GlobalNet LCL Ransomware Claim by N0n (Oct 2026)

Claim Summary

The ransomware group tracked as N0n has allegedly listed GlobalNet LCL, an Indonesian port agency and logistics operator, on its dark web leak site. According to the threat actor’s post, the claimed attack date is October 12, 2026, with a threatened publication date of October 19, 2026 at 13:27 UTC if no payment is made.

The group claims to hold “container gate movement and damage management records” tied to port agency and logistics operations in Indonesia. The post is tagged with a “NOT PAID - EXPOSED” label, suggesting the actor asserts the victim did not meet its demands. The claimed data volume is undisclosed.

None of these claims have been independently verified. The listing may be exaggerated, recycled, or fabricated. Ransomware operators frequently inflate the scope and sensitivity of stolen data to pressure victims into paying.

Threat Actor Profile

N0n is a low-profile ransomware operation with very limited public visibility. As of this report, there is no established public research available on the group, its total known victim count is unknown, and no confirmed toolset or malware family has been publicly attributed to it.

This lack of a track record is significant. It means analysts cannot assess whether N0n reliably possesses the data it claims, whether it follows through on publication threats, or whether it operates as a standalone crew, an affiliate, or a rebrand of a prior operation. Groups with little to no history sometimes exaggerate capabilities to build a reputation, while others are simply new and under-documented.

Because no known tools, tactics, or procedures (TTPs) are publicly documented, no specific YARA rules or detection signatures can be responsibly attributed to this actor at this time. Defenders should rely on general ransomware detection guidance, including monitoring for unusual data staging, exfiltration patterns, and unauthorized access to file shares, rather than actor-specific indicators.

Alleged Data Exposure

According to the threat actor, the purportedly exfiltrated material relates to container gate movement and damage management records. In a port and logistics context, such records could theoretically include operational scheduling, container handling logs, and damage assessments.

However, this is an unverified claim. No data samples, file listings, or proof-of-possession have been independently reviewed. The group has not publicly disclosed the volume of data allegedly taken. It is entirely possible the claim overstates the sensitivity or even the existence of the data.

Yazoul Security does not host, link to, or reproduce any leaked material. We do not provide access to .onion addresses, download links, or data samples.

Potential Impact

If the claim is accurate, the exposure of port logistics records could present operational and competitive risks, potentially including insight into container movement patterns and internal damage management processes. Ports and logistics firms are attractive targets because of the operational disruption that downtime can cause.

That said, the practical impact remains speculative. There is no confirmed evidence of service disruption, regulatory notification, or customer data exposure at this time. Organizations in the Indonesian transportation and logistics sector should treat this as a prompt to review third-party and supply chain exposure, not as a confirmed breach of any specific partner.

What to Watch For

• Any official statement from GlobalNet LCL confirming or denying the incident.
• Independent verification of the claimed data, including file listings or samples reviewed by researchers.
• Follow-on activity from N0n that would establish a pattern of credible claims.
• Sector-wide targeting of Indonesian port and logistics operators.
• Regulatory or CERT disclosures from Indonesian authorities.

Defenders should prioritize credential hygiene, network segmentation for operational technology, and monitoring for data exfiltration. For related guidance, see our advisory index at /advisory/.

Disclaimer

This report is based solely on an unverified claim published on a ransomware group’s leak site. Yazoul Security has NOT independently confirmed the attack, the data theft, the data volume, or the authenticity of any material referenced. The threat actor may be exaggerating, misrepresenting, or fabricating its claims. Nothing in this report should be treated as established fact. Organizations named should be presumed to be responding appropriately unless and until they issue public statements.