N0n Ransomware Uses AI and Victim Inflation to Rise to the Top

This edition of the Bitdefender Threat Debrief covers the latest events in the ransomware threat landscape, including the claims surrounding the rise of the new ransomware group N0n, a former affiliate that turns on The Gentlemen, and news concerning BYOD ransomware.

As ransomware continues to evolve, our goal with this monthly Bitdefender Threat Debrief is to help you stay ahead of the curve. To do this, we combine information from openly available sources (OSINT) - things like news reports and research – with data we gather by analyzing Data Leak Sites (DLSs), websites where ransomware groups post details about their victims. It is important to remember that we can't independently verify all of these claims but are confident in the trends we see over time.

For this month's report, we analyzed data from October 1 to October 31, 2026, and recorded 1,072 claimed ransomware victims. Note that when excluding some of N0n’s victim dataset (126 victims) from October’s total victims, the actual number of victims reported is actually 946.

Featured Story: N0n Ransomware Uses AI and Victim Inflation to Rise to the Top

What Happened?

In mid-September, the ransomware group N0n emerged. The group hosted a data leak site with more than 100 victims, divided into categories including pending, exposed, leaked, and honors (where NOn claims to have honored the promise to destroy victim data in exchange for a ransom payment).

Several weeks later, information about N0n’s operations became plainly visible due to N0n’s failures to maintain strict operational security measures. N0n’s Python file server was left accessible on the open Internet. This presented visitors with the opportunity to go to the web address and navigate through directory structures to view contents of the server. This exposure allowed cyber defense and research teams to determine with greater confidence that N0n’s image as a potentially significant threat is just that: a false depiction. N0n is a newcomer to the ransomware landscape, relying on AI tools for foundational hacking tasks.

What Information was Disclosed in N0n’s Exposure?

N0n’s file server address is associated with a location in Sweden. Several types of information were disclosed in the aftermath of N0n’s exposure. All information types revealed make it highly unlikely that N0n is a ransomware group capable of competing with other leading threats. N0n;s actual victim count (rather than their published/perceived victim population) and their use of open-source AI dismantles their apparent trend of continuous growth. According to the data obtained from N0n’s file server, the group targeted just over 20 victims. Duplicate or false entries may have emerged due to weaknesses in maintaining the site and polling potential targets.

N0n also uses an open-source AI platform, OpenCode, to manage different AI models and write scripts. N0n invested more than $7000 in Generative AI to assist them in building common scripts that are maintained to perform actions necessary for scanning and reconnaissance activities. While an encryptor was also identified, debate remains over whether N0n consistently uses ransomware. Their reuse of encryption keys and weaknesses in OPSEC may point towards hesitancy for the group to execute ransomware code more frequently.

The exposure of N0n’s server also revealed that N0n references the same encryption keys that are used across different victim campaigns. This means that the group was leveraging the exact same ransomware code and keys to lockdown systems for different targets. Cybersecurity teams supporting victims with access to those hardcoded encryption keys can then analyze them and identify patterns needed for decryption.

What Actions are Recommended for Organizations?

As opportunistic ransomware groups continue to adopt AI into their operations, it is important for organizations to remember the following:

• Data theft claims often initially lack any validity. Keep an inventory of your assets, including critical data that may be found in open repositories. Do not assume that any data stolen is from a current dataset or usable by the threat actor without supporting evidence.
• Harden remote access controls to secure systems. This includes enforcing VPN access, restricting access via RDP and also requiring MFA authentication.
• Enforce a strong password policy and regularly rotate credentials.
• Regularly document breach cases predating current operations and check for additional exposures.
• Maintain backups in a location separate from critical infrastructure and test them regularly to ensure backup data can be restored.
• Request and review intelligence on an ongoing basis to evaluate the threat actor’s behavior and current indicators of compromise

Other Notable Ransomware News

Now, let’s explore the notable news and findings since the last Threat Debrief.

• Azazel, an affiliate of The Gentlemen, turns on their operator: Azazel has accumulated more than 6 terabytes of stolen data. Despite their affiliation with The Gentlemen, the group broke away from them after stealing data in an RaaS campaign and keeping the profits for themselves. Azazel published the stolen data on a data leak site under the name Leakned. Notably, Azazel has leveraged a technique that differs from other ransomware groups. They used the Model Context Protocol (MCP) to establish a connection between an AI coding assistant and a reverse shell. This connection allows Azazel to use the AI assistant as a command and control channel, executing commands on compromised machines. Azazel has engaged in primarily in data theft and credential theft, extracting credentials from GitLab and other pipelines.
• BYOD ransomware claims university that provides healthcare services: BYOD, a ransomware group that emerged in September, has claimed enterprise organizations across both North America and Southeast Asia. The group recently claimed a university clinic that provides healthcare services to patients. Within 24 hours of their claim, BYOD expressed that they did not realize the systems they targeted were used specifically to support direct patient care. BYOD announced they would make decryptors available to the victim organization for free; and, the affected victims are encouraged to reach them and submit a payment of $2,500 to ensure their data is destroyed. These claims are identified as potential ploys to extend the compromise and/or collect additional payment.
• Booba Team claims more victims and hits government organizations: Booba Team has claimed more than 9 government organizations at the time of this release. According to Booba Team’s data leak site, this accounts for more than 800 GB of stolen data. Booba Team’s total victims claimed in the government sector in October surpasses the totals in the same period for both Qilin (who claimed 6 victims) and The Gentlemen (who claimed 3 victims). Unlike Qilin and The Gentlemen, who have broadened their victim populations to include government victims in Western Europe and Southeast Asia, Booba Team has continued to claim victims in a limited number of regions, including North America (specifically the US) and South America. The group has been known to deploy ransomware and conduct data theft.
• New brands continue to make their entry into the ransomware ecosystem: More than 17 ransomware groups have emerged in the last two months. Several newcomers were identified in October, including but not limited to: aoqin, everstake, shiba, whitearmor, hyflock, umbra, vypr, and scarlettgroup. While some groups emerge out of a necessity to commit acts of organized crime, with limited influence from other threat groups. However, the largest variables that contribute to new ransomware groups include law enforcement takedowns, feuds and factions among ransomware groups and affiliates, and operational failures. Bitdefender will continue to track further developments in ransomware takedowns, rebrands, and evolutions.

Top 10 Ransomware Families

Bitdefender's Threat Debrief analyzes data from ransomware data leak sites, where groups publicize their claimed number of compromised organizations. This approach provides valuable insights into overall RaaS market activity. However, it comes with a trade-off: while it reflects attackers' self-proclaimed success, the information comes directly from criminals and may be unreliable. Additionally, this method captures the number of victims claimed, not the actual financial impact of these attacks.

The Top 10 ransomware groups in October include N0n, The Gentlemen, Qilin, Akira, and Booba Team. Note that due to several indicators of N0n misrepresenting their operations and victims, Bitdefender has high confidence that N0n is not in actuality a group that has the means to maintain a ranking in the Top 10 Groups.

Top 10 Most Attacked Regions

Ransomware gangs prioritize targets where they can squeeze the most money from victims. In many cases, this means focusing on developed countries with higher projected growth rates. Threat actors may also launch strategic attacks during geopolitical conflicts or periods of social unrest.

Taiwan rejoins the Top 10 Regions: Taiwan ranked 10th in October; most of the region’s industries affected by ransomware attacks are in manufacturing, healthcare, and technology.

Victims based in South Korea rise due to N0n’s claims: The number of ransomware victims based in South Korea rose to 18 in October. N0n claimed 11 victims based in South Korea; all of these victims are organizations in the transportation industry. However, due to the high level of scrutiny cast on the validity of N0n’s claims, this increase should not be viewed as an accurate pattern of behavior. Ransomware groups have not claimed a total number of victims based in South Korea surpassing 10 per month since September 2025 when Qilin executed the Korean Leaks campaign.

Top 10 Most Attacked Industries

Ransomware gangs may target organizations in critical infrastructure sectors, select other organizations that offer services tailored to consumers, or attack organizations that fall into both categories. Understanding the trends and ramifications associated with specific industries, and how specialized services and clientele are impacted is crucial for assessing risk. Here are the Top 10 industries affected by ransomware attacks.

Healthcare rises to second place in the Top Industries

In October, there was an increase in the number of victim organizations represented in the manufacturing and healthcare industries. Healthcare rose to the second rank. And, the transportation industry moved from the 10^th rank to the 6^th rank in the Top Industries with N0n claiming a total of 20 transportation victims.

About Bitdefender Threat Debrief

The Bitdefender Threat Debrief (BDTD) is a monthly series analyzing threat news, trends, and research from the previous month. Don’t miss the next BDTD release, subscribe to the Business Insights blog, and follow us on Twitter. You can find all previous debriefs here.

Bitdefender provides cybersecurity solutions and advanced threat protection to hundreds of millions of endpoints worldwide. More than 180 technology brands have licensed and added Bitdefender technology to their product or service offerings. This vast OEM ecosystem complements telemetry data already collected from our business and consumer solutions. To give you some idea of the scale, Bitdefender Labs discover 400+ new threats each minute and validate 30 billion threat queries daily. This gives us one of the industry’s most extensive real-time views of the evolving threat landscape.

We would like to thank Bitdefenders Stefan Hanu, Mihai Leonte, Gabriel Macovei, and Andrei Mogage for their help with putting this report together.