Ransomware newcomer N0n reached October's top 10 ransomware groups on inflated claims, according to Bitdefender's November Threat Debrief, published on 10 November 2026. The group's leak site listed more than 100 organisations, but its own exposed server points to a much smaller operation, with just over 20 victims actually targeted.

N0n appeared in mid-September 2026 and quickly climbed the rankings that track ransomware groups by their claimed victims. Bitdefender counted 1,072 claimed ransomware victims between 1 and 31 October. Setting aside 126 of N0n's entries lowers that total to 946. Bitdefender builds its monthly figures from news reports, published research and data leak sites, and warns these numbers count claimed victims rather than real financial harm.

How the group gave itself away

N0n's leak site listed more than 100 organisations under labels such as pending, exposed and leaked. A fourth category, honours, was where the group claimed it destroyed stolen data after a ransom was paid.

A few weeks later, the group made a basic security error. Bitdefender reports that N0n left a Python file server reachable on the open internet, and anyone who visited the address could browse its folders. The server's address is associated with a location in Sweden. The server's contents showed the group's threatening image was misleading: it had targeted only slightly more than 20 victims. Duplicate or invented entries may have come from sloppy upkeep of the leak site and from the way the group checked potential targets.

AI did the heavy lifting

Bitdefender describes N0n as a newcomer that depends on AI tools for basic hacking work. The group reportedly used OpenCode, an open-source platform, to coordinate several AI models and write scripts. It also spent more than $7,000 on generative AI to help build and maintain routine scripts for scanning and reconnaissance, the early work of finding and studying targets.

Researchers also found an encryption program, the tool that locks victims' files, but Bitdefender says it is still unclear whether N0n deploys it consistently. The server showed that the group used the same encryption keys and code across different victims. Bitdefender notes that teams helping victims with access to those built-in keys could study them for patterns that support decryption. The key reuse and poor security habits may explain why the group seems reluctant to run its ransomware often.

The numbers it skewed

N0n's claims also distorted October's country and industry figures. Ransomware victims based in South Korea rose to 18, and N0n claimed 11 of them, all in transportation. Bitdefender says this jump should not be read as a real trend, since no group has claimed more than 10 victims based in South Korea in a single month since September 2025. Transportation also moved from 10th to 6th among targeted industries, with N0n claiming 20 victims in that sector.

Bitdefender says it has high confidence that N0n lacks the means to stay among the top 10 groups. The case matters because much public ransomware reporting comes straight from the criminals themselves, and N0n shows how easily self-reported tallies can be inflated.

The wider October picture

The same debrief tracks other groups that shaped October. Azazel, an affiliate of The Gentlemen, broke away after stealing data in a campaign and keeping the profits. It has gathered more than 6 terabytes of stolen data, posted on a leak site named Leakned, and used an AI coding assistant linked to remote access on compromised machines as a channel for running commands.

BYOD, another group that surfaced in September, claimed a university clinic that provides patient care. Within a day it said it had not known the systems supported direct patient care, offered free decryptors, and urged victims to pay $2,500 to have their data destroyed. Bitdefender regards these statements as possible ploys to extract more money. Booba Team had claimed more than nine government organisations by the time the report was released, with its leak site citing more than 800 GB of stolen data, and Bitdefender counted more than 17 new ransomware groups over the past two months.

What defenders should take from it

Bitdefender advises organisations not to assume a data theft claim is real or current without supporting evidence, and to keep an inventory of assets, including critical data that may sit in openly accessible repositories. Its recommendations include tighter remote access controls, a VPN, limited remote desktop access and multi-factor authentication, strong passwords changed regularly, and backups stored away from critical systems and tested often. The N0n episode is a reminder that a ransomware group's league-table position is only as honest as its own leak site. Read the Bitdefender Threat Debrief for November 2026 and the SecQuill report on the findings.