A newly formed ransomware group has claimed that if its victims don’t give into their extortion demands and pay a ransom, that they will destroy their backup infrastructure, in a move which could prevent a targeted organization from operating entirely.
Named n0n, the emergence of the ransomware crew has been detailed by cybersecurity researchers at CyberXTron. In a blog post published on September 23, researchers said activity by n0n was first spotted on September 18 and by September 22 the group’s Tor-hosted leak site had published information about over a dozen victims.
The group operates on a double extortion model which has become highly popular and highly effective among ransomware threat groups.
Threats to Destroy Backups
According to the activity observed by CyberXTron, the n0n attackers take the extortion threats to another level. In addition to stealing sensitive corporate data, they also make explicit threats to encrypt or destroy backups and shadow copies of data.
This threat is designed to instil fear into the victim about not being able to recover their network at all unless they pay the ransom demand.
Of the confirmed n0n attacks, the most targeted sector is the financial services industry, which accounts for 23% of victims. That is followed by technology, retail and education, which represent 15% of victims each. Organizations in healthcare, defense and professional services have also been targeted.
So far, the most common target for n0n ransomware attacks has been the US, but the group has claimed victims all over the world, including in Vietnam, Uzbekistan, Brazil, Sweden and Luxembourg.
The countdown timers associated with some of the victims – a psychological tactic designed to scare the compromised target into paying the ransom – have already reached zero and data stolen in the attacks has been released. This suggests that in some cases, despite the potentially destructive nature of n0n attacks, victims are choosing not to give in and pay the ransom.
Initial Entry Via Stolen Passwords
According to analysis of incidents by researchers, the n0n ransomware attacks begin by exploiting compromised credentials sourced from third-party infostealer malware. These stolen credentials are used to gain initial access to corporate networks. Privileges are then escalated to gain hold of administrative tools within the environment in order to manipulate and stage data ahead of extortion demands.
CyberXTron warned that organizations “should treat n0n as an active and credible double-extortion threat requiring prompt attention to credential hygiene, access monitoring, and backup isolation.”
Reccommended actions for businesses to take to reduce the risk of attacks by n0n or other ransomware groups include:
- Enforce multi-factor authentication (MFA) across all external access points
- Restrict exposure of internet-facing services such as VPN, RDP, and remote access interfaces
- Implement strict least-privilege access controls across all systems
- Segment networks to isolate critical systems and sensitive data environments
- Monitor internal access behavior for signs of unauthorized lateral movement or privilege misuse
