New N0n Extortion Gang Lists 38 Port and Shipping Firms in One Night
CYFIRMA says a new extortion group, N0n, posted 38 port, terminal, shipping and logistics organizations in 18 countries in one batch, 12 in South Korea. No victim has confirmed a breach and no N0n malware has been found.
A new extortion gang wants the shipping industry’s attention. CYFIRMA says a group calling itself N0n posted 38 port, terminal, shipping and logistics organizations in 18 countries on its leak site in a single batch on Oct. 12, with a shared deadline of Oct. 19. Twelve are in South Korea, covering nearly every layer of a port ecosystem. None of the listed organizations has publicly confirmed a breach, and CYFIRMA has found no N0n malware, so for now these are claims.
For defenders
What’s known: the leak site went up Sept. 18, 2026, and held 76 entries (about 64 to 66 distinct organizations) by CYFIRMA’s Oct. 13 cutoff. Korean listings carried Bitcoin demands from $600,000 to $14 million. Public reporting says KISA is notifying Korean port companies and one firm acknowledged an intrusion notice, which CYFIRMA reads as real access for part of the Korean set; a listed Korean steelmaker called its listing a one-sided claim. The group claims to hold EDI archives, terminal operating system material, invoices, banking templates and credentials. Origin unknown; no link to any known group.
How they get in: not confirmed. CYFIRMA’s best assessment is stolen logins, most likely from infostealer logs, used against remote access such as RDP (T1078 (Valid Accounts), T1021.001 (Remote Services: Remote Desktop Protocol)). Claims of destroyed backups (T1490 (Inhibit System Recovery)) and encryption are unverified, and CYFIRMA treats N0n as data-theft extortion. It also floats a hypothesis: four listed port IT providers mean one supplier hack could explain many listings.
Indicators: none beyond the leak site, which we don’t publish. CYFIRMA released Sigma and YARA threat-hunting rules for shadow-copy deletion, rclone exfiltration and public-IP RDP logons; they target likely techniques, not confirmed N0n activity. They’re in the Hunt Lead report below.
What it means for you
If you ship goods, run a freight business or trade with Asian ports, the bigger near-term risk isn’t the hack itself but what follows: stolen invoices and banking templates are perfect raw material for fake “our bank details have changed” emails. Your company doesn’t have to be on the list for that to hit you.
Do this now
- Confirm any change to a shipping partner’s bank details by calling a number you already have, never one in the email.
- Rotate passwords for EDI, SFTP and port-system accounts you share with partners, especially anyone in South Korea, Indonesia or Brazil.
- Put multi-factor authentication on RDP, VPN and Citrix, and take RDP off the open internet.
- Keep an offline or immutable backup and test that you can restore from it.
Source article: N0n Extortion Group Targets Global Shipping
Publisher: CYFIRMA Research
Published: October 16, 2026
URL: https://www.cyfirma.com/research/n0n-extortion-group-targets-global-shipping/
Executive Summary
CYFIRMA profiles N0n (also written n0n), a data-theft extortion group whose Tor leak site launched on Sept. 18, 2026 and recorded 76 entries, an estimated 64 to 66 distinct organizations, by Oct. 13; 52 of those entries were posted on Oct. 11 and 12, including a batch of 38 port, terminal, shipping, logistics and port IT organizations in 18 countries and territories with a shared deadline of Oct. 19, 13:27 UTC. Twenty-six of the 38 are in Asia and 12 in South Korea; outside the batch, victims are scattered across 23 sectors, mainly in the US and Canada. N0n has no known aliases, no observed affiliate program and no link to any known group, and CYFIRMA assigns no country of origin. No intrusion chain has been confirmed by artefacts: CYFIRMA assesses that initial access most probably comes from valid credentials harvested by infostealers, used over RDP and other remote access, followed by data staging and exfiltration with unidentified tooling, and treats the group’s claims of backup destruction and encryption as low confidence. The objective is financial extortion, with Bitcoin demands of $600,000 to $14 million on Korean listings and one claimed payment; the impact, if the claims hold, is exposure of EDI, terminal-system, invoice, banking-template, credential and personal data that enables invoice fraud and follow-on intrusion across shipping counterparties. Because no N0n sample exists, CYFIRMA’s published Sigma and YARA rules are threat-hunting rules for likely techniques rather than N0n signatures; hunt leads, false positive expectations and the published rule content are detailed below.
ATT&CK chain: Initial Access → Lateral Movement → Collection → Exfiltration → Impact
Hunt Lead Grid
| Hunt Lead Level | Hunt Lead Name | ATT&CK | Risk of False Positives |
|---|---|---|---|
| 1 (Junior) | Rclone Binary, Config and Execution Sweep | T1567.002 (Exfiltration Over Web Service: Exfiltration to Cloud Storage) | Medium. Some IT teams use rclone for sanctioned backups and migrations; the rules match the binary by embedded strings and PE metadata even when renamed, so allowlist approved hosts and service accounts rather than the file name. |
| 2 (Pro) | Shadow Copy and Backup Catalogue Deletion | T1490 (Inhibit System Recovery) | Medium to High. Backup software and admins prune shadow copies and catalogues; the rules anchor on explicit delete commands, and the YARA rule needs two or more of them in one file, so tune by allowlisting backup products by signed path. |
| 2 (Pro) | Successful RDP Logon from a Public IP | T1078 (Valid Accounts), T1021.001 (Remote Services: Remote Desktop Protocol) | Medium. Approved jump hosts and remote-access gateways with public addresses will match; the rule excludes private ranges, so allowlist the known public gateway addresses and alert on everything else. |
Rclone Binary, Config and Execution Sweep
CYFIRMA has not identified N0n’s exfiltration tooling, but its listings describe bulk archives (EDI histories, terminal-system database scripts, invoice sets) of the kind extortion groups usually move with rclone to cloud storage, and CYFIRMA published three rules for it: a Sigma rule for rclone execution by image name, original file name or the PE description “Rsync for cloud storage”, a YARA rule for rclone executables (PE, ELF or Mach-O) including renamed copies, and a YARA rule for rclone configuration files that define a cloud or file-transfer remote with credentials, or an encrypted config. The detection logic is a retrospective file-system sweep with both YARA rules across servers that hold EDI, terminal operating system or finance data, plus the Sigma rule over process-creation history, looking especially for renamed rclone binaries and configs in user, Temp or ProgramData folders.
Use EDR or a YARA-capable scanner for the file sweep, and EDR process creation, Sysmon Event ID 1 or 4688 for the Sigma rule, and pair hits with proxy or firewall logs for large outbound transfers to cloud storage. Sweep back to at least mid-September 2026, when N0n’s site went live, and further on systems exposed to partners. Allowlist sanctioned rclone use by host and account, never by file name, since attackers rename it; blocking all cloud storage is usually the wrong control because the business depends on it. These rules generalize to nearly every data-extortion crew, which is why they are worth running even without a confirmed N0n link. An unexplained rclone binary or config with a cloud remote on a data server should be escalated as possible exfiltration.
The rules below are reproduced from the CYFIRMA source article. The page renders them with typographic quotes and without indentation; straight quotes and standard indentation are restored here, with no other change.
title: Rclone Execution on Windows Host
id: 2b8e4a71-c05d-4f3e-a9b6-71d3e5f0c842
status: experimental
description: Hunts for rclone, a tool commonly used by extortion groups for bulk exfiltration to cloud storage. N0n exfiltration tooling is unknown.
author: CYFIRMA Research
date: 2026-10-14
tags:
- attack.exfiltration
- attack.t1567.002
logsource:
category: process_creation
product: windows
detection:
selection_image:
Image|endswith: '\rclone.exe'
selection_pe:
OriginalFileName: 'rclone.exe'
selection_desc:
Description: 'Rsync for cloud storage'
condition: 1 of selection_*
falsepositives:
- Sanctioned backup or migration jobs
level: highrule Hunt_Rclone_Binary
{
meta:
description = "Rclone executables, including renamed copies; rclone is commonly used by extortion groups for bulk exfiltration to cloud storage"
author = "CYFIRMA Research"
date = "2026-10-14"
id = "938b7207-8a0d-463f-8b15-58d12991845d"
mitre_attack = "T1567.002"
scope = "Threat hunting for a likely technique, not confirmed N0n activity. N0n exfiltration tooling is unknown"
false_positives = "Sanctioned backup or migration tooling"
strings:
$s1 = "github.com/rclone/rclone" ascii
$s2 = "Rsync for cloud storage" ascii wide
$s3 = "rclone.org" ascii
condition:
(
uint16(0) == 0x5A4D or
uint32(0) == 0x464C457F or
uint32(0) == 0xFEEDFACF or
uint32(0) == 0xCFFAEDFE
)
and 2 of them
}rule Hunt_Rclone_Config_With_Cloud_Remote
{
meta:
description = "Rclone configuration files defining a cloud or file-transfer remote, or an encrypted rclone configuration"
author = "CYFIRMA Research"
date = "2026-10-14"
id = "6852333e-0590-4a34-aa31-c4c3ca1a2591"
mitre_attack = "T1567.002"
scope = "Threat hunting for a likely technique, not confirmed N0n activity"
false_positives = "Legitimate rclone use by administrators or developers"
strings:
$type = /\ntype\s?=\s?(mega|s3|ftp|sftp|pcloud|dropbox|drive|onedrive|b2|webdav|box|swift|azureblob|putio)\b/ ascii nocase
$key = /\n(user|pass|access_key_id|secret_access_key|token|host|endpoint|account)\s?=\s?\S/ ascii nocase
$enc = "RCLONE_ENCRYPT_V0:" ascii
condition:
filesize < 64KB and (($type and $key) or $enc)
}Hunt Lead Level: 1 (Junior Analyst)
ATT&CK: Exfiltration → T1567.002 (Exfiltration Over Web Service: Exfiltration to Cloud Storage) (mapping per source article)
Sources: “N0n Extortion Group Targets Global Shipping”, CYFIRMA, Oct. 16, 2026, https://www.cyfirma.com/research/n0n-extortion-group-targets-global-shipping/ (source article)
Shadow Copy and Backup Catalogue Deletion
N0n’s listings for a retail software vendor and an IT services provider claim that backups and shadow copies were encrypted or destroyed, and other listings claim networks were taken offline; CYFIRMA has found no encryptor, ransom note or file extension and rates these claims low confidence. Its rules hunt for the commands that usually precede such destruction: vssadmin delete shadows, wmic shadowcopy delete and wbadmin delete catalog in process-creation logs (Sigma), and scripts or binaries that contain two or more of the vssadmin, wmic, wbadmin or bcdedit recovery-disabling commands, or PowerShell that removes Win32_ShadowCopy objects (YARA). The detection logic is a real-time Sigma alert on those command lines plus a periodic YARA sweep of script folders, Temp, ProgramData and admin shares for staged deletion scripts.
Use EDR process creation, Sysmon Event ID 1 or 4688, and the VSS and Windows Backup event logs to confirm what was actually deleted. Allowlist backup products by signed image path and their scheduled maintenance windows, and route every other hit straight to response rather than tuning it away, because by the time shadow copies are being deleted an intruder usually holds admin rights. Relying on shadow copies as your only recovery is the wrong control; offline or immutable backups are what survives this step. The lead generalizes to almost every ransomware and destructive-extortion operation. Escalate any non-allowlisted hit as a likely late-stage intrusion and isolate the host immediately.
The rules below are reproduced from the CYFIRMA source article. The page renders them with typographic quotes and without indentation; straight quotes and standard indentation are restored here, with no other change.
title: Shadow Copy or Backup Catalogue Deletion
id: 6f1d2c9e-3b7a-4e52-9d1f-8a4c0b2e7d31
status: experimental
description: Hunts for deletion of volume shadow copies or the Windows backup catalogue. N0n claims to destroy backups, but this is not confirmed by artefacts.
author: CYFIRMA Research
date: 2026-10-14
tags:
- attack.impact
- attack.t1490
logsource:
category: process_creation
product: windows
detection:
selection_vssadmin:
Image|endswith: '\vssadmin.exe'
CommandLine|contains|all:
- 'delete'
- 'shadows'
selection_wmic:
Image|endswith: '\WMIC.exe'
CommandLine|contains|all:
- 'shadowcopy'
- 'delete'
selection_wbadmin:
Image|endswith: '\wbadmin.exe'
CommandLine|contains|all:
- 'delete'
- 'catalog'
condition: 1 of selection_*
falsepositives:
- Administrative backup maintenance
level: highrule Hunt_Shadow_Copy_And_Backup_Deletion_Commands
{
meta:
description = "Scripts or binaries containing two or more shadow copy, backup catalogue or recovery deletion commands, a technique N0n claims but has not been confirmed to use"
author = "CYFIRMA Research"
date = "2026-10-14"
id = "5cfd1f23-5451-46f8-83e8-a1b225f9880a"
mitre_attack = "T1490"
scope = "Threat hunting for a likely technique, not confirmed N0n activity"
false_positives = "Administrative backup maintenance scripts; legitimate security tools that embed these commands"
strings:
$c1 = /vssadmin(\.exe)?"?\s+delete\s+shadows/ ascii wide nocase
$c2 = /vssadmin(\.exe)?"?\s+resize\s+shadowstorage/ ascii wide nocase
$c3 = /wmic(\.exe)?"?\s+shadowcopy\s+delete/ ascii wide nocase
$c4 = /wbadmin(\.exe)?"?\s+delete\s+(catalog|systemstatebackup|backup)/ ascii wide nocase
$c5 = /bcdedit(\.exe)?"?\s+\/set\s+\{default\}\s+recoveryenabled\s+no/ ascii wide nocase
$ps1 = "Win32_ShadowCopy" ascii wide nocase
$ps2 = "Remove-CimInstance" ascii wide nocase
$ps3 = "Remove-WmiObject" ascii wide nocase
$ps4 = ".Delete()" ascii wide nocase
condition:
filesize < 10MB and
(
2 of ($c*) or
($ps1 and 1 of ($ps2, $ps3, $ps4))
)
}Hunt Lead Level: 2 (Pro)
ATT&CK: Impact → T1490 (Inhibit System Recovery) (mapping per source article; actor-claimed, not confirmed)
Sources: “N0n Extortion Group Targets Global Shipping”, CYFIRMA, Oct. 16, 2026, https://www.cyfirma.com/research/n0n-extortion-group-targets-global-shipping/ (source article)
Successful RDP Logon from a Public IP
CYFIRMA’s leading hypothesis for N0n’s access is valid credentials, most plausibly from infostealer logs, used against remote access services; the spread of small and large victims across unrelated sectors with no shared exploited product fits that, and the claimed theft of plaintext staff credentials and hundreds of customer accounts would feed re-entry. Its Sigma rule looks for Windows Event 4624 with logon type 10 (RemoteInteractive) where the source IpAddress is outside the RFC 1918, loopback and link-local ranges, meaning someone logged in over RDP directly from the internet. The detection logic is that rule run against all Windows security logs, enriched with the source IP’s geolocation and ASN and the account’s normal logon pattern.
Use Windows Security logs from every host with RDP enabled, forwarded to the SIEM, and enrich with RDP gateway, VPN and Citrix logs so traffic through approved gateways can be separated from direct exposure. Sweep from mid-September 2026 onward, and search infostealer log sources for your corporate domains in parallel, as CYFIRMA recommends. Allowlist approved public jump hosts by address; geofencing alone is the wrong control, because stolen credentials are often used through residential proxies in the victim’s own country. Any hit for an account without an approved remote-access reason should trigger a password reset, session review and a check for MFA on that path. The rule generalizes to every credential-driven intrusion, not just N0n.
The rule below is reproduced from the CYFIRMA source article. The page renders it with typographic quotes and without indentation; straight quotes and standard indentation are restored here, with no other change.
title: Successful RDP Logon from Non-Private IP Address
id: 9c3f7d10-4e28-4b6a-8f05-d2a1b6e94c57
status: experimental
description: Hunts for successful RemoteInteractive logons from public IP addresses, consistent with use of stolen credentials over exposed RDP, an assessed but unconfirmed N0n access vector.
author: CYFIRMA Research
date: 2026-10-14
tags:
- attack.initial_access
- attack.t1078
- attack.lateral_movement
- attack.t1021.001
logsource:
product: windows
service: security
detection:
selection:
EventID: 4624
LogonType: 10
filter_private:
IpAddress|cidr:
- '10.0.0.0/8'
- '172.16.0.0/12'
- '192.168.0.0/16'
- '127.0.0.0/8'
- '::1/128'
- 'fe80::/10'
condition: selection and not filter_private
falsepositives:
- Approved remote access through jump hosts with public addresses
level: mediumHunt Lead Level: 2 (Pro)
ATT&CK: Initial Access → T1078 (Valid Accounts); Lateral Movement → T1021.001 (Remote Services: Remote Desktop Protocol) (mapping per source article; assessed, not confirmed)
Sources: “N0n Extortion Group Targets Global Shipping”, CYFIRMA, Oct. 16, 2026, https://www.cyfirma.com/research/n0n-extortion-group-targets-global-shipping/ (source article)
Hash Appendix
N0n
CYFIRMA identified no file hashes, IP addresses, ransom notes, email addresses or Tox IDs for N0n, and no N0n sample is available, so there are no hashes to list. CYFIRMA also published a YARA rule matching N0n’s leak-site address and tagline; it isn’t reproduced here because it contains the leak-site address, which we don’t publish.
MD5s
(not available) # no N0n samples identifiedSHA1s
(not available) # no N0n samples identifiedSHA256s
(not available) # no N0n samples identifiedReferences Appendix
- “N0n Extortion Group Targets Global Shipping”, CYFIRMA Research, Oct. 16, 2026, https://www.cyfirma.com/research/n0n-extortion-group-targets-global-shipping/ (source article; victimology, assessed TTPs, Sigma and YARA rules)
- MITRE ATT&CK Enterprise technique pages linked above, MITRE, https://attack.mitre.org/