Threat Intelligence Report Sep 15 - Sep 21 2026

Worldwide Ransomware Victims

Worldwide ransomware victim distribution shows that the United States was the most affected country, with 69 victims, accounting for 34.16% of the total ransomware activity. This indicates that the United States remained the primary target region during this period, representing more than one-third of all reported ransomware incidents.

Canada recorded the second-highest number of victims, with 9 cases, contributing 4.46% of the total. Argentina followed with 7 victims, representing 3.47%, while France, Germany, and the United Kingdom each recorded 6 victims, accounting for 2.97% individually.

Other countries with notable ransomware impact included India, with 5 victims, contributing 2.48%, along with Italy, Brazil, Japan, and Australia, each reporting 5 victims and representing 2.48% individually.

Moderate ransomware activity was observed in Mexico, Türkiye, Spain, and Peru, each recording 4 victims, accounting for 1.98% individually. United Arab Emirates, Finland, Bulgaria, Singapore, Viet Nam, Switzerland, Sweden, and Bulgaria each reported 3 victims, contributing 1.49% individually.

Several countries recorded lower but notable activity, including Croatia, Colombia, Taiwan, Russian Federation, South Korea, Czechia, and Chile, each with 2 victims, representing 0.99% individually.

The remaining countries recorded 1 victim each, accounting for 0.50% individually. These included Malaysia, Georgia, South Africa, Morocco, Haiti, Saudi Arabia, Kenya, Portugal, Israel, Romania, New Zealand, Costa Rica, Norway, Ukraine, Iran, Thailand, Indonesia, Netherlands, Philippines, Namibia, Luxembourg, Trinidad and Tobago, and Ireland.

Overall, the data shows that ransomware activity was concentrated primarily in the United States, which accounted for a significant share of global victims. However, the distribution of victims across North America, Europe, Asia-Pacific, the Middle East, Africa, and South America demonstrate the continued global reach of ransomware operations and the persistent targeting of organisations across multiple regions.

Ransomware Group in Focus

N0n Ransomware

Executive Summary 

The verified public record for N0n now includes a threat-tracking identity, publication activity on 18 September 2026, one Tor onion service, and two downloadable data archives released after their deadlines expired. RansomLook recorded nine N0n posts first observed between 16:01 and 16:07 UTC. WatchGuard lists N0n as active, first seen in September 2026, with the type Data Broker. Examination of the two released archives confirmed organisation-specific CRM and database content. [1][2][3]

No independently verified malware sample, malware hash, ransom note, encrypted-file extension, decryptor, wallet, negotiation identity, command-and-control host, clearnet domain, IP address, organisation incident statement, regulator notice, law-enforcement confirmation, or incident-response report was identified by the research cutoff. The released data supports a verified data-exposure finding, but it does not establish ransomware execution, encryption, service disruption, initial access, persistence, lateral movement, collection method, or exfiltration method. [4][7]

The sole retained N0n-specific infrastructure observable is the Tor service listed independently by RansomLook and in reporting that reproduces a ThreatMon alert. Its 56-character service identifier decodes as a version 3 onion address and passes the checksum procedure defined in the Tor specification. This validates the address format; it does not prove a malware infection or a successful compromise. [1][4][5]

Published Data Evidence

The evidence below was examined locally and summarised without reproducing personal records or credential values. The portal capture showed both entries under the leaked category with expired deadlines and download and torrent controls.

Assessment. N0n's public distribution of the two archives is verified, and the contents provide strong evidence of data exposure associated with the two anonymised organisations. The files do not independently prove that N0n performed the original intrusion, deployed ransomware, encrypted systems, or obtained the data directly from the named environments. No public acknowledgement by either organisation was located by the research cutoff.

Vietnamese Education Organisation

Brazilian legal-services platform

Verified Infrastructure Observable

No additional N0n infrastructure IOC or malware IOC met the verification standard. In particular, no malware hash, ransom-note name, encrypted extension, wallet, email address, qTox identity, clearnet domain, IP address, TLS certificate, or confirmed negotiation endpoint is included. The released-archive hashes are retained separately as evidence identifiers, not as indicators of endpoint infection. [7][8][9][10][8][9][10]

Excluded Claims and Techniques

The following material remains excluded because no independent primary evidence was located:

• Organisation names and claimed victim counts. This report uses anonymised organisation details only.
• Operator claims about service interruption, network blackout, source-system locking, or data categories not confirmed in the released files.
• Encryption capability, ransomware binary behaviour, operating system targets, or recovery impact.
• initial access, credential source, phishing, exploitation, persistence, privilege escalation, discovery, lateral movement, collection method, staging method, or exfiltration method.
• Ransom demand, cryptocurrency wallet, payment, negotiation, or settlement.
• Attribution to an operator, affiliate, country, predecessor, rebrand, malware family, or other threat groups.
• Actor-specific technique mappings, signatures, YARA rules, Sigma rules, or hash blocklists.

Defensive Actions

The actions below are general ransomware and data-extortion safeguards from the CISA StopRansomware Guide. They are not presented as N0n-specific countermeasures. [6]

• Require phishing-resistant multifactor authentication for email, VPN, remote access, and privileged accounts. [6]
• Segment critical systems and restrict administrative access to approved management paths. [6]
• Maintain offline or logically isolated backups and test restoration procedures. [6]
• Preserve centralised identity, endpoint, network, cloud, and security-control logs outside the systems they monitor. [6]
• If a compromise is suspected, isolate affected systems, disable compromised accounts, preserve evidence, and follow the approved incident-response plan. [6]
• Preserve the released archives in restricted evidence storage, record SHA-256 values, restrict access to personnel with a documented need, and do not upload personal or credential-bearing data to public malware-analysis services.
• Use the Tor observable for intelligence correlation and monitoring; do not treat a match by itself as proof that an endpoint is infected. [1][6]
   

Mitigation Using Red Piranha Crystal Eye 6.0

• Block and monitor: Add n0n[.]to to Web Filter policies and verify HTTPS enforcement.
• Detect and contain: Update IDPS rules, validate inline prevention, and isolate suspected hosts using Advanced Firewall rules.
• Reduce exposure: Segment databases and backups, enforce MFA, and apply CEASR application controls.
• Respond and recover: Review CE alerts, preserve evidence, rotate compromised credentials, and restore verified backups.
   

Source References

[1] RansomLook, "N0n group profile," Accessed Sep. 20, 2026. [Online]. Available: https://www.ransomlook.io/group/n0n

[2] RansomLook, "Recent posts for 18 September 2026," Accessed Sep. 20, 2026. [Online]. Available: https://www.ransomlook.io/recent?window=3

[3] WatchGuard Threat Lab, "Ransomware Tracker," Accessed Sep. 20, 2026. [Online]. Available: https://www.watchguard.com/wgrd-security-hub/ransomware-tracker

[4] Undercode News, "New ransomware group N0n emerges," Sep. 19, 2026. [Online]. Available: https://undercodenews.com/new-ransomware-group-n0n-emerges-adding-another-threat-to-the-2026-cybercrime-landscape/

[5] Tor Project, "Encoding onion addresses," Accessed Sep. 20, 2026. [Online]. Available: https://spec.torproject.org/rend-spec/encoding-onion-addresses.html

[6] Cybersecurity and Infrastructure Security Agency, "StopRansomware Guide," Accessed Sep. 20, 2026. [Online]. Available: https://www.cisa.gov/stopransomware/ransomware-guide

[7] No More Ransom, "Decryption tools catalogue," Accessed Sep. 20, 2026. [Online]. Available: https://www.nomoreransom.org/en/decryption-tools.html

[8] AlienVault OTX, "Threat intelligence pulse search," Checked Sep. 20, 2026. [Online]. Available: https://otx.alienvault.com/browse/global/pulses

[9] VirusTotal, "Threat intelligence search," Checked Sep. 20, 2026. [Online]. Available: https://www.virustotal.com/gui/domain/n0n.to/details https://www.virustotal.com/gui/domain/n0n.to/relations

[10] Triage, "Public malware analyses," Checked Sep. 20, 2026. [Online]. Available: https://tria.ge/reports https://dns.google/resolve?name=n0n.to&type=A