N0n Ransomware Recovery: The Fast-Growing Group Behind 177 Claims Since September 2026

N0n posted its first victims on 18 September 2026 and by 3 November had listed 177 (ransomware.live), which makes it one of the most active leak sites of the autumn. 58 victims are in the United States, 14 in South Korea, 7 in Brazil, 4 in Indonesia and 3 in the United Arab Emirates; one is an Indian transport company. Transport and logistics firms appear more often than in most groups' lists, followed by technology and manufacturing.

Among its public claims are Transcom WorldWide, a customer-service outsourcer, the US sports merchandise company Fanatics, the Irish cloud hosting provider Dediserve and Venezuela's internet provider Inter. Many listings carry only a company number and a countdown to publication. These are the group's own claims and are not independently confirmed.

Little technical research on N0n has been published. Threat-intelligence trackers map its intrusions to the use of valid accounts, meaning stolen or bought logins, followed by scripted commands to spread and steal data. Its file extension, ransom note and encryption method are not publicly documented yet, and it is not confirmed that every listed victim had files encrypted rather than only data taken.

No public decryptor exists for N0n, and none is likely while the group is active. Recovery without the key works from what an encryptor leaves behind: large files such as SQL Server and Oracle databases, VMware and Hyper-V virtual disks and Veeam backup files are often only partly encrypted, because encrypting every byte of a large file takes too long. We measure exactly which regions of each file were encrypted and rebuild the tables, virtual machines and files from the intact parts.

Keep the encrypted files and the ransom note, do not wipe or reinstall the servers, and do not run repair tools on the encrypted files. Contact us for a free assessment. We have solved many cases like this. No data, no charge.