CYFIRMA Reports N0n Extortion Claims Targeting Global Maritime Sector
Summary
CYFIRMA says N0n posted 38 maritime-sector leak-site claims across 18 countries in October. No listed organization has publicly confirmed a breach; KISA notifications and one intrusion notice suggest some claims may reflect real access. Encryption claims remain unproven
Key points
- N0n posted 38 maritime and logistics entries within 23 minutes on October 12, spanning 18 countries and territories; 26 entries were in Asia.
- CYFIRMA recorded 76 leak-site entries and estimates they represent 64 to 66 distinct organizations after accounting for duplicate anonymized posts.
- No listed organization has publicly confirmed a breach. CYFIRMA cites reported KISA notifications to Korean port companies and one firm’s acknowledged intrusion notice as evidence that some claims may reflect real access.
- Claims of encryption, backup destruction, and network disruption remain unverified; CYFIRMA says it found no linked encryptor, ransom note, or other technical artifact.
- The claimed data includes EDI archives, terminal-system material, invoices, and credentials, but CYFIRMA has not validated the published data contents.
- Valid credentials are assessed as the likeliest initial-access method, and RDP as a possible lateral-movement technique; the report says neither is confirmed by artifacts.
- The report provides Sigma and YARA hunting rules as proactive, unvalidated guidance—not as confirmed N0n detection signatures.
Article Details
- Publisher
- CYFIRMA
- Report Period
- Information collected through 2026-10-13; published 2026-10-16.
- Scope
- Monitoring and analysis of N0n leak-site entries and claimed victims, with emphasis on maritime and logistics targeting.
- Sample Size
- 76 leak-site entries; an estimated 64–66 distinct organizations after deduplication.
- Key Statistics
- CYFIRMA recorded 76 entries from 2026-09-18 to 2026-10-13; after deduplication, they represent an estimated 64–66 organizations.
- N0n posted 54 new entries from 2026-10-11 to 2026-10-13, including 38 maritime entries posted within 23 minutes on 2026-10-12.
- The 38 maritime victims represent 58% of an estimated 66 distinct organizations; 26 of the 38 are in Asia.
- South Korea accounts for 12 maritime-batch entries; Korean listings carried Bitcoin demands from USD 600,000 to USD 14 million.
- 52 of the 76 recorded entries (68%) were posted on 2026-10-11 and 2026-10-12.
- Recommendations
- Rotate shared EDI, SFTP, API, and port community system credentials with listed parties, and review access logs from mid-September onward.
- Require MFA on RDP, VPN, Citrix, and cloud administration consoles, and remove direct internet exposure of RDP.
- Monitor the N0n leak site and RSS feed through the 2026-10-19, 13:27 UTC deadline, and review published file trees for relevant references.
- Search infostealer log sources for corporate domains and force password resets for exposed accounts.
- Ask listed partners in writing about confirmed intrusions and affected shared data; verify banking-detail changes through known contacts, and maintain tested immutable or offline backups.
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolUse of Remote Desktop Protocol is assessed by CYFIRMA; no confirming artifacts were identified.T1074 · Data StagedCYFIRMA maps Data Staged to the contents of N0n's listings; no technical staging artifact is reported.T1078 · Valid AccountsCYFIRMA assesses use of valid accounts as the most probable initial-access vector, but reports no confirming access artifact.T1486 · Data Encrypted for ImpactN0n claims to have encrypted victim data, but CYFIRMA found no encryptor or ransom note and treats the capability claim as unverified.T1490 · Inhibit System RecoveryN0n claims to have destroyed or encrypted backups and shadow copies; CYFIRMA found no technical artifacts confirming this.T1657 · Financial TheftCYFIRMA considers Financial Theft (extortion) supported by leak-site demands and N0n's claim that a victim paid.
Threat Actors
Countries
BrazilIndonesia (4) and Brazil (4) follow.ChinaElsewhere the batch is thin: one or two organisations each in Japan, China, Singapore, Taiwan, Hong Kong, Vietnam and India, five in Europe including Türkiye, two in the Gulf and one in Morocco.IndiaElsewhere the batch is thin: one or two organisations each in Japan, China, Singapore, Taiwan, Hong Kong, Vietnam and India, five in Europe including Türkiye, two in the Gulf and one in Morocco.Indonesiaport community system operators in the Middle East and South Korea, a port logistics IT provider in Indonesia, and a port consultancy in Germany. EDI data naming many parties could come from a single hub compromiseJapanElsewhere the batch is thin: one or two organisations each in Japan, China, Singapore, Taiwan, Hong Kong, Vietnam and India, five in Europe including Türkiye, two in the Gulf and one in Morocco.SingaporeElsewhere the batch is thin: one or two organisations each in Japan, China, Singapore, Taiwan, Hong Kong, Vietnam and India, five in Europe including Türkiye, two in the Gulf and one in Morocco.South KoreaOf the 38, 26 are in Asia, led by South Korea with 12 entries.TaiwanElsewhere the batch is thin: one or two organisations each in Japan, China, Singapore, Taiwan, Hong Kong, Vietnam and India, five in Europe including Türkiye, two in the Gulf and one in Morocco.United StatesTwo US businesses, a specialty retailer and a confectionery company, named after their anonymised deadlines expired. KISA notifies Korean victims, according to public reporting. A listed Korean steelmaker publiclyVietnamElsewhere the batch is thin: one or two organisations each in Japan, China, Singapore, Taiwan, Hong Kong, Vietnam and India, five in Europe including Türkiye, two in the Gulf and one in Morocco.
Industries
financeVerify payment detail changes (P2, Finance): Confirm any change to banking details from shipping counterparties through a known contact, given the claimed theft of invoices and banking templates.Maritime LogisticsTransportation & Logistics accounts for 35 organisations (53%), of which 33 are classified as Maritime Logistics.Transportation and LogisticsTransportation & Logistics accounts for 35 organisations (53%), of which 33 are classified as Maritime Logistics.