Ransomware

A ransomware group that did not exist two weeks ago has already listed more than a dozen victims. It is called n0n, and it has added a new threat to the usual pitch: pay, or it will encrypt or destroy your backups too, so you cannot recover on your own.

Researchers at CyberXTron first saw n0n on September 18 and published their analysis on September 23. By September 22 its leak site on Tor listed more than a dozen victims. Some countdown timers have already run out and the stolen data has been published, so some victims chose not to pay.

How the attacks run

The method itself is standard for ransomware. The difference is how openly n0n goes after recovery.

1. Stolen logins. Initial access comes from credentials harvested by infostealer malware.
2. Remote access. The attackers use those credentials to get into the corporate network.
3. Admin rights. They escalate until they hold administrative tools inside the network.
4. Data theft. Files are staged and taken, so there is something to leak.
5. Extortion. The ransom note threatens to encrypt or destroy backups and shadow copies, and a countdown starts on the leak site.

Financial services firms, mostly in the United States, are the main targets so far. Victims also include technology, retail, education, healthcare, defense and professional services companies.

Why the backup threat works

Most backup systems are built to survive a failed disk or a deleted file, not an intruder with domain admin rights. If the backup console signs in with the same directory, if backup storage is mounted as a share on production servers, or if anyone with admin rights can shorten retention, then an attacker who reaches step 3 can reach the backups too.

It is also getting faster. Anthropic's September threat report describes one intrusion that went from a single stolen developer token to full administrative control of a cloud environment in about three hours. The time between an attacker getting in and the backups being at risk can be shorter than a working day.

Backups that hold

A useful check: if someone holding your domain admin password can log in to the backup system, an attacker who steals that password can delete your backups.

• Give the backup system its own identity. Separate accounts, not joined to the main domain, with their own phishing-resistant MFA.
• Make copies immutable. Use object lock or immutable storage so copies cannot be deleted or changed before they expire, even by an admin.
• Keep one copy out of reach. Offline, or in a separate cloud account that production admins cannot sign in to.
• Alert on the warning signs. Backup deletion, retention changes and mass removal of snapshots or shadow copies should wake someone up.
• Practise restoring. Run a real restore on a schedule and time it, so you know how long recovery takes before you need it.

Close the way in, too

Good backups help you recover. Stopping the first three steps means you may not need to. For n0n that means watching for staff credentials in infostealer logs and resetting them, putting phishing-resistant MFA on every remote access path, and keeping admin accounts separate and watched.

Our security operations team watches for exactly those early steps, and our red team and code review work tests whether an attacker who gets in can reach your backups. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would run the work.

---

Sources: Infosecurity Magazine, SC Media, Anthropic threat intelligence report, September 2026.