Full Report
A new post from SOCRadar reported that the n0n extortion group added 38 organizations across the global maritime... The post n0n extortion claims target 38 global maritime and logistics organizations, raising port data exposure concerns appeared first on Industrial Cyber.
Analysis Summary
# Incident Report: Mass Data Extortion of Global Maritime and Logistics Sectors
## Executive Summary
The "n0n" extortion group has targeted 38 global maritime and logistics organizations, listing them on a dark web leak site with ransom demands ranging from $2.4 million to $14 million. The incident involves the exfiltration of sensitive port operational data, likely via a single shared application vulnerability or exposed interface rather than individual network breaches. While primarily a data-theft extortion campaign, the group remains a high-threat actor due to its aggressive posting schedule and potential for operational disruption.
## Incident Details
- **Discovery Date:** October 15, 2026 (SOCRadar Report)
- **Incident Date:** September 2026 – October 2026
- **Affected Organization:** 38 organizations (including BNCT, Pusan Newport Company, Nam Dinh Vu Port, ILCS Pelindo)
- **Sector:** Maritime, Transportation, and Logistics
- **Geography:** Global (18 countries; notable concentration in South Korea)
## Timeline of Events
### Initial Access
- **Date/Time:** September/October 2026
- **Vector:** Probable exploitation of a shared application or a specific vulnerability in port management/EDI software.
- **Details:** Access may also be facilitated via credentials harvested by infostealer malware, though many victims lacked matching infostealer logs, reinforcing the "shared vulnerability" theory.
### Lateral Movement
- **Details:** Limited evidence of deep lateral movement within internal networks; the group appears to focus on specific applications containing Electronic Data Interchange (EDI) and operational records.
### Data Exfiltration/Impact
- **Details:** Exfiltration of specific datasets including vessel schedules, container manifests, gate movement records, shipping documentation, and terminal system configuration records.
- **Volumes:** Ranges from 1.5 GB to 2.4 GB per victim; Nam Dinh Vu Port saw 23,507 EDI message files stolen.
### Detection & Response
- **How it was discovered:** SOCRadar identified new listings on the n0n group’s dark web leak site.
- **Response actions taken:** Threat intelligence monitoring; publication of a deadline (Oct. 19, 2026) by the threat actor to pressure victims.
## Attack Methodology
- **Initial Access:** Exploitation of exposed shared applications or vulnerabilities; Infostealer malware credentials.
- **Persistence:** Use of administrative tools to maintain access.
- **Privilege Escalation:** Not explicitly detailed; likely leverages existing administrative tool access.
- **Defense Evasion:** Avoids traditional ransomware (encryption) to stay under the radar of some detection tools.
- **Credential Access:** Infostealer malware.
- **Discovery:** Active Directory mappings and reconnaissance of port operational systems.
- **Lateral Movement:** Administrative tool manipulation.
- **Collection:** Gathering EDI files, legal documents, and terminal logs.
- **Exfiltration:** Transfer of data to dark web hosting environments.
- **Impact:** Financial extortion; potential for operational disruption if data is manipulated or if encryption (though not yet seen) is deployed.
## Impact Assessment
- **Financial:** Extortion demands between $2.4M and $14M per organization.
- **Data Breach:** Exposure of highly sensitive logistics data (manifests, vessel schedules, and gate records).
- **Operational:** High potential for supply chain disruption if terminal system configurations are used to interfere with port traffic.
- **Reputational:** High; public listing on a leak site impacts trust in maritime supply chain security.
## Indicators of Compromise
- **Network indicators:** Monitoring for connections to known n0n leak site domains (URLs defanged: hxxps[://]socradar[.]io/blog/n0n-group-global-ports-shipping-leak/).
- **File indicators:** Massive exfiltration of EDI-formatted files (.edi, .xml).
- **Behavioral indicators:** Unusual administrative tool usage; access to container manifest databases from unauthorized external IPs.
## Response Actions
- **Containment:** Identify and patch the suspected shared application vulnerability.
- **Eradication:** Revoke credentials potentially harvested by infostealers.
- **Recovery:** Verification of data integrity in terminal systems to ensure configurations haven't been altered.
## Lessons Learned
- **Key takeaways:** The maritime sector remains vulnerable to "shared-point-of-failure" attacks where one vulnerable application can expose dozens of organizations.
- **Improvement:** Better vetting of third-party port IT providers and shared logistics platforms is required.
## Recommendations
- **Patch Management:** Audit and patch all Internet-facing EDI and Port Management Systems.
- **Identity Security:** Implement Multi-Factor Authentication (MFA) to mitigate the impact of infostealer-harvested credentials.
- **Network Segmentation:** Isolate operational data (EDI/Manifests) from general IT environments.
- **Monitoring:** Implement behavior-based monitoring for administrative tools to detect non-malware-based extortion activities.