Backup extortion in ransomware: what practitioners need to act on

TL;DR: The new threat actor n0n claimed over a dozen victims within a day of launching its Tor-hosted leak site, according to ZeroFox, while also threatening to encrypt or delete backups. The pattern reinforces a shift toward encryption-free data extortion as ransom payments decline and backup resilience improves.

Editorial analysis by NHI Mgmt Group, based on content published by ZeroFox: “Flash Report: Emerging Threat Actor Targets Data Backups”.

By the numbers:

• Technology and professional services combined accounted for 46 percent of n0n's targeting activity.
• ZeroFox says traced ransom payment rates fell to 28 percent in 2025, compared to more than 78 percent in 2022.

Key questions

Q: What breaks when credentials and SSO IDs are exposed in a ransomware breach?

A: The main failure is account reuse.

Q: Why do attackers target backup platforms during ransomware campaigns?

A: Attackers target backup platforms because backups reduce extortion leverage.

Q: What are the signs that a ransomware operation is maturing beyond simple file encryption?

A: A more mature ransomware operation usually shows multiple indicators: data theft before encryption, leak-site publishing, affiliate recruitment, recurring wallet patterns, and payments for supporting services such as hosting.

Practitioner guidance

• Tighten authentication on externally sourced credentials Assume stolen credentials from infostealer ecosystems will be tested against your estate, and require stronger verification for accounts that can reach sensitive systems or administrative consoles.
• Separate backup administration from production access Place backup management in a distinct trust zone with separate privileged identities, restricted restoration rights, and independent monitoring of delete or encrypt actions.
• Review privileged paths to data staging tools Identify which accounts can reach file staging, compression, transfer, and backup-targeting utilities, then remove unnecessary administrative reach from those paths.

Bottom line: The article shows that modern ransomware pressure can target backups directly, so restoration integrity is now part of the attack surface.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →