N-TREE Data Breach

ZaWoo, a ransomware group, claimed to have targeted N-TREE, a technology company based in Austria, on August 30, 2026. The group listed the company on its leak site, alleging unauthorized access to N-TREE’s systems and data. The domain associated with the company is n-tree[.]com. The claim of a data breach has not been independently verified. The technology sector, especially companies operating internationally, can be attractive targets for ransomware groups due to the potential for widespread disruption and the value of intellectual property. Over the past 60 days, ZaWoo has claimed 16 victims, with a significant focus on Germany (DE), Austria (AT), and Canada (CA). Their primary sectors of operation are Technology and Manufacturing. N-TREE’s profile as a technology company operating in Austria aligns with ZaWoo’s typical targeting strategy, suggesting this incident could be part of a broader campaign by the group.

SOCRadar CTI’s analysis of stealer-log data for N-TREE returned a “no_exposure_in_sample” verdict. This indicates that no credential records directly linked to N-TREE’s corporate domain (n-tree[.]com) were identified within the current infostealer datasets queried. However, this null result does not definitively clear N-TREE of a compromise. The absence of identified records in the analyzed sample means that the organization is not confirmed to be unaffected by the alleged breach. Phishing campaigns or the exploitation of publicly facing services remain plausible vectors for initial access that could lead to a compromise, even if associated credentials have not yet appeared in the queried stealer logs. Given the nature of ransomware operations, it is crucial to continue monitoring for any potential credential exposure or related activity. Proactive measures such as credential hygiene checks, password rotations, and multi-factor authentication reviews are recommended to mitigate potential risks.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.