ZeroFox Intelligence Flash Report - N0n Ransomware Group's Alleged Logistics Sector Breach Victims Likely Share Supplier

ZeroFox Intelligence Flash Report - N0n Ransomware Group's Alleged Logistics Sector Breach Victims Likely Share Supplier

Product Serial: F-2026-10-30a

TLP:CLEAR

In this Flash Report, ZeroFox researchers report on ransomware and digital extortion (R&DE) group n0n's data breach claims against logistics sector entities.

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here

Key Findings

• As of October 26, 2026, ransomware and digital extortion (R&DE) group n0n claims to have stolen data from at least 38 maritime and logistics organizations that very likely originated from one shared supplier rather than via 38 separate intrusions.
• The threat group has claimed at least 86 victims since ZeroFox first observed it on September 21, making it a fast-growing R&DE collective. N0n is very likely opportunistic rather than sector-focused, although the transport and logistics sector now comprises roughly a quarter of its current victims.
• While the claimed data is unlikely to be used to directly disrupt shipping or transport operations, it likely provides threat actors with material for cargo fraud, phishing, and intrusion planning against port terminals. However, none of the listings ZeroFox observed mention container release codes, likely limiting the most direct route to cargo theft.
• N0n is likely attempting to scale its operations. On October 26, an untested actor using the alias “nn0nn” advertised a n0n affiliate program for initial access brokers (IABs) on a Russian-language dark web forum. As of writing, ZeroFox was unable to confirm whether the actor is associated with the group. If recruitment succeeds, victim listings will likely accelerate, and organizations that appear on them will need to determine if their exposure stems from a shared upstream source rather than a direct breach.