The extortion crew N0n has found a way to pressure a victim before naming it. Since October 5, 2026, the group has posted 64 listings on its leak site under placeholder names such as "Company #95", each with little more than a sector and a location: "solar energy company, Switzerland", "plumbing and kitchen products distribution, Cincinnati, Ohio". About three days later, in case after case, the real name appears with the label "NOT PAID" and a list of the files the crew says it took.
That gives a targeted organization a short, private deadline, and gives defenders a rare early signal. Every listing here is a claim by the criminals, not a confirmed breach. The independent tracker ransomware.live, from which IntelFusions imports its incident data, labels N0n an emerging group whose claims should be treated with caution until independently verified.
Seven teasers, seven names, almost always three days
IntelFusions compared every anonymous N0n teaser in its data against the crew's later named listings. Seven teasers carry a descriptor identical to a named post that followed, and six of the seven were named exactly three days later:
- "Semiconductor manufacturing, California" (October 15) became SMIC US Company of Sunnyvale, described in the listing as the US arm of Semiconductor Manufacturing International Corporation (October 18).
- "IT services, USA" (October 17) became 51Ridge, a Newark, New Jersey hosting and IT provider (October 20).
- "IT services, South Korea" (October 18) became Hanjin Information Systems and Telecommunication (October 21).
- "Healthcare support services, United States" (October 19) became Heritage Senior Living two days later.
- "Solar energy company, Switzerland" (October 20) became SunTechnics Fabrisolar AG (October 23).
- "Network and IT services, New York" (October 21) became Adirondack Networks (October 24).
- "Plumbing and kitchen products distribution, Cincinnati" (October 22) became Keidel Supply Company (October 25).
Others fit the same rhythm on country and timing but are too thinly described to match with certainty, among them an Ethiopian teaser on October 20 and the Horn of Africa Regional Environment Centre and Network's naming on October 23. Dates are as recorded by the tracker, so a day of drift is possible.
The crew says it took network maps, not just files
For SMIC US, N0n lists business records, payroll related records and financial documents. For Hanjin it claims a directory of 999 staff accounts and a map of which personnel are seconded to which clients. For the Ethiopian environmental network it claims the full SAP Business One production database.
Several reveals advertise something more dangerous than embarrassment. The 51Ridge, Heritage Senior Living and Performance Ford listings claim network security configurations, internal segmentation maps, site-to-site VPN definitions or remote access account structures, data that is useful to the next intruder, whoever it is. WatchGuard's tracker entry classifies N0n as a data broker rather than a crypto-ransomware developer, which fits a crew that leaks what it steals rather than encrypting it.
The teasers also distort the numbers. In IntelFusions' data a teaser and its reveal are separate entries, so a raw count of N0n's listings, 164 since it surfaced in September, overstates how many distinct organizations it has hit.
Recognise the teaser, use the three days
US IT and managed service providers recur in the teasers, but the descriptors span healthcare, energy, law and manufacturing on four continents. An organization that matches one should treat it as an incident lead:
- Check new N0n teasers against your own sector and location, and call your incident response provider at once if one fits.
- Preserve firewall, VPN and identity logs before they roll over, and hunt for bulk outbound transfers in the preceding weeks.
- If network or VPN configurations may be exposed, rotate VPN keys, certificates and remote access credentials, and review firewall rules as if an attacker had read them.
- Prepare notifications in parallel and report to your national CERT or law enforcement.
We have followed N0n from its scattered debut to its sweep of port and shipping firms, and its listing history is on our N0n profile. The teaser is the newest part of its playbook and the most useful one for defenders: a crew that announces a victim three days early is also telling that victim exactly how long it has.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.