N0N Ransomware: 10 Victims Posted in 24 Hours — Telecom, Fintech & Government Targeting Analysis with Detection Rules

Classification: TLP:CLEAR | Publication Date: 2026-09-19 | Source: ransomware.live aggregation of N0N .onion leak site

Executive Summary

Between 2026-09-18 and 2026-09-19, the N0N ransomware operation posted 10 victims in a single 24-hour window to its dark web leak site — an unusually dense posting burst that suggests either a coordinated disclosure deadline (victims who refused payment hitting their timer simultaneously) or a deliberate intimidation cadence. The victim set spans 8 countries (VE, SE, AR, US, TR, LU, BR, VN) and 7 sectors, with a notable concentration in financial services and payment-adjacent infrastructure.

Highlights of claimed victims include Inter (Venezuela's largest ISP), Transcom WorldWide (PayPal support operations), Argentina's Ministry of Education, AstraZeneca Türkiye, digital securities platform STOKR, investment firm Argentem Creek Partners, and the United Federation of Teachers. All listings are gang claims published to the N0N leak site; victim organizations should be considered alleged until confirmed, but the operational pattern itself is actionable regardless.

The bottom line: N0N is operating as an opportunistic, edge-device-first extortion crew with a global victim footprint. Organizations running VMware vCenter, Cisco FMC, or Check Point gateways with any of the CVEs below unpatched should treat themselves as pre-negotiation until proven otherwise.

Threat Actor Profile — N0N

Analyst note: N0N is a relatively low-signature actor in current telemetry. The profile below combines confirmed leak-site observations with assessments based on behavioral clustering. Confidence levels are noted inline.

The simultaneous publication of 10 victims across unrelated geographies is characteristic of a crew that pipelines intrusions: gain access broadly via exploitable edge infrastructure, then run negotiations in parallel and publish on a shared deadline.

Current Campaign Analysis

Sector Targeting (last 10 postings)

Key analytical observations:

1. Payment-chain interest. Three of ten victims touch the payments/securities ecosystem directly. A PayPal support operations provider (Transcom) is a classic third-party exposure play — the gang gains leverage by threatening data belonging to a marquee brand without breaching the brand itself.
2. Subsidiary/regional targeting. AstraZeneca Türkiye rather than AstraZeneca global follows the pattern of hitting regional entities with weaker security posture but strong parent-brand leverage.
3. Telecom as a victim class. Inter (VE) is national-scale ISP infrastructure. ISPs carry enormous exfiltration value (subscriber PII, routing data) and disruption leverage.

Geographic Concentration

Latin America (VE, AR, BR) and Southeast Asia (VN ×2) account for 50% of postings, with the US, Sweden, Türkiye, and Luxembourg rounding out the set. This is consistent with edge-device exploitation campaigns: internet-facing appliances in regions with slower patch cadence yield the cheapest access, while US/EU victims provide the highest ransom yield.

Victim Profile

• Size range: Mid-market to enterprise. National ISP and ministry-scale victims at the top; regional professional services firms at the bottom.
• Revenue band: Estimated $10M–$500M+ annual revenue for most named victims, with nation-state-scale entities (ministry, national ISP) as outliers.
• Common thread: Every victim plausibly operates internet-facing VPN, firewall management, or virtualization management infrastructure — the exact product classes present in the KEV overlap below.

Posting Frequency / Escalation

Ten postings in a single day is a burst pattern, not steady-state. This typically indicates one of three things: (a) a shared negotiation deadline expiring, (b) a deliberate publicity surge to build brand recognition, or (c) a mass-exploitation wave from weeks earlier reaching detonation/publication simultaneously. Given the CVE timing below, (c) cannot be ruled out — and defenders should assume an active exploitation wave is underway.

CVE Correlation — Assessed Initial Access Vectors

The following CISA KEV entries (confirmed ransomware exploitation) align with N0N's assessed access playbook and should be treated as candidate intrusion vectors for this campaign:

The timeline is telling: each KEV addition precedes this victim burst by 1–5 months — exactly the window needed to operationalize an exploit, pipeline intrusions, and reach the publication deadline. If you run any of these products unpatched, assume compromise and hunt (rules below).

Detection Engineering

Sigma Rules

Three rules targeting N0N's assessed TTP chain: (1) post-exploitation process spawning from edge/hypervisor services, (2) lateral movement via PsExec/WMI/service creation, (3) pre-encryption staging — shadow copy deletion plus archive/exfil tooling.

---
title: N0N Campaign - Suspicious Child Process from VPN or vCenter Service
id: 7f3a91c2-n0n1-4b2a-9c1d-aa1000010001
status: experimental
description: Detects shells or scripting interpreters spawned by VPN gateway, firewall management, or VMware vCenter service processes. Consistent with post-exploitation of CVE-2026-59310, CVE-2026-20316, and CVE-2026-50751 assessed in N0N initial access.
author: Security Arsenal Threat Intelligence
date: 2026/09/19
references:
  - https://securityarsenal.com/darkside
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  category: process_creation
  product: windows
Detection:
  selection_parent:
    ParentImage|contains:
      - '\vmware-\'
      - '\vpxd'
      - '\cisco\'
      - '\checkpoint\'
      - '\fmc'
    ParentCommandLine|contains:
      - 'vpn'
      - 'tomcat'
      - 'httpd'
      - 'vpxd'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\sh'
      - '\bash'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate vCenter or FMC administrative scripts executed under service context
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t1059
---
title: N0N Campaign - PsExec WMI or Remote Service Lateral Movement
id: 7f3a91c2-n0n1-4b2a-9c1d-aa1000010002
status: experimental
description: Detects lateral movement tooling consistent with N0N operator behavior - PsExec service installation, remote service creation over admin shares, and WMI process spawning of payload droppers.
author: Security Arsenal Threat Intelligence
date: 2026/09/19
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec:
    - Image|endswith: '\PsExec.exe'
    - OriginalFileName: 'psexec.c'
    - Image|endswith: '\PSEXESVC.exe'
  selection_service:
    Image|endswith: '\sc.exe'
    CommandLine|contains|all:
      - '\\'
      - 'create'
  selection_wmi:
    ParentImage|endswith: '\WmiPrvSE.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\rundll32.exe'
  condition: 1 of selection_*
falsepositives:
  - Legitimate administration with PsExec by IT staff (whitelist known admin hosts)
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002
  - attack.t1047
---
title: N0N Campaign - Pre-Encryption Staging Shadow Copy Deletion and Archive Exfil
id: 7f3a91c2-n0n1-4b2a-9c1d-aa1000010003
status: experimental
description: Detects pre-detonation behavior observed across ransomware crews matching N0N playbook - Volume Shadow Copy deletion, backup catalog tampering, and invocation of archiving/exfiltration tools (rclone, 7z, WinRAR CLI) in the same window.
author: Security Arsenal Threat Intelligence
date: 2026/09/19
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_shadow:
    - Image|endswith: '\vssadmin.exe'
      CommandLine|contains:
        - 'delete shadows'
        - 'resize shadowstorage'
    - Image|endswith: '\wmic.exe'
      CommandLine|contains: 'shadowcopy delete'
    - Image|endswith: '\bcdedit.exe'
      CommandLine|contains: 'recoveryenabled no'
    - Image|endswith: '\wbadmin.exe'
      CommandLine|contains: 'delete catalog'
  selection_staging:
    Image|endswith:
      - '\rclone.exe'
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
    CommandLine|contains:
      - 'copy'
      - 'sync'
      - ' a '
      - '-p'
  condition: selection_shadow or selection_staging
falsepositives:
  - Backup administrators performing legitimate shadow storage maintenance
  - Legitimate rclone use in cloud sync pipelines (whitelist service accounts)
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.t1560.001
  - attack.exfiltration
  - attack.t1567

KQL Hunt — Microsoft Sentinel

Hunt for the pre-ransomware staging window: shadow copy tampering, suspicious new services, archive/exfil tooling, and mass file renames within a 14-day lookback — aligned to N0N's estimated dwell time.

// N0N pre-ransomware staging hunt - 14 day dwell-time aligned lookback
let Lookback = 14d;
let SuspectHosts =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where ProcessCommandLine has_any (
        "delete shadows", "shadowcopy delete", "resize shadowstorage",
        "recoveryenabled no", "delete catalog")
    | summarize ShadowEvents=count(), FirstSeen=min(TimeGenerated) by DeviceName;
let Staging =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName in~ ("rclone.exe","7z.exe","7za.exe","rar.exe","winrar.exe")
       or ProcessCommandLine has_any ("rclone copy", "rclone sync", "mega.nz", "file.io", "anonfiles")
    | summarize StagingEvents=count(), Tools=make_set(FileName) by DeviceName;
let NewServices =
    DeviceEvents
    | where TimeGenerated > ago(Lookback)
    | where ActionType == "ServiceInstalled"
    | extend ServiceName = tostring(parse_json(AdditionalFields).ServiceName)
    | where ServiceName !has_any ("Windows", "Microsoft", "Update")
    | summarize NewSvcCount=count(), Services=make_set(ServiceName) by DeviceName;
let MassRename =
    DeviceFileEvents
    | where TimeGenerated > ago(2d)
    | where ActionType == "FileRenamed"
    | summarize RenameCount=count() by DeviceName, bin(TimeGenerated, 1h)
    | where RenameCount > 500
    | summarize PeakRenamePerHour=max(RenameCount) by DeviceName;
SuspectHosts
| join kind=leftouter Staging on DeviceName
| join kind=leftouter NewServices on DeviceName
| join kind=leftouter MassRename on DeviceName
| project DeviceName, FirstSeen, ShadowEvents, StagingEvents, Tools,
          NewSvcCount, Services, PeakRenamePerHour
| extend RiskScore = (toint(ShadowEvents) * 3) + (toint(StagingEvents) * 2)
                     + toint(NewSvcCount) + (toint(PeakRenamePerHour) / 100)
| order by RiskScore desc

Rapid-Response Triage Script

Run on any host suspected of N0N pre-staging activity. Checks for exposed RDP, scheduled tasks and services created in the last 7 days, shadow copy integrity, and common exfil tool artifacts.

# N0N Rapid Triage - run elevated. Outputs to C:\IR-Triage-<host>-<timestamp>.txt
$out = "C:\IR-Triage-$env:COMPUTERNAME-$(Get-Date -Format 'yyyyMMdd-HHmmss').txt"
"=== N0N Rapid Triage - $env:COMPUTERNAME - $(Get-Date) ===" | Out-File $out

"`n--- [1] RDP Exposure ---" | Out-File $out -Append
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue
"RDP Enabled: $(if($rdp.fDenyTSConnections -eq 0){'YES - INVESTIGATE'}else{'No'})" | Out-File $out -Append
Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue |
  Select-Object LocalAddress, LocalPort, OwningProcess | Out-File $out -Append

"`n--- [2] Scheduled Tasks Created/Modified Last 7 Days ---" | Out-File $out -Append
Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt (Get-Date).AddDays(-7) } |
  Select-Object TaskName, TaskPath, Date, @{N='Author';E={$_.Principal.UserId}} | Out-File $out -Append

"`n--- [3] Services Installed Last 7 Days ---" | Out-File $out -Append
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
  Select-Object TimeCreated, Message | Out-File $out -Append

"`n--- [4] Volume Shadow Copies ---" | Out-File $out -Append
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) { "WARNING: NO SHADOW COPIES PRESENT - possible vssadmin deletion (T1490)" | Out-File $out -Append }
else { $shadows | Select-Object InstallDate, DeviceObject | Out-File $out -Append }

"`n--- [5] Exfil/Staging Tool Artifacts ---" | Out-File $out -Append
foreach ($tool in 'rclone','7z','7za','rar','megasync','filezilla') {
  $hits = Get-ChildItem 'C:\Users\*\Downloads','C:\ProgramData','C:\Windows\Temp' -Filter "$tool*.exe" -Recurse -ErrorAction SilentlyContinue
  if ($hits) { $hits | Select-Object FullName, CreationTime | Out-File $out -Append }
}
if (Test-Path "$env:APPDATA\rclone\rclone.conf") { "RCLONE CONFIG FOUND - check remotes for exfil destinations" | Out-File $out -Append }

"`n--- [6] Failed Logon Bursts (brute-force indicator) ---" | Out-File $out -Append
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-3)} -ErrorAction SilentlyContinue |
  Group-Object { $_.Properties[19].Value } | Where-Object Count -gt 20 |
  Select-Object Name, Count | Out-File $out -Append

"`nTriage complete. Review $out and escalate any [1]/[3]/[4]/[5] hits to IR immediately." | Out-File $out -Append

Incident Response Priorities — N0N Playbook

T-Minus Detection Checklist (before encryption fires)

N0N's assessed 5–14 day dwell time means most victims have a detection window. Prioritize, in order:

1. Shadow copy / backup tampering — vssadmin delete shadows, bcdedit recoveryenabled no, wbadmin delete catalog. This is the highest-fidelity pre-detonation signal (T1490). If you see it, you are likely hours from encryption.
2. Archive tool staging — 7z/rar/rclone execution on servers, especially file servers and hypervisor management hosts. Data is being compressed for exfil (T1560.001).
3. New services on multiple hosts within a short window — mass service installation (Event 7045) indicates payload push preparation (T1569.002).
4. WMI/PsExec execution fan-out from a single workstation — one host touching many others via admin shares is the lateral movement apex.
5. vCenter/ESXi anomalies — new local users, SSH enabled on ESXi hosts, unexplained VM shutdowns or snapshot deletions. Given CVE-2026-59310 overlap, treat vCenter as a Tier-0 asset this week.
6. Unusual egress to file-sharing/anonymous upload domains (mega.nz, file.io, anonfiles, temp-share services) — exfiltration in progress.

Critical Exfiltration Targets (by victim pattern)

Based on this campaign's victim set, assume N0N prioritizes:

• Subscriber/customer PII databases (telecom, education, healthcare victims)
• Financial records and payment-adjacent data (fintech victims — STOKR, Argentem Creek, Transcom)
• Legal/case files (professional services victims — attorney-client material carries extreme extortion leverage)
• HR and payroll systems (union/education victims)
• Email archives of executive and legal mailboxes (negotiation intelligence and leverage material)

Containment Actions — Ordered by Urgency

1. (0–15 min) Isolate the affected VLAN/host at the switch or EDR level — do NOT power off (preserves memory artifacts and avoids triggering dead-man encryption scripts).
2. (0–30 min) Disable the suspected compromised identity; force password resets for any account observed in lateral movement paths, starting with domain admins and vCenter/ESXi root credentials.
3. (0–1 hr) Block exfil destinations at the egress proxy/firewall; snapshot firewall/VPN management plane logs before they rotate.
4. (0–2 hr) Verify backup integrity and offline/immutable backup availability before any remediation begins. If shadow copies were deleted on endpoints, confirm your offline backups are intact and disconnected.
5. (0–4 hr) Patch or isolate the candidate entry vector (vCenter, Cisco FMC, Check Point gateway, ScreenConnect) — assume persistence mechanisms are in place (webshells, rogue accounts, scheduled tasks).
6. (Same day) Engage IR retainer and legal counsel; if regulated data (health, financial, education records) is involved, regulatory clocks may already be running. Do not engage the gang directly — route negotiation decisions through counsel and your IR provider.

Hardening Recommendations

Immediate (24 hours)

1. Patch or isolate the five KEV products — CVE-2026-59310 (vCenter), CVE-2026-20316 (Cisco FMC), CVE-2026-50751 (Check Point IKEv1), CVE-2026-48027 (Nx Console), CVE-2024-1708 (ScreenConnect). If you cannot patch, pull the management interface off any routable network segment. These are CISA-confirmed ransomware vectors and align with this campaign's victimology.
2. Audit vCenter and ESXi for rogue local accounts, unexpected SSH enablement, and recent snapshot deletion.
3. Block rclone, 7z CLI, and anonymous file-sharing domains at the proxy for all servers; alert on their execution via the Sigma rules above.
4. Enable shadow copy deletion alerting (Event 7036 for VSS service stop + process creation rules for vssadmin/wmic/bcdedit).
5. Verify offline/immutable backup copies exist and test one restore — today, not during an incident.
6. Disable IKEv1 on Check Point gateways where IKEv2 is viable (CVE-2026-50751 mitigation).

Short-Term (2 weeks)

1. Segment the management plane. vCenter, firewall management, and backup infrastructure should live in an isolated, jump-host-gated network zone with no direct internet path and no lateral reachability from user VLANs.
2. Deploy the detection content above into your SIEM/EDR as production analytics; tune false positives with admin-host allowlists.
3. Third-party exposure review. The Transcom victim pattern shows N0N leverages BPO/support-chain compromise. Enumerate vendors with access to your data or network and verify their edge-device patch posture contractually.
4. Implement egress filtering with default-deny for server subnets; exfil-dependent extortion fails when bulk egress fails.
5. Move to phishing-resistant MFA (FIDO2) for all remote access and privileged accounts; edge exploitation often chains into harvested credential reuse.
6. Ransomware tabletop exercise using this briefing as the inject — rehearse the T-minus checklist and containment ordering with your SOC and executive team.

Analyst Assessment

N0N's single-day, 10-victim burst across 8 countries reads as the publication phase of a broad edge-device exploitation wave launched weeks to months ago — the KEV timeline fits almost too neatly. Financial services, education, and any organization with exposed vCenter, VPN, or firewall management infrastructure should operate under an assumption-of-compromise posture for the next 14 days and hunt aggressively using the content above. Watch the leak site: burst patterns are typically followed by either a second wave (if the initial access pipeline is still warm) or a quiet period (if operators are re-tooling). We will continue monitoring the N0N .onion infrastructure and update this briefing as new postings or victim confirmations emerge.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub