n0n: Leak Site, Infrastructure and Victims of a New Extortion Operation

n0n appeared on the dark web in September 2026. Within five weeks, its leak site had listed more than a hundred organisations, and a campaign targeting ports, shipping companies and logistics providers brought the group into wider public attention.

The scale of the listings is striking, but the numbers alone do not explain how the operation works or how successful it has been. Its own records tell a more complicated story. Victims appear under anonymous placeholders before being named, ransom demands can change substantially within days, and sample files attached to seemingly unrelated organisations contain overlaps that raise questions about where the data originated.

By following n0n's leak site, its RSS feed, connected infrastructure and payment records through StealthMole, this investigation examines how the group built its public presence, what its maritime campaign reveals about its possible access to victim data, and whether its claims of scale are reflected in the evidence available.

A New Name on the Dark Web

n0n's leak site provided the first look at how the group presented itself. Its approach was straightforward: list an organisation, set a deadline and threaten to publish its data if the victim failed to pay.

• nongze***************************************snad.onion

The next question was when the operation first surfaced and how quickly it began naming victims. Searching for n0n in StealthMole's Telegram Tracker brought up an early post from the threat intelligence channel DARKFEED, which identified the group as a new threat actor on 18 September 2026. About an hour later, Ransomfeed News reported Venezuelan internet provider Inter as the group's first publicly named victim, with the post timestamped 17:51 GMT.

The two reports place n0n's public emergence and its first reported victim within a short period. They provide an early reference point for tracking the operation, although they do not establish when the group began operating privately or whether Inter was its first actual target.

The leak site also reveals how n0n wants victims to experience the extortion process. It runs without JavaScript under the tagline “no js | no mercy” and separates listings into four tabs: Pending, Exposed, Leaked and Honor. Each listing carries a countdown, and the site states that data will be published when the timer expires without payment. Victims are instructed to use a personal key from their ransom note to enter a private negotiation room.

This arrangement connects the public pressure campaign to a private negotiation process. The listing makes the threat visible, while the countdown gives it a deadline. The private key provides a separate route for the victim to engage with the group. These are the procedures n0n describes on its site; the available evidence does not establish whether every victim was handled in exactly this way.

There is also a detail that matters when tracking the group across different sources. A notice in the site's footer specifies the preferred spelling, “n0n”, with a zero between two lowercase n's, and lists alternative spellings that visitors should avoid. The notice first appeared in the group's RSS feed on 12 October.

That clarification provides a useful reference when searching for the group across Telegram, leak records and other indexed sources. It also highlights a practical issue in actor tracking: a search that relies on one spelling may not capture every relevant reference, while similar names can introduce unrelated activity.

A snapshot dated 27 October showed three figures in the site's footer:

• 105 organisations listed
• 2,300,186 site visits
• 307,163 data downloads

The three figures should not be treated as equally reliable. The visit and download counters are controlled by the group and cannot be independently verified from the available evidence. The organisation count, however, matches the listings visible on the site. It provides a more defensible measure of the group's published victim list, although it does not independently confirm 105 successful intrusions.

From Onion to Clearnet

The leak site was not the only location used to make n0n's claimed stolen data available. Its victim listings promised downloadable archives in ZIP and torrent formats for organisations that failed to pay. Following the links from the onion site in StealthMole's Dark Web Tracker led to a separate clearnet domain: n0n.**.

Nine torrent files linked directly from the leak site had been collected on 21 September 2026:

• https://n0n.**/t/uft.torrent
• https://n0n.**/t/vn-betting.torrent
• https://n0n.**/t/astrazeneca-tr.torrent
• https://n0n.**/t/minedu-ar.torrent
• https://n0n.**/t/stokr.torrent
• https://n0n.**/t/paypal-transcom.torrent
• https://n0n.**/t/argentem-creek.torrent
• https://n0n.**/t/konnatus.torrent
• https://n0n.**/t/beliteacher.torrent

The filenames correspond to nine organisations already named on n0n's leak site: the United Federation of Teachers, a Vietnamese betting operator, AstraZeneca Türkiye, Argentina's Ministry of Education, STOKR, Transcom's PayPal support operation, Argentem Creek Partners, Konnatus and BeLi Teacher.

The important detail is that these were not simply files found on a separate website with a similar name. The torrent URLs were linked directly from the group's own victim listings. This establishes a clear connection between the onion site and the clearnet domain, and shows that the latter was being used to distribute archives associated with the listed victims.

To establish whether n0n.** appeared elsewhere in the available intelligence, the domain was further investigated in StealthMole's Dark Web Tracker. The search returned 13 Tor URLs referencing it. All belonged to n0n's leak site, including the homepage and listing pages for the early victims. No other dark web page, Telegram channel or leak record referenced the domain in the results examined.

The Group's Own Record

The leak site's footer links to an RSS feed that provides a more useful record of n0n's activity than a single snapshot of the site. StealthMole’s captured snapshots of the leak site showed active entries, their status and their deadlines. Because the captures preserve earlier versions of the feed, they make it possible to compare how n0n's public claims changed over time, including cases where a current listing no longer reflects what appeared in an earlier snapshot.

• nongze******************************************snad.onion

The first capture, dated 21 September, already marked nine victims as “not paid, data published”. Their deadlines ranged from 19 September to 21 September. This places the first claimed publications within days of the group's initial appearance in the available reporting.

The feed becomes particularly useful in early October, when n0n began adding entries under anonymous labels such as “Company #74”, accompanied by a brief description of the organisation's sector and location. As deadlines approached, some of these entries reappeared under the organisation's actual name.

Several examples illustrate the pattern:

Placeholder	Description in Feed	Later Named As
Company #22	Neurology practice, New South Wales	Hunter Neurology
Company #24	Smart building and surveillance integrator, California	Interior Technologies
Company #70	FX liquidity and trading technology, Netherlands	Solid Trading B.V.
Company #74	Semiconductor manufacturing, California	SMIC US Company
Company #76	Fintech payments, US	Finzly Corp

This pattern has two implications for interpreting the group's activity.

First, a placeholder and its later named version may represent one organisation at two points in the publication process, rather than two separate victims. Counting every record independently would therefore inflate the apparent size of the operation.

Second, the feed gives a view of how n0n stages its public disclosures. The anonymous entries preserve some information about a target while withholding its name; later updates make the identification public. The timing is consistent with a staged disclosure process, although the records do not establish why the group chose to anonymise particular victims or whether every placeholder was eventually named.

This distinction became clear when n0n was searched further in StealthMole's Ransomware Monitoring. The search returned 133 recorded victims associated with n0n, including duplicate records for organisations listed first as placeholders and later by name.

Who n0n Targets

The early victim list shows no clear concentration in a single sector. Between 18 September and early October, n0n named organisations ranging from internet and IT service providers to healthcare, finance, government and retail.

Among the early listings were:

• Inter, Venezuela's largest internet provider.
• Transcom WorldWide, through its PayPal customer support operation.
• AstraZeneca Türkiye.
• Argentina's Ministry of Education.
• The United Federation of Teachers in New York.
• Fanatics, the US sports merchandise company.
• Dediserve, a cloud hosting provider in the iomart group.
• FinSoft, an Uzbek retail software vendor.

Later listings included US healthcare practices, managed IT providers, a fintech payments vendor, a semiconductor firm's US arm, a dental laboratory, a hotel and a Korean IT services company.

The range of organisations suggests that n0n was not limiting its public campaign to one industry. However, the victim list alone cannot establish whether the group selected targets opportunistically, obtained access through a common third party, or acquired data from multiple unrelated sources.

The wording of some early listings is also worth examining. Several go beyond threatening to release stolen files and claim extensive disruption to the victim's systems.

AstraZeneca Türkiye's listing states that “all sites are enforcing a total network blackout until settlement”. FinSoft and AFRICA-TECH are told that “all backups and shadow copies are encrypted or destroyed”. The Dediserve listing claims that all 46 servers at its Frankfurt site and their backups were removed.

These statements portray n0n as an operation capable of affecting entire victim environments, not merely obtaining and publishing documents. But the distinction between a group's claim and a verified incident is important here. The available evidence does not independently confirm the extent of the alleged disruption, encryption or destruction.

The Maritime Campaign

On 12 October 2026, n0n published 38 organisations from the port, shipping and logistics sector in a single batch. The listings covered 18 countries, with South Korea accounting for 12 organisations.

The timing is notable. Thirty-eight organisations across 18 countries appeared in a single short window, rather than being added gradually over several days. This establishes a coordinated publication event, although it does not by itself show that all the data was acquired at the same time or through the same means.

The listings also use a different format from n0n's earlier posts. Each specifies a fixed settlement amount in US dollars, provides a dedicated Bitcoin address and states that payment is verified automatically on the blockchain. Victims are offered a one-time alternative: pay 10% of the stated settlement to the same address and use the transaction ID to claim a private negotiation room.

Unlike the earlier listings, none of the maritime entries claims network disruption. The stated leverage is the data itself.

This difference matters because it changes what can be inferred from the group's own descriptions. The earlier posts presented n0n as having extensive control over some victims' systems. The maritime entries instead emphasised possession of data and the prospect of publication. The records do not establish whether this reflected a different acquisition method, a different type of access, or simply a different way of presenting the campaign.

The Ransom Demands Did Not Stay the Same

The initial ransom demands attracted considerable attention. Public reporting placed the total for the maritime batch at around USD 1.22 billion. Yet the 21 October leak-site snapshot gives a much lower combined figure of approximately USD 275.8 million.

The difference becomes clear when the RSS feed captures are compared. Between 12 and 16 October, n0n reduced the five largest demands while leaving the other 33 unchanged.

Listing	12 October demand (USD)	16 October demand (USD)
Ocean Network Express	400,000,000	25,000,000
Apical Group	320,000,000	25,000,000
ZPMC	160,000,000	18,000,000
Dongkuk Steel	100,000,000	10,000,000
T.S. Lines	56,000,000	10,000,000

Using the original figures, the 38 demands totaled USD 1,223.8 million. After the five reductions, the total fell to approximately USD 275.8 million.

The important point is not simply that the demands fell. The reductions were concentrated in five listings, while the other 33 remained unchanged. The resulting total was therefore driven heavily by a small number of exceptionally large demands.

The records establish that n0n changed its pricing within four days of publishing the batch. They do not explain why. The reductions could reflect a change in the group's negotiating position, an attempt to make the demands more realistic, or another motive, but none of these explanations can be established from the feed alone.

What can be said is that the original billion-dollar total was not a stable measure of the group's eventual demands. Any assessment of the campaign needs to account for when the figures were recorded rather than treating the first published amounts as the final position.

One Source, Many Victims?

The sample files attached to the 38 maritime listings raise a more substantial question: do they represent data taken independently from each named organisation, or could at least part of the batch have come from a common source?

Several filenames refer to the same family of maritime software, OPUS and ALLEGRO, across different organisations:

• Eurogate Tanger: 524900_[PNO+MGT+WebPortal] EGT_Release Note_Release_OPUS Terminal_20230707.docx
• NCT Kandla: 93101_RE KAP OPUS MGT is down URGENT00069.msg
• Korea Ferry: 436473_OPUS ADMIN_KFC STAFF.xlsx
• Portonave: 164167_sl-opus00060.txt
• CULines: 848346_UGL BL template on Allegro - 0807.xlsx
• Tsuneishi / Kambara Kisen: 658686_Allegro Seacast CSV June.2024-1.xlsx

The filenames are not the only point of overlap. Several samples read like correspondence between a software vendor and its customers, including release notes, a gap analysis report, enhancement requests and an urgent support email about a system outage. That is different from a collection made up exclusively of documents that clearly originate from each victim's internal systems.

The filenames also share a structured format. Each begins with a numeric ID, and many end with a five-digit counter. The same general pattern appears across listings associated with different organisations. One file appears under both April Asia and GlobalNet LCL.

These details raise the possibility that at least part of the batch came from a common archive or system rather than from 38 wholly separate collections of data. The repeated software references suggest a connection to the maritime technology ecosystem, while the filename structure and duplicate sample provide additional reasons to examine whether the files share a common origin.

That remains a hypothesis, not a confirmed explanation. Shared software does not, on its own, prove a shared breach, and the available filenames cannot establish how the files were obtained or whether all the organisations were affected in the same way.

There is, however, an external assessment that aligns with this interpretation. Maritime cybersecurity firm Cydome has publicly assessed that the batch likely originated from a single support archive linked to CyberLogitec, a South Korean maritime software vendor owned by EUSU Holdings. CyberLogitec develops the OPUS and ALLEGRO products referenced in the samples.

The relationship is worth noting because EUSU Logistics, which shares the EUSU name, is itself among the 38 listed organisations. Its attached samples include an infrastructure assessment and file server configuration.

The available evidence does not prove that CyberLogitec was the source, and CyberLogitec has not confirmed an incident. Nor does the shared EUSU name establish a connection between the data in the listings and the vendor or its owner. Nevertheless, the repeated OPUS and ALLEGRO references, common filename patterns, duplicate sample and vendor-style correspondence are consistent with Cydome's assessment that a common support archive may be involved.

By 21 October, the deadlines for all 38 maritime listings had expired. All were marked “NOT PAID — LEAKED”, with ZIP and torrent downloads attached. The group had therefore moved from threatening publication to claiming that the data was available, but the listing status alone does not independently verify the completeness or provenance of each archive.

Following the Payments

The ransom demands provide one measure of the scale n0n wanted to project. The Bitcoin addresses attached to each listing offer another way to examine the campaign: rather than relying on the group's stated settlement status, payments can be checked against the addresses it published. Each of the 38 maritime listings carried a dedicated Bitcoin address.

Victim	Country	Settlement (USD)	Bitcoin address
Tsuneishi / Kambara Kisen	Japan	28,000,000	bc1qx***************t49
Santos Brasil	Brazil	26,000,000	bc1q****************h2z
Ocean Network Express	Singapore	25,000,000	bc1q****************4x8
Apical Group	Singapore	25,000,000	bc1q***************hne
ZPMC	China	18,000,000	bc1q****************avt
EUSU Logistics	South Korea	14,000,000	bc1q3***************g98
Pusan Newport Company	South Korea	12,000,000	bc1q***************8asn
Polaris Shipping	South Korea	12,000,000	bc1q****************hue
Samudera	Indonesia	12,000,000	bc1q****************k9c
Dongkuk Steel	South Korea	10,000,000	bc1q****************5ml
T.S. Lines	Taiwan	10,000,000	bc1q****************03m
TTI Algeciras	Spain	10,000,000	bc1q****************fvr
Yusen Logistics Hong Kong	Hong Kong	8,000,000	bc1qp***************egm
BNCT (Busan New Container Terminal)	South Korea	8,000,000	bc1q****************l83
CULines	China	7,800,000	bc1q****************7f2
Eurogate Tanger	Morocco	6,000,000	bc1q****************lcy
Portonave	Brazil	5,800,000	bc1q****************myf
Nam Dinh Vu Port	Vietnam	5,000,000	bc1q****************827
Asyaport	Türkiye	4,800,000	bc1q****************a4e
NEOM Ports	Saudi Arabia	4,000,000	bc1q****************4ph
Dong-A Tanker	South Korea	3,200,000	bc1qh***************dv8
ILCS Pelindo	Indonesia	2,400,000	bc1q****************tkg
T2S	Brazil	2,400,000	bc1q****************e46
Camellia Line	Japan	2,000,000	bc1q****************4ug
HPC Hamburg Port Consulting	Germany	2,000,000	bc1q****************6ga
NCT Kandla	India	1,600,000	bc1q***************r9p
Superterminais	Brazil	1,600,000	bc1q***************pt8
BKH ICD	South Korea	1,200,000	bc1q****************5ra
GNCNet / DGT Busan	South Korea	1,200,000	bc1q****************g6p
Korea Ferry	South Korea	1,200,000	bc1q****************7vc
GCS Kuwait	Kuwait	1,000,000	bc1q****************c9s
April Asia	Indonesia	800,000	bc1q****************td6
GlobalNet LCL	Indonesia	800,000	bc1q****************mh3
MGNP	South Korea	800,000	bc1q****************m96
Premier Alliance	Netherlands	800,000	bc1q*****************xy
Samjoo Maritime	South Korea	600,000	bc1q****************05s
BMT IQ	United Kingdom	400,000	bc1q****************j0l
Saehan Marine	South Korea	400,000	bc1q****************usw

The address list gave a way to test whether the campaign had generated any visible payments. A review of public blockchain records as of 22 October 2026 found no transactions received by any of the 38 addresses. This includes the smaller 10% payments that n0n said would unlock a private negotiation room.

That result is significant when considered alongside the changing ransom demands. The group initially attached more than USD 1.2 billion in demands to the batch, later reduced the total to approximately USD 275.8 million, and marked the listings as leaked after their deadlines expired. Yet none of the published addresses had received an on-chain payment by the date checked.

This does not establish that no victim negotiated with n0n or that no payment could have been made through another route. It does establish that the 38 addresses published for this campaign showed no incoming transactions in the records reviewed. The settlement amounts should therefore be treated as demands, not money received.

The picture outside the maritime batch is different. The leak site's Honor tab lists ten anonymised organisations as having “honored their deadline”, with their data marked as destroyed between 5 and 20 October. All ten entries are anonymised. The first two, described as a US technology company and a Canadian financial services firm, were recorded as settled on 5 and 7 October.

These entries suggest that n0n claims to have reached settlements with other victims, but the site's statements are not independently verified payment records. Unlike the maritime listings, the Honor entries do not provide named Bitcoin addresses that can be matched to those outcomes.

One case in the historical RSS captures offers a possible link between a named victim and an anonymous entry. In the 12 October capture, Company #23, described as an architecture and design firm in Florida, was pending with a deadline of 14 October. By 16 October, the feed listed Trieschmann Dumala Architectural Group as “not paid, exposure passed”, with exactly the same deadline. In the 21 October snapshot, Trieschmann Dumala no longer appeared, while Company #23 was listed in the Honor tab with its data marked as destroyed on 18 October.

The matching deadline and description support the possibility that Company #23 and Trieschmann Dumala were the same organisation, later moved back into an anonymous entry after a settlement. The connection has not been confirmed, however, and the available records do not independently establish that a payment occurred.

The contrast is worth keeping in view: the maritime campaign's published wallets showed no incoming transactions, while n0n's own records claimed that ten other organisations had settled. One finding is based on the reviewed blockchain records; the other remains the group's account of its negotiations.

What the Group Says Comes Next

The 21 October snapshot of n0n's leak site included a banner under the heading “COMING SOON”. It announced a future publication involving:

• “more than 500 organizations”
• a “combined value almost 1 trillion USD”
• “the largest breach we have held to date”

No organisation names, sample files or download links accompanied the announcement.

The same banner stated that n0n would be “opening our affiliate doors”, inviting other hackers to apply and “become n0n as well”.

The proposed publication would represent a substantial increase on the 102 organisations listed in the 21 October snapshot. But at this stage, the announcement is a claim about future activity, not evidence that the group has obtained data from more than 500 organisations or that the combined value of the material approaches USD 1 trillion.

The maritime campaign offers a reason to be cautious about taking the headline figures at face value. Its original demands totalled more than USD 1.22 billion before being reduced to approximately USD 275.8 million within four days. That history does not prove the next announcement will be exaggerated, but it shows that figures published by the group can change substantially.

The affiliate announcement is also significant, although its implications remain uncertain. If implemented, it could extend the n0n name beyond the original operators by allowing other hackers to participate under the same brand. It is not yet clear whether this would involve a formal affiliate programme, shared infrastructure, revenue sharing or simply permission to use the name. None of those arrangements can be confirmed from the banner alone.

Conclusion

The evidence collected so far shows an operation that developed a visible leak-site presence quickly, used its own RSS feed to track changing victim listings, and connected its onion site to a clearnet domain hosting torrent files. The historical captures also reveal that the published victim count needs to be deduplicated: anonymous placeholders and later named entries can refer to the same organisation, while searches for the group's name can return records belonging to unrelated actors.

The maritime campaign is the most significant finding in this investigation, but not simply because it involved 38 organisations across 18 countries. The shared OPUS and ALLEGRO references, recurring filename structure, duplicate sample and vendor-style correspondence raise the possibility that at least part of the batch originated from a common data source. Cydome's assessment of a possible CyberLogitec-linked support archive is consistent with those observations, but the source has not been confirmed.

The payment records add another dimension. As of 22 October, none of the 38 Bitcoin addresses associated with the maritime campaign had received a transaction, despite the group's substantial published demands. Its Honor tab, meanwhile, claimed that ten other organisations had settled. Those claims remain unverified, and one apparent link between a named victim and an anonymised Honor entry is suggestive rather than conclusive.

The findings show why n0n's published numbers should not be used as a direct measure of successful attacks or financial returns. The group has demonstrated a consistent public process for listing organisations, setting deadlines and publishing data it claims to hold. However, the number of listings, the origin of the data, the extent of compromise and the money actually received are separate questions. The available evidence answers some of them more clearly than others.

The announced plan to publish data relating to more than 500 organisations and open the operation to affiliates could mark a new phase, but it remains untested. Whether n0n can turn that stated ambition into a larger and more effective operation will depend on what appears next, not on the size of the figures in its own announcement.

Editorial Note

Dark web investigations rarely provide a complete picture. Threat actors control their own publications, change claims and listings over time, and have an incentive to present their operations as larger or more successful than the available evidence may support. In this case, StealthMole's historical captures, Dark Web Tracker, Telegram Tracker and Ransomware Monitoring helped connect the group's infrastructure, reconstruct changes to its victim records and compare its public claims with observable evidence. Those findings make the operation easier to assess, but questions around the source of the maritime data, the extent of individual compromises and the group's actual financial returns remain open.

To access the unmasked report or full details, please reach out to us separately.

Contact us: support@stealthmole.com