Skip to content
Emergence of N0n and BYOD Ransomware Groups in 2026

Emergence of N0n and BYOD Ransomware Groups in 2026

First seen 10 Nov 2026, 17:19 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 10, 2026 at 17:21 UTC
  • •N0n ransomware claims over 100 victims but actual count is around 20 due to exposure.
  • •BYOD operates as a ransomware-as-a-service group with confirmed data theft from at least eight victims.
  • •Both groups utilize leak sites to exert pressure on victims, marking a shift in ransomware tactics.

In late September 2026, two new ransomware groups, N0n and BYOD, emerged in the cybersecurity landscape. N0n, a former affiliate of The Gentlemen, claimed over 100 victims but was exposed for operational security failures, revealing it targeted just over 20 victims. BYOD, operating a ransomware-as-a-service model, has confirmed at least eight victims, with a focus on data theft rather than file encryption. Both groups utilize leak sites to pressure victims, with BYOD's first public claims linked to a U.S. staffing firm and a Trump-branded wireless carrier. The threat posed by N0n appears overstated due to its reliance on open-source AI tools and a lack of substantial victim data. The current status of both groups indicates a growing concern in the ransomware landscape, particularly as they exploit new operational models.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 5h ago How this analysis works

Timeline

2026-09-29
BYOD leak site first linked to victims
BYOD's leak site began public postings, targeting a U.S. staffing firm and Trump Mobile as early victims.
cyberxtron.com
2026-10-31
N0n's victim count disclosed
N0n reported 1,072 claimed victims for October, but actual count is likely 946 after excluding duplicates.
Bitdefender

More articles in this cluster (3)

Following this threat?

Track Azazel and Standpointe in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (32)

1 / 4

Common questions

What are the main tactics used by N0n and BYOD?
N0n relies on AI tools for hacking tasks and claims victim data on its leak site, while BYOD focuses on data theft without encryption.
How many victims have been confirmed for each group?
N0n claims over 100 victims but actual numbers are around 20, while BYOD has at least eight confirmed victims.
What should organizations do to protect against these groups?
Organizations should enhance their cybersecurity measures, monitor for data leaks, and prepare incident response plans to address potential threats.