A young extortion crew called N0n has put 38 organisations on its leak site in a single sweep. Nearly all of them belong to the global shipping system: container terminals, port community IT providers, shipping lines, ferry operators and freight agents in 18 countries and territories. South Korea leads the list with 12 names, at least three of them tied to Busan, the country's busiest port.
Every entry is a claim by the criminals, not a confirmed breach. The independent tracker ransomware.live, which recorded the posts on 12 October, labels N0n an emerging group whose claims should be treated with caution until independently verified. That caution applies here in full.
From scattered victims to one industry
When N0n surfaced in September, its victims had nothing obvious in common. As we reported in our look at its debut, its first ten listings ran from an Argentine ministry to a Venezuelan internet provider and a teachers' union. WatchGuard's tracker entry classifies the group as a data broker rather than a crypto-ransomware developer.
This batch is different. Our importer picked up all 38 listings in one scrape on the afternoon of 12 October, and 35 of them sit in transportation. The other three are a steelmaker and two firms close to the sector: ZPMC, the Chinese maker of port cranes and terminal machinery, and the shipbuilding and ship management business listed as Tsuneishi / Kambara Kisen. The sweep more than doubled the crew's tally, which ransomware.live now puts at 72.
The names include some of the largest operators in world trade. Among them are Ocean Network Express in Singapore, Santos Brasil and Portonave in Brazil, TTI Algeciras in Spain, Eurogate Tanger in Morocco, NEOM Ports in Saudi Arabia and Nam Dinh Vu Port in Vietnam. In Korea the crew named BNCT Busan New Container Terminal, Pusan Newport Company, the port community IT provider listed as GNCNet / DGT Busan, the tanker operator Dong-A Tanker and the steelmaker Dongkuk Steel.
The crew says it took the paperwork, not the cranes
The listings describe stolen data, not stopped ships. Most claim operational EDI archives: the standard electronic messages that lines, terminals and agents exchange about vessel schedules, container manifests, gate movements and bookings. The Nam Dinh Vu entry claims the terminal's full EDI message archive plus configuration files from its operations server. Others claim terminal operating system database material, invoicing and tariff records, dangerous-goods documentation, and in Ocean Network Express's case staff directories and voyage and fuel-consumption records.
Many posts are marked as unpaid with files due for publication, the usual pressure tactic. No listing that IntelFusions has reviewed claims that port operations were disrupted, and the crew's descriptions are its own, unverified by us.
Ask your terminal partners about EDI access now
Because EDI flows link many companies, a leak at one terminal can expose cargo and booking data belonging to every line that calls there. Shipping lines, forwarders and shippers that exchange messages with any named organisation should ask that partner directly whether it is investigating, review which accounts and interfaces can reach their EDI feeds, and watch for invoice or booking fraud that uses genuine shipment details as bait.
Named organisations should treat the listing as a lead, preserve logs for the period in question and verify before commenting publicly. We first flagged extortion crews circling the sector in September's port and fuel terminal claims. IntelFusions tracks the group as N0n, and Korea's wider exposure sits on our South Korea profile.
A month ago N0n looked like an opportunist selling access records. One sweep later, it has pitched itself as a crew with a view into the paperwork of global trade. Whether the files back that up is the question the publication deadlines will now answer.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.