N0N Ransomware Group Files 14 Unverified Claims in Single-Day Surge

A single day of ransomware activity generated 23 claims on public leak sites, with the N0N group responsible for the majority of these filings. Our data desk analysis of public data from ransomware.live shows N0N submitted 14 claims, significantly outpacing other active groups. These figures represent unverified statements made by criminal actors and do not confirm actual data theft or victim status.

Which ransomware groups are most active right now?

N0N is the dominant actor in this 24-hour window, accounting for more than half of all recorded claims. Following N0N, the qilin group filed three claims, while rhysida submitted two. Several other groups reported single incidents each. Emperador, BrainCipher, dragonforce, and incransom each filed one claim during the same period. This distribution highlights N0N’s current operational tempo compared to its competitors in the ransomware landscape.

Where are these attacks concentrated geographically?

The United States faces the highest volume of reported claims, with 10 incidents attributed to it in this timeframe. Canada follows with two claims. Single claims were reported for organizations in Australia, Morocco, Peru, and Colombia. This geographic spread indicates that while US entities are the primary focus, ransomware groups are casting a wider net across North America, South America, Africa, and Oceania.

Which industries are being targeted?

Healthcare organizations appear in four of the claims, making it the most frequently cited sector in this dataset. Professional services and technology sectors each account for two claims. Transportation and government and defense sectors each saw one reported claim. These sectors are often critical infrastructure or hold sensitive data, making them high-value targets for extortion. The data does not link specific sectors to specific ransomware groups for every claim.

What does this mean for business operations?

These numbers reflect claims posted to leak sites, not necessarily successful breaches or data exfiltration. Victims’ names are deliberately withheld in this reporting to protect privacy. However, the volume suggests active campaigns by multiple groups. Organizations should monitor these trackers as part of broader threat intelligence, but treat individual claims as unverified until official confirmation or vendor updates are available.

Background: Threat intelligence program

A threat intelligence program transforms raw data into actionable context. It requires collection, processing, analysis, and dissemination. Most programs fail because they automate collection without human analysis, creating noise that hides real attacks. Success depends on aligning intelligence with specific defensive actions.

Read the full guide: How Threat Intelligence Programs Work and Where They Fail

What to do and how to stay safe: N0N

• Monitor ransomware leak site trackers for any mention of your organization or its subsidiaries.
• Verify any claims through official channels before taking action or assuming data loss.
• Ensure backup systems are isolated and tested to mitigate potential ransomware impacts.
• Review security logs for unusual activity that might indicate a breach in progress.

Step-by-step guide: How Windows Malware Removal Works: The Hidden Persistence Layer

General security guidance from the Sandbox Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How many ransomware claims were recorded in this 24-hour period?

A total of 23 ransomware leak-site claims were recorded in the 24-hour period analyzed.

Which country had the most claims?

The United States had the most claims, with 10 reported incidents during the timeframe.

Is N0N the only ransomware group active?

No, other groups including qilin, rhysida, emperador, BrainCipher, dragonforce, and incransom also filed claims.