Santos Brasil and Softruck on n0n lists

Recent records from several sources link Brazilian port operations and technology companies to digital extortion claims, although there is no independent confirmation of the intrusions in the cases cited. Santos Brasil appeared in Ransomware.live and n0n listings, while Softruck was mentioned by the ACSec Ransomware Observatory as a victim associated with DireWolf.

What was reported about Santos Brasil?

Ransomware.live listed Santos Brasil, which is tied to port operations in Brazil, as a victim of an emerging group, but its own database warned that the claim should be treated with caution until independent verification is available. The entry described exposed database scripts and operational terminal system logs.

The Loadstar, meanwhile, reported that the extortion group n0n included 38 maritime transport and port organizations across 18 countries, among them Santos Brasil, Portonave and Superterminais. None of those organizations had publicly confirmed an intrusion at the time of publication.

DatamarNews added, citing SOCRadar, that the campaign threatened to release alleged stolen data on October 19, 2026 at 1:27 UTC. That report also said the claims had not been independently verified and that it was not confirmed whether the data was authentic, complete or recent.

What other listings appeared?

FalconFeeds.io circulated a list of 32 alleged new n0n victims that included Santos Brasil, Portonave and Super Terminais. It was a third-party report based on the group's portal, not a confirmation from the affected companies.

Safety4Sea also said the available evidence does not establish a common initial access point for the 38 maritime organizations. In its view, n0n, which emerged in September 2026, is focused on data theft and publication threats rather than conventional ransomware deployment.

What was said about Softruck?

The ACSec Ransomware Observatory listed Softruck, based in Brazil, among the disclosed victims associated with the DireWolf group. The published result does not provide a specific technical TTP or independent confirmation of the intrusion, so the case remains at the stage of initial, unverified attribution.

How do these records fit with official alerts?

The Brazilian CISC bulletin published by the federal government on that date addressed campaigns aimed at .gov.br domains and critical NGINX vulnerabilities, but the available result does not link those alerts to the claims against Santos Brasil, Superterminais, Oportunidados or Softruck. In parallel, the materials reviewed do not document a technical link between those alerts and the victim listings published by the tracking portals.

Taken together, the sources point to overlapping listings, with Brazilian companies in the port and software sectors appearing in extortion campaigns attributed to different groups, but with no public confirmation of compromise and no technical detail sufficient to support an independent attribution.