Emerging Ransomware Gang Uses Backup Destruction Threats to Pressure Victims

A newly formed ransomware group known as n0n is escalating the stakes of double‑extortion attacks by threatening to wipe out victims’ backup systems unless a ransom is paid.

Backup Destruction as a New Lever

Unlike typical ransomware that encrypts primary data, n0n explicitly warns that it will target and destroy backup repositories, effectively removing the victim’s fallback option for recovery.

The group’s ransom notes detail the methods it will use, including deleting snapshots, corrupting cloud‑based storage, and disabling backup software services.

Tactics and Targets

Early victims appear to be mid‑size enterprises that rely heavily on automated backup solutions. n0n’s approach forces organizations to consider paying the ransom not just to restore encrypted files, but to preserve any chance of data recovery.

• Threatening to delete on‑premises backup tapes
• Corrupting cloud snapshots on platforms such as AWS and Azure
• Disabling backup agents and wiping configuration files

Response and Mitigation

Security experts advise that organizations should segment backup environments from production networks, implement immutable storage where possible, and regularly test restoration procedures to ensure resilience against such threats.

Incident response teams are also urged to treat backup destruction threats as a critical component of the ransom negotiation, documenting all communications for potential law‑enforcement involvement.

“If attackers can eliminate your backups, the leverage they gain is far greater than simple encryption,” said a senior analyst at a leading cybersecurity firm.

The emergence of n0n underscores a broader trend where ransomware actors are diversifying their tactics to increase pressure on victims and extract higher payouts.

For a detailed account of n0n’s tactics and recommended defenses, see InfoSecurity Magazine coverage of ransomware gang uses backup.