Extortion group n0n lists 38 port and shipping firms, sets October 19 leak deadline

A cyber extortion group calling itself n0n has added 38 maritime and logistics organizations in 18 countries to its dark web leak site in a single batch posted on October 12, according to threat intelligence firm SOCRadar. The group, which emerged in September, is threatening to publish the allegedly stolen data on October 19 and has demanded ransoms ranging from $2.4 million to $14 million, putting container terminals, shipping lines and port IT providers under pressure ahead of the deadline.

What happened

SOCRadar said nearly all of the new listings belong to the port, shipping and logistics sector. South Korea accounts for 12 entries, including Busan terminal operators BNCT and Pusan Newport Company. The batch also includes five port IT and EDI providers, shipping lines, agencies, depots and surveying firms. According to SAFETY4SEA, named organizations include Ocean Network Express, CULines, T.S. Lines, Santos Brasil, TTI Algeciras and Eurogate Tanger. Maritime cybersecurity firm Cydome also issued a warning on October 14, describing a possible exposure affecting 37 maritime organizations linked to a shared environment.

All posts carry a shared publication deadline of October 19 at 13:27 UTC. SOCRadar reported that EUSU Logistics faces a $14 million demand for 60 MB of data, ILCS Pelindo $2.4 million for 2.4 GB and Eurogate Tanger $6 million. Some pages offer a negotiation room in exchange for a 10% entry fee paid in Bitcoin.

Technical details

SOCRadar describes n0n as a financially motivated data-theft extortion group whose earlier intrusions typically began with credentials harvested by infostealer malware. Before the maritime wave, it had listed 21 victims in 17 countries.

The maritime batch looks different. The reviewed listings describe small, application-scoped data sets, such as 23,507 EDI message files from Nam Dinh Vu Port, 1.5 GB from Pusan Newport Company and 660 MB from Eurogate Tanger. SOCRadar concluded that this pattern points to a single shared platform or vulnerability rather than 38 separate intrusions, and said it found no stealer-log credential matches for many of the listed companies. The firm compared the pattern to the MOVEit and Cleo mass-exploitation campaigns but stressed there is no evidence linking n0n to them. SAFETY4SEA likewise reported that the available evidence does not establish a common entry point.

Who is affected

The claims remain unverified: according to both SOCRadar and SAFETY4SEA, none of the listed maritime organizations had publicly confirmed a breach at the time of writing. SOCRadar noted that specific data descriptions, such as demurrage records and port disbursement accounts, lend some credibility, while templated write-ups and the lack of confirmations weigh against it. The October 19 release will be the main test of what the group actually holds.

What to do

SOCRadar advises maritime organizations to map shared platforms and ask vendors whether they are investigating, patch and review internet-facing EDI, file transfer and terminal systems, rotate integration credentials, check for employee and vendor credentials in stealer logs, enforce MFA on VPN and RDP access and prepare customer and regulator communications in case partner data leaks. Cydome recommended assessing supplier risk, reviewing vendor permissions and examining credentials shared through support channels.