← threat actors
threat actor · not yet in the cluster map
n0n
also tracked as the gentlemen 1
2 stories · 1 in the wild · October 13, 2026 – November 2, 2026
evidence: 1 observed · 1 claimed
how they got in
- credential stuffing 1 · Nov 2
sectors
- finance 1 · Oct 13
- retail 1 · Oct 13
- technology 1 · Oct 13
- transport 1 · Oct 13
techniques
- credential access 1 · Nov 2
- credential stuffing 1 · Nov 2
- impact 1 · Nov 2
- lateral movement 1 · Nov 2
attack phases seen
- Impact 1 · Nov 2
- Initial access 1 · Nov 2
- Lateral movement 1 · Nov 2
what we reported, newest first, grouped by story
November 2, 2026
- The n0n extortion crew hit 23 organizations across 14 countries using stolen and weak credentials — RDP scanning and FortiGate VPN credential stuffing — rather than exploits, pairing AI-assisted scripting with conventional intrusion and spending over $7,000 on AI services. They escalated to deleting data and backups and altering firewall policies, exposed their own infrastructure, and at one point misused an AWS key to wipe S3 data (The Register).
· Nov 2 · observed · via credential stuffing · AI Inside the Intrusion
Oct 10 – October 13, 2026
- Leak-site volume: The Gentlemen added 10 victims with countdown timers and no samples yet, including Deloitte, KFC, MoneyGram, Confluent, BigID and the Royal Thai Air Force (@DailyDarkWeb); n0n posted 32 victims heavily concentrated in ports and shipping — Ocean Network Express, Santos Brasil, TTI Algeciras and HPC Hamburg Port Consulting among them (@FalconFeedsio).
· Oct 13 · claimed · as the gentlemen · Threat Intelligence