Topic starter
25/10/2026 11:10 am
TL;DR: n0n claimed over a dozen victims within a day of launching its Tor-hosted leak site, with ZeroFox tracking a model that also threatens backup destruction. Backup integrity now sits inside the attack surface, so recovery planning has to protect the systems attackers can reach after they already have credentials.
Editorial analysis by NHI Mgmt Group, based on content published by ZeroFox: “Flash Report: Emerging Threat Actor Targets Data Backups”.
By the numbers:
- Technology and professional services combined accounted for 46 percent of n0n's targeting activity.
- ZeroFox says traced ransom payment rates fell to 28 percent in 2025, compared to more than 78 percent in 2022.
Key questions
Q: Why do attackers target backup platforms during ransomware campaigns?
A: Attackers target backup platforms because backups reduce extortion leverage.
Q: What are the signs that a ransomware operation is maturing beyond simple file encryption?
A: A more mature ransomware operation usually shows multiple indicators: data theft before encryption, leak-site publishing, affiliate recruitment, recurring wallet patterns, and payments for supporting services such as hosting.
Q: What breaks when credentials and SSO IDs are exposed in a ransomware breach?
A: The main failure is account reuse.
Practitioner guidance
- Tighten authentication on externally sourced credentials Assume stolen credentials from infostealer ecosystems will be tested against your estate, and require stronger verification for accounts that can reach sensitive systems or administrative consoles.
- Separate backup administration from production access Place backup management in a distinct trust zone with separate privileged identities, restricted restoration rights, and independent monitoring of delete or encrypt actions.
- Review privileged paths to data staging tools Identify which accounts can reach file staging, compression, transfer, and backup-targeting utilities, then remove unnecessary administrative reach from those paths.
Bottom line: The article shows that modern ransomware pressure can target backups directly, so restoration integrity is now part of the attack surface.
Glossary terms: Backup Extortion, Infostealer, Recovery Isolation
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:15 pm
Backup extortion is becoming a distinct ransomware control problem, not a variant detail. ZeroFox's n0n reporting shows that attackers no longer need encryption to create business pressure. If backups can be threatened, the recovery function itself becomes the coercion point, which changes how resilience programs should be designed and measured. Practitioners should treat backup trust boundaries as part of the extortion surface, not a post-incident recovery concern.
A question worth separating out:
Q: How should security teams separate recovery controls from production identities?
A: Use distinct privileged identities, separate administrative pathways, and independent approval or monitoring for backup operations. The point is to make a compromised production account insufficient to destroy recovery capability. If the same identity plane can reach both live systems and backups, the organisation has not truly isolated resilience from compromise.
👉 Read our full editorial: n0n’s backup-extortion model shows ransomware is evolving
This post was modified 7 days ago by NHI Mgmt Group