Ransomware Group n0n Threatens Backup Integrity in New Extortion Tactic

• •The ransomware group n0n threatens to delete backups, challenging recovery assumptions.
• •Over a dozen organizations have been affected, primarily in the U.S. and various sectors.
• •Analysts emphasize the psychological impact of the threat, despite no evidence of backup destruction capabilities.

A new ransomware group named n0n has emerged, targeting organizations by threatening to encrypt or delete their backup infrastructure. First detected on September 18, 2026, n0n has already affected over a dozen organizations, primarily in the U.S., with victims from sectors including finance, technology, retail, and education. The group exploits stolen credentials from infostealer malware to gain initial access, escalating privileges to extort confidential data. Analysts note that while the group's threats are aggressive, there is currently no technical evidence that they can execute the promised destruction of backups. This tactic aims to psychologically pressure victims into paying ransoms by undermining the belief that backups are secure. Recommendations for organizations include improving credential hygiene and implementing immutable backup solutions. The situation remains dynamic as the group continues to expand its list of victims.