooling, office-security integrations); Tax-season document flows of the firm and its investor document delivery platform | Corporate connectivity remains severed until settlement. | [ACTIVE: deadline 2026-09-21 03:01 UTC] |
||||||
| Ransomware | AstraZeneca Türkiye id32974 View details | Türkiye | Healthcare / Pharma | leaked | ||
|
Pharmaceutical manufacturing (GxP) · Türkiye | Complete internal network-security configuration of all 3 sites (940 MB): every rule, device definition, remote-access mappings; 1.35M connection records: M365/Intune, SAP Concur, UniFi camera estate, internal applications | All sites are enforcing a total network blackout until settlement. | [ACTIVE: deadline 2026-09-21 03:01 UTC] |
||||||
| Ransomware | STOKR (digital securities platform) id32975 View details | Luxembourg | IT | leaked | ||
|
Digital securities / investment platform · Luxembourg - EU | KYC investor register: full names, emails, countries, nationalities, wallet addresses and tax IDs where present; Identity-to-crypto-wallet mapping of KYC-accepted investors (FR, DE, CH, BE, NL, UK and others); Internal platform admin directory with staff accounts and roles | The investor data will also be delivered to the tax authorities of the investors' countries. | [ACTIVE: deadline 2026-09-20 22:40 UTC] |
||||||
| Ransomware | Konnatus (usucapião legal services) id32976 View details | Brazil | Finance / Legal / Insurance | leaked | ||
|
Legal services / real estate · Brazil | The application database: chart of accounts, income/outflow structures, account types; User accounts with password hashes | Publication proceeds after the deadline. | [ACTIVE: deadline 2026-09-20 03:32 UTC] |
||||||
| Ransomware | BeLi Teacher / FSC education centers (AWS) id32977 View details | Viet Nam | Services | leaked | ||
|
Education / edtech · Vietnam | The complete CRM lead database: 152,044 contact records — names, emails, +84 phone numbers, cities, study interests, engagement history; The CRM file archive (tasks, forums, comments, customer files) migrated from GetFly CRM | Publication proceeds in batches after the deadline. | [ACTIVE: deadline 2026-09-20 02:47 UTC] |
||||||
| Ransomware | Vietnamese betting operator (GC789 network / Boundless TE) id32978 View details | Viet Nam | Finance / Legal / Insurance | leaked | ||
|
Online gambling / agent platform · Vietnam / Switzerland | The complete bettor database: 2,021,011 registered bettors with names, +84 phone numbers, email addresses, deposit and withdrawal amounts; The full agent network: 39,998 agent accounts, hierarchy, balances, credit lines and commission ladders; 85 million login records with IP addresses and device identifiers; Daily trading and P&L data per provider; The fraud stack: 33,000+ blacklisted emails and phones, arbitrage and odds-mover reports, multi-account detection rules | Publication proceeds in batches after the deadline. | [ACTIVE: deadline 2026-09-20 01:37 UTC] |
||||||
| Ransomware | United Federation of Teachers id32979 View details | United States | NGOs / Associations | leaked | ||
|
Education / Labor Union · US — New York | The union’s complete legal case archive — approx. 181,420 documents: grievance and arbitration files, disciplinary appeal decisions and personnel case files, each named for a member; Contract documents: CBAs, MOUs, MOAs and side letters; Nurse-federation and health-benefit-fund case materials; Teacher evaluation and class-size complaint files; Staff search and case-view audit logs | Publication proceeds in batches after the deadline. The victim can verify everything and settle in their private negotiation room. | [ACTIVE: deadline 2026-09-19 14:58 UTC] |
||||||