n0n Ransomware Lists ONE, Pelindo's ILCS and NCT Kandla Among 38 Maritime Firms; the Gang Uses an AI Coding Agent

A new ransomware group calling itself n0n has listed 38 maritime, port and logistics companies on its leak site, among them eight in Southeast Asia and India. The batch went up on 12 October and includes Ocean Network Express and Apical Group in Singapore, ILCS Pelindo, Samudera, April Asia and GlobalNet LCL in Indonesia, Nam Dinh Vu Port in Vietnam and the NCT Kandla container terminal in India. These are the gang's claims, not confirmed breaches.

The listings describe what n0n says it holds: for ILCS Pelindo, "Operational EDI archives (container manifests)"; for Nam Dinh Vu Port, the full EDI message archive of the terminal's operations server; for ONE, staff directories and voyage and fuel-consumption records. The deadline it set was 19 October. Security firm SOCRadar says none of the 38 was marked as settled after that date and all were published.

One vendor's data, Cydome suspects

Maritime security firm Cydome found that at least 21 of the 38 companies are publicly documented customers of CyberLogitec, a Korean maker of terminal and shipping software. Its reading is that n0n split one data set into separate "victims", though it says this isn't confirmed and that being named doesn't mean a company's own network was breached. It also doesn't know whether n0n stole the data or bought it. File dates in the samples run from 2009 to August 2026.

CyberLogitec hasn't confirmed an incident, SOCRadar notes. According to Korean press quoted by Cydome, CyberLogitec confirmed that the listed Korean companies are its customers, sent them a precautionary notice and said their systems were operating normally.

In India, The Week asked the Deendayal Port Authority about the Kandla listing and could not independently verify the alleged data breaches.

What the AI did

The AI evidence comes from an exposed staging server, found by SOCRadar, that held an n0n operator's working files from late September, covering at least 23 organisations in 14 countries but not the maritime batch. The operator used opencode, an open-source AI coding agent, which "wrote and debugged hundreds of attack scripts"; spending on AI models reached $7,216 by 22 October. The firm calls it a human-run operation helped by AI, with no fully autonomous attack system seen.

No vulnerability was exploited in the cases SOCRadar documented. Its chief information security officer, Ensar Seker, told The Register that access "relied on weak or stolen credentials". The documented entry points were credential stuffing against FortiGate SSL-VPN appliances through residential proxies, weak RDP and WinRM passwords, and exposed AWS keys. In some networks the operator took over Cisco Firepower Management Center and switched every access policy to block.

Encrypted files end in .n0n and the ransom note is n0n_READ_ME.txt.