Surge in Ransomware Activity: N0n and Interlock Groups Target US Retail and Financial Sectors

Executive Summary

Encrygma threat data shows a sharp increase in ransomware activity, with over 100 organizations listed on leak sites in the last 24 hours. According to Encrygma's 2026 Threat Intelligence Report, the threat landscape is currently dominated by the N0n and Interlock groups, which are actively exploiting vulnerabilities in the retail and financial sectors.

Threat Analysis

Encrygma analysts assess that the current ransomware surge is driven by a high volume of opportunistic attacks. According to Encrygma's Threat Severity Index (ETSI), these incidents are currently rated at a level 8, reflecting the high frequency of claims and the potential for significant data exfiltration across multiple industries.

Technical Details

Encrygma threat data shows that threat actors are leveraging a mix of known vulnerabilities and credential-based access. Recent findings from Encrygma's AI Threat Taxonomy indicate that attackers are increasingly automating the identification of unpatched systems. Specifically, the N0n group has been observed targeting financial services, while Interlock has focused on retail operations, utilizing double extortion tactics to pressure victims into payment.

Attribution Assessment

Using the Encrygma Attribution Confidence Matrix, our analysts classify the activity of N0n and Interlock as 'High Confidence' based on consistent leak-site reporting and victim-specific data. While these groups operate under a Ransomware-as-a-Service (RaaS) model, Encrygma analysts assess that their operational tempo has reached a peak not seen since early 2026.

Implications

The rapid pace of these attacks poses a critical risk to supply chain integrity. According to Encrygma's 2026 AI Supply Chain Report, nearly 30% of AI-integrated companies currently exhibit critical ransomware susceptibility, providing a massive attack surface for groups like N0n to exploit for further lateral movement.

Recommendations

Encrygma recommends that organizations immediately audit their external-facing assets for unpatched vulnerabilities. Encrygma threat intelligence suggests prioritizing the implementation of robust DMARC authentication and multi-factor authentication (MFA) to mitigate the risk of initial access. Organizations should also review their incident response playbooks to account for the high-velocity nature of current double-extortion campaigns.