Investigation Finds Possible Shared Data Source Behind n0n’s Maritime Extortion Claims
Summary
An investigation of n0n’s maritime extortion campaign found overlapping sample-file patterns consistent with a possible shared data source, but not proof of one. None of 38 published Bitcoin addresses showed incoming payments by October 22, 2026.
Key points
- On October 12, n0n listed 38 port, shipping, and logistics organizations across 18 countries; the batch does not establish that data was acquired at the same time.
- Samples shared OPUS and ALLEGRO references, filename patterns, a duplicate file, and vendor-style correspondence. Cydome assessed that the batch likely came from a support archive linked to CyberLogitec; the source remains unconfirmed, and CyberLogitec had not confirmed an incident.
- n0n reduced five large maritime demands between October 12 and 16, lowering the batch total from about $1.22 billion to $275.8 million.
- As of October 22, the 38 published Bitcoin addresses had no incoming transactions in the records reviewed; this does not rule out negotiations or payments by another route.
- Historical records show some anonymous victim placeholders later appeared under organization names, so duplicate entries can inflate apparent victim counts.
- Claims of disruption, encryption, destruction, settlements, and future data releases were not independently verified; the article distinguishes these claims from its observed records.
Article Details
- Attack Vectors
- n0n used a leak-site extortion process: it listed organisations, set deadlines, and threatened to publish data if victims did not pay. Listings directed victims to a private negotiation room using a key from the ransom note.
- For 38 maritime-sector listings, n0n linked torrent archives from its leak site and later marked the listings as leaked. The article does not establish how the data was acquired.
- Some listings claimed that victim systems or backups had been encrypted or destroyed; these claims were not independently confirmed.
- Cydome assessed that the maritime data batch likely came from a single support archive linked to CyberLogitec. The article presents this as an unconfirmed hypothesis.
- Defensive Notes
- Treat n0n's listing counts, claims of disruption, data provenance, and settlement statements as unverified unless independently corroborated.
- Deduplicate anonymous placeholder listings against later named entries when assessing the number of reported victims.
MITRE ATT&CK
T1486 · Data Encrypted for ImpactSome n0n victim listings claimed that data was encrypted; the article does not independently verify those claims.T1490 · Inhibit System RecoveryListings for FinSoft and AFRICA-TECH claimed that backups and shadow copies were encrypted or destroyed; this was not independently confirmed.
Threat Actors
Vendors
Products
Countries
Hong KongYusen Logistics Hong KongKuwaitGCS KuwaitNetherlandsFX liquidity and trading technology, NetherlandsSouth KoreaThe listings covered 18 countries, with South Korea accounting for 12 organisations.Türkiyenamed on n0n's leak site: the United Federation of Teachers, a Vietnamese betting operator, AstraZeneca Türkiye, Argentina's Ministry of Education, STOKR, Transcom's PayPal support operation, Argentem Creek Partners,
Industries
Financial ServicesThe first two, described as a US technology company and a Canadian financial services firm, were recorded as settled on 5 and 7 October.GovernmentBetween 18 September and early October, n0n named organisations ranging from internet and IT service providers to healthcare, finance, government and retail.HealthcareBetween 18 September and early October, n0n named organisations ranging from internet and IT service providers to healthcare, finance, government and retail.logisticsWithin five weeks, its leak site had listed more than a hundred organisations, and a campaign targeting ports, shipping companies and logistics providers brought the group into wider public attention.Maritimethrough StealthMole, this investigation examines how the group built its public presence, what its maritime campaign reveals about its possible access to victim data, and whether its claims of scale are reflectedShippingWithin five weeks, its leak site had listed more than a hundred organisations, and a campaign targeting ports, shipping companies and logistics providers brought the group into wider public attention.