n0n’s backup-extortion model shows ransomware is evolving

At a glance

What this is: ZeroFox tracked the emergence of n0n, a ransomware and data extortion group that quickly claimed victims and distinguished itself by threatening backup destruction as well as data theft.

Why it matters: IAM and security teams should treat backup access, privilege escalation, and recovery isolation as part of ransomware resilience, because extortion now targets the recovery path as much as the primary environment.

By the numbers:

• Technology and professional services combined accounted for 46 percent of n0n's targeting activity.
• ZeroFox says traced ransom payment rates fell to 28 percent in 2025, compared to more than 78 percent in 2022.

Context

Ransomware and digital extortion now extend beyond simple encryption. Attackers increasingly combine stolen credentials, internal privilege abuse, and pressure on backups to make recovery harder even when encryption is not the main lever.

The security problem is therefore not just data theft or malware execution, but control of the recovery layer. When backup systems are reachable from the same trust plane as production systems, extortion can target continuity as directly as availability.

Key questions

Q: What breaks when credentials and SSO IDs are exposed in a ransomware breach?

A: The main failure is account reuse. Exposed credentials and SSO identifiers can let attackers test access across connected systems, impersonate users, or pivot into partner environments. The risk is amplified when passwords are reusable or federation trust is broad, because the leak becomes a live authentication problem, not just a data disclosure event.

Q: Why do attackers target backup platforms during ransomware campaigns?

A: Attackers target backup platforms because backups reduce extortion leverage. If a victim can restore systems from clean backups, the ransom demand loses force. By compromising backup infrastructure or exploiting backup software, attackers narrow recovery options, increase outage pressure, and make payment more attractive. That is why backup systems need the same hardening and monitoring as core production services.

Q: What are the signs that a ransomware operation is maturing beyond simple file encryption?

A: A more mature ransomware operation usually shows multiple indicators: data theft before encryption, leak-site publishing, affiliate recruitment, recurring wallet patterns, and payments for supporting services such as hosting. These signals suggest the group is running a broader extortion business, not a one-off encryption event. That changes both the technical response and the financial investigation strategy.

Q: How should security teams separate recovery controls from production identities?

A: Use distinct privileged identities, separate administrative pathways, and independent approval or monitoring for backup operations. The point is to make a compromised production account insufficient to destroy recovery capability. If the same identity plane can reach both live systems and backups, the organisation has not truly isolated resilience from compromise.

Technical breakdown

How stolen credentials become an extortion foothold

The article describes an intrusion path that starts with credentials stolen through third-party infostealer malware. Those credentials are then used to reach corporate networks, which means the first control failure is not malware delivery but identity reuse outside the victim environment. Once attackers can authenticate successfully, the organisation has already lost the ability to treat the account boundary as a trust boundary. In practice, this is a classic credential access to internal access progression, and it becomes more dangerous when those accounts are accepted without step-up controls or device context checks. See the Cloud Workload Identity Guide. See the Cloud Workload Identity Guide.

Practical implication: treat stolen credentials as a known entry path and tighten authentication and session controls around externally acquired identities.

Why privilege escalation matters before data staging

ZeroFox says the stolen credentials are used to access corporate networks, then privileges are escalated so attackers can reach administrative tools and stage data. That shift matters because staging is not a passive step. It requires elevated access to locate, assemble, and prepare data for coercion, which means the attacker has crossed from simple access into operational control. This is the point where overprivileged accounts, weak admin segmentation, and insufficient monitoring of privileged actions all become visible failure modes. For identity teams, the issue is not just whether the account can log in, but whether it can reach the systems that control backup integrity and data movement.

Practical implication: constrain administrative reach and monitor privileged sessions that can access backup, file staging, and deletion tools.

How backup targeting changes the ransomware architecture

n0n’s distinguishing tactic is the threat to encrypt or delete data backups, which shifts extortion from business interruption alone to recovery denial. That makes backup architecture part of the attack surface rather than a separate resilience domain. If backups are network reachable, share identity, or inherit the same administrative trust as production systems, attackers can pursue them after gaining foothold in the primary environment. The article also points to encryption-free data extortion as a growing pattern, which means attackers do not need to disrupt every system if they can credibly threaten restoration. The architectural lesson is that backup isolation, access segmentation, and immutable recovery controls must be designed as security controls, not convenience features. See the Data Security Guide.

Practical implication: separate backup administration and access paths from production identities so recovery remains available under coercion.

Threat narrative

Attacker objective: The objective is to maximize extortion leverage by controlling both exposed data and the victim's ability to restore it.

1. Entry occurs through credentials stolen by third-party infostealer malware, giving the actor authenticated access to victim environments.
2. Escalation follows when the attacker uses that access to obtain administrative privileges and reach tools for data manipulation and staging.
3. Impact comes from ransom pressure built on data theft and the threat to encrypt or delete backups, which targets recovery as well as confidentiality.

Breaches seen in the wild

• Gemini AI Breach — Google Calendar Prompt Injection: Gemini AI assistant prompt injection attack leaks sensitive Google Calendar data.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Backup extortion is becoming a distinct ransomware control problem, not a variant detail. ZeroFox's n0n reporting shows that attackers no longer need encryption to create business pressure. If backups can be threatened, the recovery function itself becomes the coercion point, which changes how resilience programs should be designed and measured. Practitioners should treat backup trust boundaries as part of the extortion surface, not a post-incident recovery concern.

Credential theft remains the most efficient bridge from external compromise to internal control. The initial access path described here depends on credentials collected elsewhere and reused inside the target environment. That is a governance failure in identity lifecycle and credential hygiene, because the organisation is inheriting trust decisions made outside its boundary. API key management is one of the few controls that makes this failure mode visible when the stolen secret is not a password but another reusable authenticator.

Encryption-free extortion is a named shift in adversary economics. ZeroFox's own figures on falling ransom payment rates explain why attackers are experimenting with new monetisation models. When victims pay less often, groups seek leverage through data exposure, backup destruction, and recovery delay instead of depending solely on encryption payloads. That means security leaders should stop treating ransomware as a single technique and instead map the extortion model the adversary is actually using.

The most dangerous assumption is that backups sit outside the attack path. The article suggests the opposite: backup access may be reachable once the attacker has internal credentials and elevated administrative tooling. That creates a governance gap in which the recovery layer is implicitly trusted but not independently controlled. Practitioners should review whether backup administration, storage, and restoration rights are separated enough to survive a compromised production identity.

Data extortion and identity compromise now reinforce each other. The more organisations harden data recovery, the more attackers look for identity paths that let them undermine that recovery. That makes privileged access governance central to resilience, because the same identity that can stage data can often reach backup management functions. Teams should align identity controls, backup isolation, and incident response planning as one control system, not three separate ones.

What this signals

Ransomware resilience now depends on control-plane separation. The decisive question is whether backup administration can be reached through the same identities that govern production access. When the answer is yes, the organisation has created a single compromise path from credential theft to recovery denial.

Recovery independence is the new extortion boundary. ZeroFox's reporting suggests that attackers are testing whether victims can still restore when encryption is absent or incomplete. That makes backup immutability, isolated privilege, and restoration testing part of core security governance rather than disaster recovery housekeeping.

For practitioners

• Tighten authentication on externally sourced credentials Assume stolen credentials from infostealer ecosystems will be tested against your estate, and require stronger verification for accounts that can reach sensitive systems or administrative consoles.
• Separate backup administration from production access Place backup management in a distinct trust zone with separate privileged identities, restricted restoration rights, and independent monitoring of delete or encrypt actions.
• Review privileged paths to data staging tools Identify which accounts can reach file staging, compression, transfer, and backup-targeting utilities, then remove unnecessary administrative reach from those paths.
• Harden off-network and immutable recovery options Verify that critical backups cannot be altered through the same identity plane used for production administration, and test restoration when the primary environment is unavailable.
• Monitor for extortion-oriented post-access behavior Alert on combinations of authentication success, privilege escalation, data staging, and backup-related activity because that sequence is more informative than any single event.

Key takeaways

• The article shows that modern ransomware pressure can target backups directly, so restoration integrity is now part of the attack surface.
• ZeroFox says n0n claimed over a dozen victims quickly, and the group's model reflects a broader shift toward encryption-free extortion.
• Separating backup rights from production identities is the control most likely to reduce leverage when attackers already hold internal credentials.

Related NHI Mgmt Group resources: Data Security Guide · Group Managed Service Accounts (gMSA) Guide · API Key Management Guide · Dark Web Monitoring Guide

Key terms

• Backup Extortion: A ransomware and extortion pattern in which attackers pressure victims by threatening recovery capability rather than relying only on full-disk or file encryption. The objective is to make restoration uncertain, slow, or impossible so the victim is more likely to pay.
• Infostealer: An infostealer is malware built to collect credentials, session material, tokens, and other authentication data from infected systems. In NHI programmes, the risk is not only theft but reuse, because harvested workload secrets can unlock cloud access long after the initial infection.
• Recovery Isolation: The separation of backup, restoration, and disaster recovery paths from ordinary operational administration. It reduces the chance that a compromised production account can also tamper with the systems needed to restore services after an attack.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity controls to the broader security programmes they support.