Close Menu
  • Home
  • News
  • Security
  • Privacy
  • Cybercrime
    • Threat Groups
    • Ransomware
    • Explainers
    • Stealer Logs
  • AI
  • OSINT
  • Tools
    • Ransomtracker
    • Stealercheck
    • FortiBleed Checker
    • Site Check
  • Data
    • Ransomware statistics
    • Ransom payment rate
    • Breach verification
  • Newsletter
  • About Us
Facebook X (Twitter) Instagram Threads
Ransomnews
  • Home
  • News
  • Security
  • Privacy
  • Cybercrime
    • Threat Groups
    • Ransomware
    • Explainers
    • Stealer Logs
  • AI
  • OSINT
  • Tools
    • Ransomtracker
    • Stealercheck
    • FortiBleed Checker
    • Site Check
  • Data
    • Ransomware statistics
    • Ransom payment rate
    • Breach verification
  • Newsletter
  • About Us
Facebook X (Twitter) LinkedIn
Ransomnews

N0N · Threat actor profile

THREAT ACTOR

N0N_

Active

N0N is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.

For Ransomnews editorial coverage of N0N, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.

21 Victims tracked
1 / 1 Active mirrors
2026-09-18 First listing
2026-10-07 Most recent

Victims by year

  • 2026 21

Leak site mirrors

1 mirror tracked, 1 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.

  • nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion n0n snapshot · 2026-10-08 06:16

Recent victims

The 50 most recent victims claimed by N0N. Total in the index: 21.

Date listed Victim Description
2026-10-07 Chibitek managed IT services (MSP) · USA
2026-10-05 Company #3 IT managed services · United States
2026-10-05 Company #2 Financial services · Canada
2026-10-05 Company #1 technology · United States
2026-10-01 Houston Thyroid & Endocrine Specialists Healthcare - Endocrinology (US) · Houston, Texas
2026-09-30 MCAP — MortgageHub commercial lending platform Mortgage securitization and servicing (Canada) · Canada
2026-09-29 Precision Facades Ltd Facade engineering and construction (UK) · United Kingdom
2026-09-28 Dediserve Ltd Cloud infrastructure provider (iomart group) · Dublin, Ireland / FRA1 …
2026-09-26 Inter (Venezuela's largest internet provider) Telecommunications / ISP · Venezuela
2026-09-26 Fanatics (global sports commerce platform) Sports commerce / e-commerce · United States
2026-09-26 FinSoft (Kolibri retail back-office software) Retail software vendor / IT services · Uzbekistan
2026-09-26 AFRICA-TECH (IT services / document processing) IT services / document services · Mali
2026-09-18 United Federation of Teachers Education / Labor Union · US — New York What will be published if no …
2026-09-18 Vietnamese betting operator (GC789 network / Boundless TE) Online gambling / agent platform · Vietnam / Switzerland What will be…
2026-09-18 BeLi Teacher / FSC education centers (AWS) Education / edtech · Vietnam What will be published if no settlement …
2026-09-18 Konnatus (usucapião legal services) Legal services / real estate · Brazil What will be published if no se…
2026-09-18 STOKR (digital securities platform) Digital securities / investment platform · Luxembourg - EU What will …
2026-09-18 AstraZeneca Türkiye Pharmaceutical manufacturing (GxP) · Türkiye What will be published i…
2026-09-18 Argentem Creek Partners (investment firm) Investment management / private credit · United States What will be p…
2026-09-18 Ministry of Education — Argentina Government / education · Argentina What will be published if no settl…
2026-09-18 PayPal support operations (Transcom WorldWide) Outsourced customer support / financial services · Netherlands / Tunis…

← Back to Ransomtracker

Statistics on this page are computed by Ransomnews from a live leak-site monitoring feed. Numbers update every ten minutes. Operator-written victim descriptions are truncated and shown in snippet form only. Source data: RansomLook (CC BY 4.0), aggregated and adapted by Ransomnews.

The Ransomnews Monthly

What leaked, what held up

One email a month: the datasets we verified, and the ones that fell apart under scrutiny.

Double opt-in. We store your email, signup time, and IP for consent records (GDPR Art. 7). See our privacy policy.

Free tool

How does your own site score?

Forty passive checks on TLS, security headers, email spoofing and privacy. A grade out of 100 in about fifteen seconds.

No signup. Nothing installed. We only request what your site already serves publicly.

Free tool

Were you in a leak?

Check whether an email address has surfaced in infostealer logs. No signup, no data stored.

Run StealerCheck

Live data

Ransomtracker

Victims as they are posted to ransomware leak sites, tracked continuously and checked against the claims.

Open the tracker

9,711 confirmed attacks tracked

Facebook X (Twitter) LinkedIn
© 2026 Ransomnews.com

Type above and press Enter to search. Press Esc to cancel.

Cookies on Ransomnews

We use strictly-necessary cookies to run the site and may use first-party analytics to understand which articles are read. Some pages contain affiliate links; when you click one, the affiliate network sets cookies on the merchant's domain to attribute the referral. See the Cookie Policy and Affiliate Disclosure for detail.

RANSOMNEWS.COM

Tracking the criminal infrastructure of the internet.

Independent coverage of ransomware, breach economics, threat actors, privacy, AI security, and the open-source investigation toolkit.

Topics

  • News
  • Security
  • Privacy
  • Cybercrime
  • AI
  • OSINT
  • Threat Groups
  • Stealer Logs
  • Ransomtracker
  • Stealercheck
  • FortiBleed Checker
  • Site Check

Site

  • About Us
  • Editorial Team
  • Contact
  • Tip Line
  • Editorial

Legal

  • Privacy Policy
  • Terms of Service
  • Cookie Policy
  • Funding & Independence
  • RSS Feed
© 2026 Ransomnews.com · Tracking the criminal infrastructure of the internet.