Classification: TLP:CLEAR | Publication Date: 2026-10-12 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

Executive Summary

N0N's leak site currently shows 13 recent listings concentrated in Canada, the United States, and Australia, with named or sector-tagged organizations spanning Technology, Professional Services, Healthcare, and a large set with sector marked Not Found. Every listing is an unverified criminal accusation. Twelve listings were independently observed by a second leak-site crawler, which corroborates that N0N published the claims; it does not corroborate that any listed organization was breached.

The operational signal for defenders is the pattern, not the accusation: a same-day burst of postings on 2026-10-11, a healthcare-heavy subset in the US and AU, and professional services/technology exposure in the US. Organizations in regulated-data sectors should treat this as a prompt to hunt for pre-encryption staging, edge-device exposure, credential attacks against VPN/RDP, backup tampering, and unusual archive/upload behavior. No CVE in this brief is asserted as the initial vector for any named listing; the KEV items below are sector-level exposure hypotheses only.

Sourcing & Verification

• Corroboration: 12 of 13 listings were independently observed by a second leak-site crawler. One listing, Chibitek, appears single-source on ransomware.live only.
• Inclusion reflects the threat actor's claim and is NOT confirmation of a breach, compromise, intrusion, data theft, ransomware detonation, or active incident.
• A named organization may dispute a listing. A denial is likewise not proof that the claim is false; disclosure obligations vary by jurisdiction and contract, and not every incident is reportable, so neither silence nor denial settles the question.
• Security Arsenal will publish corrections and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

• Aliases: None are established by the live dataset used for this brief. Treat any alias claims outside this dataset as unverified until independently corroborated.
• Operating model: Not established by the dataset. The presence of a leak site and multi-victim posting cadence is consistent with extortion-oriented ransomware operations, but this brief does not assert whether N0N is RaaS, closed-group, or affiliate-driven.
• Ransom demands: Not established by the dataset. Do not benchmark negotiations from this listing set alone.
• Initial access: Not established for these specific listings. For defensive planning, prioritize common ransomware ingress paths: internet-facing VPN/firewall flaws, RDP exposure, phishing-driven macro or script execution, stolen credentials, and vulnerable remote management infrastructure.
• Double extortion: The listings themselves indicate an extortion claim. Because a leak-site post is only an accusation, defenders should plan for the possibility of claimed data theft without treating claimed exfiltration as proven.
• Dwell time: Not established by the dataset. Use the detection section to compress attacker dwell time by catching staging before encryption.

Current Campaign Analysis

• Sectors targeted in the live listing set: Technology, Professional Services, Healthcare, and Not Found. The named-sector subset is small; do not overfit. Healthcare appears three times in the named-sector set, twice in the US and once in AU.
• Geographic concentration: US is dominant in the named-location set, with CA and AU also present. Several listings lack country attribution and are marked ?.
• Listed organizations from the dataset: Company #24, Company #23, Company #22, Company #21, Company #20, Company #19, Company #14, Company #29, Company #28, Company #27, Company #26, Company #25, and Chibitek. Company #29 is tagged Technology/US; Company #28 Professional Services/US; Company #27 Healthcare/AU; Company #26 and Company #25 Healthcare/US; Company #14 is CA with sector Not Found; Company #24 through Company #19 are Not Found/?; Chibitek is Technology/US and single-source.
• Victim profile: The dataset does not provide employee counts or revenue. Do not infer exact size. Qualitatively, healthcare and professional services claims typically imply high-pressure extortion leverage because of regulated records, client confidentiality, uptime requirements, and legal notification exposure; technology claims can imply downstream risk if the organization provides software, MSP, cloud, or support services.
• Posting frequency: A burst pattern is visible: twelve listings are dated 2026-10-11, with Chibitek dated 2026-10-07. Burst posting can indicate batch disclosure after a collection period, an attempt to maximize pressure, or crawler timing artifacts; the dataset cannot distinguish these.
• CVE relationship: No evidence links any listed organization to a specific CVE. Hypothesis only: edge and management-plane vulnerabilities in CISA KEV are relevant to the sectors represented. CVE-2026-50751 affects Check Point Security Gateway IKEv1 authentication; CVE-2026-20316 affects Cisco Secure Firewall Management Center hard-coded password exposure; CVE-2026-59310 affects VMware vCenter path traversal; CVE-2026-63077 affects JetBrains TeamCity deserialization; CVE-2026-48027 affects Nx Console via embedded malicious code. Prioritize these where present, especially at healthcare, technology, and professional services organizations with exposed management interfaces or CI/CD infrastructure.

Detection Engineering

The following Sigma rules are intentionally behavior-based and map to common pre-ransomware stages: edge credential pressure, phishing execution, lateral movement, backup sabotage, and staging. Tune for environment baselines and management hosts.

---
title: N0N Hunt - RDP or VPN Credential Pressure Followed by Success
id: 9f1c2d10-n0n0-4a10-91a1-202610120001
status: experimental
description: Detects repeated remote authentication failures followed by success on edge VPN, RDP, or Windows logon paths. Use as hunt logic for claimed ransomware campaigns; not evidence that any N0N listing is real.
author: Security Arsenal
references:
  - https://securityarsenal.com/darkside
date: 2026/10/12
modified: 2026/10/12
tags:
  - attack.t1078
  - attack.t1133
  - attack.t1190
logsource:
  product: windows
  service: security
detection:
  selection_fail:
    EventID:
      - 4625
      - 4771
      - 4776
  selection_success:
    EventID:
      - 4624
    LogonType:
      - 3
      - 10
  condition: selection_fail and selection_success
fields:
  - EventID
  - LogonType
  - IpAddress
  - WorkstationName
  - TargetUserName
falsepositives:
  - Password spray from legitimate red team
  - Misconfigured service accounts
level: high
---
title: N0N Hunt - Office or Script Child Process With Network and Archive Staging
id: 9f1c2d10-n0n0-4a10-91a1-202610120002
status: experimental
description: Detects Office or script interpreters spawning command shells, PowerShell, archive utilities, or sync tools shortly after execution. Useful for phishing macro and staging hypotheses only.
author: Security Arsenal
references:
  - https://securityarsenal.com/darkside
date: 2026/10/12
modified: 2026/10/12
tags:
  - attack.t1204
  - attack.t1059
  - attack.t1560
  - attack.t1567
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - winword.exe
      - excel.exe
      - powerpnt.exe
      - outlook.exe
      - mshta.exe
      - wscript.exe
      - cscript.exe
  selection_child:
    Image|endswith:
      - cmd.exe
      - powershell.exe
      - pwsh.exe
      - rar.exe
      - 7z.exe
      - winzip.exe
      - robocopy.exe
      - rclone.exe
  condition: selection_parent and selection_child
fields:
  - Image
  - ParentImage
  - CommandLine
  - ParentCommandLine
  - User
  - Computer
falsepositives:
  - Administrative automation
  - Software packaging
level: high
---
title: N0N Hunt - Backup Tampering and Pre-Encryption Staging Markers
id: 9f1c2d10-n0n0-4a10-91a1-202610120003
status: experimental
description: Detects shadow copy deletion, backup catalog tampering, suspicious service installation, and remote execution tool markers associated with pre-detonation ransomware behavior. Behavioral hypothesis only.
author: Security Arsenal
references:
  - https://securityarsenal.com/darkside
date: 2026/10/12
modified: 2026/10/12
tags:
  - attack.t1490
  - attack.t1021
  - attack.t1569.002
  - attack.t1070
logsource:
  category: process_creation
  product: windows
detection:
  selection_cmd:
    CommandLine|contains:
      - vssadmin delete shadows
      - vssadmin Delete Shadows
      - wbadmin delete catalog
      - bcdedit recoveryenabled no
      - psexec
      - wmic process call create
      - sc create
      - schtasks /create
  selection_img:
    Image|endswith:
      - vssadmin.exe
      - wbadmin.exe
      - bcdedit.exe
      - psexec.exe
      - wmiprvse.exe
      - schtasks.exe
  condition: selection_cmd or selection_img
fields:
  - Image
  - CommandLine
  - ParentImage
  - User
  - Computer
falsepositives:
  - Backup maintenance windows
  - Endpoint management platforms
level: critical

let lookback = 7d;
let suspiciousTools = dynamic(["psexec.exe","wmiprvse.exe","vssadmin.exe","wbadmin.exe","bcdedit.exe","rclone.exe","rar.exe","7z.exe","schtasks.exe","sc.exe"]);
union withsource=table_ (
  DeviceProcessEvents
  | where TimeGenerated >= ago(lookback)
  | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, RemoteIP=tostring(""), Source="Process"
),
(
  DeviceNetworkEvents
  | where TimeGenerated >= ago(lookback)
  | project TimeGenerated, DeviceName, AccountName=tostring(""), FileName=InitiatingProcessFileName, ProcessCommandLine=InitiatingProcessCommandLine, InitiatingProcessFileName=InitiatingProcessFileName, InitiatingProcessCommandLine=InitiatingProcessCommandLine, FolderPath=InitiatingProcessFolderPath, RemoteIP, Source="Network"
)
| where FileName in~ (suspiciousTools)
   or ProcessCommandLine has_any ("vssadmin delete shadows","wbadmin delete catalog","recoveryenabled no","/create","process call create","rclone","mega","azcopy")
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Hits=count(), DistinctDevices=dcount(DeviceName), Commands=make_set(ProcessCommandLine, 5), RemoteIPs=make_set(RemoteIP, 5) by DeviceName, FileName, AccountName
| where Hits >= 1
| extend Score = (iff(FileName in~ ("vssadmin.exe","wbadmin.exe","bcdedit.exe"), 50, 0)) + (iff(ProcessCommandLine has_any ("rclone","mega","azcopy"), 25, 0)) + (iff(ProcessCommandLine has "psexec" or ProcessCommandLine has "process call create", 25, 0))
| order by Score desc, LastSeen desc

# Rapid N0N-campaign hygiene check: exposed RDP, recent persistence, shadow copy state, suspicious staging tools
# Run elevated on Windows servers, VDI brokers, backup servers, and management hosts. Read-only by default.
$ErrorActionPreference = 'SilentlyContinue'
$since = (Get-Date).AddDays(-7)
Write-Host '[+] RDP listeners and NLA state'
Get-NetTCPConnection -State Listen -LocalPort 3389 | Select-Object LocalAddress,LocalPort,OwningProcess
Get-ItemProperty 'HKLM:SYSTEM\CurrentControlSet\Control\Terminal Server' | Select-Object fDenyTSConnections
Get-ItemProperty 'HKLM:SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' | Select-Object UserAuthentication,SecurityLayer
Write-Host '[+] Scheduled tasks created or changed in last 7 days'
Get-ScheduledTask | ForEach-Object { $i=Get-ScheduledTaskInfo $_; [pscustomobject]@{TaskName=$_.TaskName;TaskPath=$_.TaskPath;LastRunTime=$i.LastRunTime;NextRunTime=$i.NextRunTime;LastResult=$i.LastTaskResult} } | Sort-Object LastRunTime -Descending
Write-Host '[+] Services created recently via event log'
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=$since} | Select-Object TimeCreated,Message
Write-Host '[+] Volume Shadow Copies'
vssadmin list shadows
Write-Host '[+] Recent risky binaries or archives in user-writable paths'
$paths = @($env:PUBLIC,$env:TEMP,$env:APPDATA,$env:PROGRAMDATA)
Get-ChildItem $paths -Recurse -Include *.exe,*.dll,*.ps1,*.bat,*.rar,*.7z,*.zip -File | Where-Object {$_.LastWriteTime -gt $since} | Select-Object FullName,Length,LastWriteTime
Write-Host '[+] Outbound sync/exfil tool signatures'
Get-CimInstance Win32_Process | Where-Object {$_.Name -match 'rclone|robocopy|azcopy|7z|winrar|psexec' -or $_.CommandLine -match 'mega|wasabi|backblaze|s3|rclone'} | Select-Object ProcessId,Name,CommandLine

Incident Response Priorities

• T-minus detection checklist, before encryption fires: unusual VPN success after failure bursts; new local or domain admin equivalents; RDP enabled on hosts where policy denies it; Office or script interpreter spawning cmd/powershell; mass file rename or delete reconnaissance; archive utility execution on servers; rclone/azcopy/megacmd presence; vssadmin, wbadmin, bcdedit, or backup console anomalies; new services, scheduled tasks, run keys, WMI subscriptions, or PSExec traces; egress spikes to cloud storage or uncommon ASNs; EDR tampering; backup job failures outside maintenance windows.
• Critical assets to prioritize for exfiltration monitoring: EHR/clinical repositories and medical imaging archives for healthcare claims; client matter files, deal rooms, HR records, and email archives for professional services; source code, CI/CD secrets, package registries, support access, and customer tickets for technology; backup catalogs, NAS/SMB shares, domain controllers, virtualization management, and identity stores across all sectors. This prioritization is sector-risk guidance, not confirmation that any listed organization lost data.
• Containment, ordered by urgency: 1) isolate suspected staging hosts at the switch/EDR network layer without powering off; 2) disable or expire suspect accounts and revoke tokens, especially VPN, RDP, M365, backup, and hypervisor admin sessions; 3) block egress to suspicious storage endpoints and preserve firewall/DNS/proxy logs; 4) protect backups by pausing deletion-capable jobs, rotating backup credentials, and verifying immutable copies; 5) snapshot volatile evidence before broad shutdown; 6) enumerate edge devices against KEV exposure and emergency-patch or ACL management planes; 7) prepare regulator/client decision trees only after evidence confirms scope.

Hardening Recommendations

• Immediate, 24h: enforce MFA on VPN, RDP gateways, firewall/vCenter/TeamCity management, backup consoles, and remote admin tools; block direct RDP from the internet; restrict Check Point, Cisco FMC, VMware vCenter, JetBrains TeamCity, and build tooling to management networks; review and remove Nx Console versions implicated by CVE-2026-48027 from developer endpoints; disable Office macro execution from internet zones; alert on vssadmin/wbadmin/bcdedit, new 7045 services, and cloud-sync tools on servers; verify immutable backups and test a bare-metal restore path; enable egress filtering for server VLANs.
• Short-term, 2 weeks: segment identity, backup, virtualization, CI/CD, and clinical/business-critical data planes; move to phishing-resistant MFA for admins; deploy just-in-time admin with no standing domain admin; centralize logs for VPN, EDR, DNS, proxy, cloud storage, backup, hypervisor, and CI/CD into Sentinel or equivalent; establish canary files and deception shares; baseline archive utility and sync-tool usage; require signed scripts and constrained PowerShell language mode on servers; implement rapid isolation playbooks in EDR; review disclosure and customer communication workflows so legal decisions are not improvised during an unverified claim.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub