n0n: 34 maritime and port organisations listed on 12 October

On 12 October 2026, between 13:53 and 14:16 UTC, the leak site of a recent cybercriminal group calling itself n0n listed 38 organisations [1] [2]. Each entry carries the mention “unpaid”. These listings rest solely on the group’s own claim, which no victim has confirmed to my knowledge. Of the 38 organisations named, 34 belong to shipping, ports and terminals.

A group first seen on 18 September 2026

The group has been publicly active for less than a month, which calls for caution about its origin and methods. Its first activity is detected on 18 September 2026, and its leak site, reachable through Tor, appears on the 21st. By the 22nd it already claims more than a dozen victims [3]. They include a customer relations provider (87 million records claimed) and a Venezuelan internet access provider. SOCRadar counts 21 victims in 17 countries before the maritime batch, most of them outside the sector, and places the group probably in Russia. No link to an earlier group is documented.

ZeroFox and CyberXTron describe initial access through credentials stolen by infostealers (malware that harvests credentials) and the threat of encrypting or destroying backups. SOCRadar describes data theft without any ransomware deployment.

As a reminder, an infostealer is usually installed after a click on the infected attachment of a phishing email. It then collects the credentials typed on the workstation of a technician or a contractor, administration interfaces included, and resells them. With a valid account, access requires no vulnerability, and a strong password makes no difference if it was typed on an infected machine.

Who is on the list?

Of the 34 maritime entities, 22 are in East, South and Southeast Asia, 10 of them in South Korea. The other 12 are in Brazil, Turkey, Morocco, Kuwait, Saudi Arabia, Spain, Germany and the United Kingdom. SOCRadar counts 18 countries in total.

The entries do not all describe the same thing. 15 of them announce Electronic Data Interchange (EDI) archives. Some name the standard terminal messages (BAPLIE for stowage plans, CODECO for gate movements, COPARN for bookings). 7 others concern database scripts or configuration files of terminal operating systems. The last 12, mostly Korean shipowners, list internal commercial documents: expense receipts, port call accounts, bunker calculations, charter parties, staff directories. A compromised EDI exchange platform would explain the first family. The other two imply access to terminal applications and to ship management tools.

The 38 entries were posted within twenty-three minutes and carry the same deadline, 19 October at 13:27 UTC, with one exception set at 13:19. The batch was therefore prepared before going online. The origin of the data cannot be inferred from that.

Six ransom amounts displayed

6 entries out of 34 carry a ransom in the 13 October survey: between $600,000 and $14 million, payable in bitcoin. The two highest amounts concern a terminal and a logistics company. Access to the private negotiation room costs 10% of the amount, according to SOCRadar: 5.7 bitcoins (about $600,000) for Eurogate Tanger, 2.3 (about $240,000) for ILCS.

SOCRadar records $2.4 million for ILCS, for 2.4 GB. EUSU Logistics demands $14 million for 60 MB. The amount therefore does not follow the claimed volume. Without encryption, the group monetises the sole threat of publication.

Boannews reports the same orders of magnitude for the Korean companies: $14 million for Yoosoo Logistics, $12 million for Busan New Port and $600,000 for Samjoo Maritime [4]. It adds $10 million for Dongkuk Steel, a steelmaker I do not count among the maritime entities. These amounts are the ones the group displays, and nothing indicates they are fixed until the deadline.

A software vendor mentioned?

For this batch, an entry route other than stolen credentials is circulating on social networks. A vulnerability at a Korean vendor of software for shipping and terminals is said to have been the initial source of compromise, a lead consistent with the digital dependencies of the sector. The cybersecurity company that put it forward states itself that it has established neither the origin nor the extent of the supposed leak, and the leak site entries name no supplier. The vendor has published nothing. Its statements and those of its customers identify 9 of the 34 entities as users of its software, port terminals and a shipowner spread across several countries. The other 25 remain without a documented link. The entry displaying the highest ransom belongs to a sister company of this vendor within the same group. SOCRadar observes that the small datasets claimed for several victims could come from a common application, which is not confirmed either [6]. The actual cost of these leaks and attacks (Cyber Battle Damage Assessment, the evaluation of damage after an attack) has not yet been assessed.

Claims without samples

None of the 38 entries comes with a sample, which SOCRadar also notes for the group’s earlier victims [6]. The announced volumes are small and specific to one application. SOCRadar reads 660 MB and 354 files for a Moroccan terminal, 1.5 GB and 774 files for a Korean terminal, 2.4 GB and 108 files for an Indonesian port IT provider. SOCRadar also searched the batch’s domains in the infostealer logs in circulation. For a good share of the organisations, no credential appears there, although this is the documented access mode for the group’s first victims. At least one entry names an organisation without an information system of its own: an alliance of three shipowners, whose claimed network documentation would come from the systems of a member or of a terminal.

The Korean agency’s statement

Ten of the 34 entities are Korean, and the national agency spoke on 13 October. The Korea Internet and Security Agency (KISA) told the outlet Boannews that day that it knew of ransomware damage at several port companies, which it had informed [4]. An IT manager at one of the named companies tells the same outlet that KISA warned him and that he is checking the extent of the damage.

Dongkuk Steel, which appears on the list with documents from an internal financial system claimed, answers that the group’s assertions are unilateral and that no actual damage is confirmed [5]. None of the 38 organisations had confirmed a compromise as of 18 October.

The 19 October deadline

The publication announced for 19 October at 13:27 UTC will provide the first verifiable element. If the files of several victims share the same export format and the same directory tree, the common source will be readable directly in the archives.

Sources

• [1] The Loadstar, 12 October 2026.
• [2] The Maritime Executive, October 2026.
• [3] Infosecurity Magazine, on the emergence of n0n.
• [4] Boannews, 13 October 2026, on the 12 Korean shipping and steel companies.
• [5] Newsjournalism (NGetNews), 13 October 2026, on Dongkuk Steel.
• [6] SOCRadar, 13 October 2026, on the 12 October batch, the claimed volumes and the negotiation portal.