N0n — Ransomware Profile
N0n is a data extortion operation that WatchGuard first recorded in September 2026 and classifies as a data broker rather than a crypto-ransomware developer. The group runs a Tor-hosted leak site and uses both direct extortion and double extortion against the organisations it names. At the time of WatchGuard's tracker entry it had documented ten claimed victims across eight countries, with the earliest extortion dates falling in mid September 2026.IntelFusions coverage (1)
- New extortion crew opens with a ministry and an ISP 2026-09-19 · Ransomware
Recent claimed victims
- Company #1 2026-10-05
- Company #2 2026-10-05
- Company #3 2026-10-05
- Houston Thyroid & Endocrine Specialists 2026-09-30
- MCAP — MortgageHub commercial lending platform 2026-09-30
- Precision Facades Ltd 2026-09-29
- Dediserve Ltd 2026-09-28
- TapClicks (marketing analytics platform) 2026-09-25
- AFRICA-TECH (IT services / document processing) 2026-09-22
- FinSoft (Kolibri retail back-office software) 2026-09-22
- Fanatics (global sports commerce platform) 2026-09-20
- PayPal support operations (Transcom WorldWide) 2026-09-18
- Inter (Venezuela's largest internet provider) 2026-09-18
- United Federation of Teachers 2026-09-18
- Vietnamese betting operator (GC789 network / Boundless TE) 2026-09-18
- BeLi Teacher / FSC education centers (AWS) 2026-09-18
- Konnatus (usucapião legal services) 2026-09-18
- STOKR (digital securities platform) 2026-09-18
- AstraZeneca Türkiye 2026-09-18
- Argentem Creek Partners (investment firm) 2026-09-18
- Ministry of Education — Argentina 2026-09-18
Vendor research
- n0n Ransomware (Ransomware Tracker) WatchGuard Technologies