New Ransomware Group Threatens to Wipe Victims' Backups, Raising Stakes in Double‑Extortion Attacks

An emerging ransomware collective identified as n0n is escalating the threat landscape by adding the destruction of backup data to its extortion playbook, according to a recent analysis published by Infosecurity Magazine. The group’s ransom notes explicitly warn that failure to pay will trigger not only encryption of primary files but also the erasure of copies stored in backup systems, a tactic that could cripple recovery efforts for affected organizations.

The approach builds on the “double extortion” model that has become common among ransomware operators over the past few years. In that model, attackers first encrypt a victim’s data and then threaten to release stolen information publicly if the ransom is not paid. By targeting backups as well, n0n seeks to remove the most reliable safety net that many enterprises rely on to avoid paying a ransom, effectively turning a two‑step leverage strategy into a three‑step one.

Cybersecurity experts note that the move reflects a broader trend of ransomware groups diversifying their tactics to stay ahead of defensive measures. As more organizations adopt immutable storage, offline backups, and rapid incident‑response protocols, attackers are looking for new vulnerabilities to exploit. Backup destruction, whether achieved through ransomware payloads that locate and delete snapshot files or by exploiting misconfigurations in cloud storage, can render traditional recovery plans ineffective.

The n0n gang’s communications do not provide technical details about how the backup wiping is carried out, but analysts suggest the threat could involve ransomware modules that scan for common backup directories, target volume shadow copy services, or leverage privileged access to cloud backup APIs. Such capabilities would require a higher level of sophistication than earlier ransomware strains, indicating that the group may be drawing on expertise from more established criminal enterprises.

For businesses, the emergence of this tactic underscores the importance of a layered defense strategy. Security teams are advised to regularly test backup integrity, enforce strict access controls, and consider air‑gapped or immutable backup solutions that cannot be altered once written. Incident‑response plans should also account for the possibility that backups may be compromised, including alternative data‑recovery pathways and legal considerations surrounding ransom negotiations.

Law enforcement and industry partners are monitoring the n0n gang closely, but attribution remains challenging due to the use of anonymizing infrastructure and frequent rebranding. The heightened risk associated with backup destruction may prompt regulators to revisit cybersecurity standards, especially for critical infrastructure sectors that rely heavily on rapid data restoration.

While the full impact of n0n’s strategy will become clearer as more incidents are reported, the threat signals a new phase in ransomware economics. By threatening to eliminate the very mechanism that traditionally mitigates ransom demands, attackers aim to increase pressure on victims and potentially drive higher payouts, a development that could reshape how organizations approach both preventive and reactive cybersecurity measures.