N0N Ransomware: 10 Victims Posted in Single-Day Surge — Cross-Sector Campaign Hits Telecom, Finance, Government & Education

Classification: TLP:AMBER — For enterprise defenders and incident response teams Source: Security Arsenal dark web collection (leak site monitoring via ransomware.live) Collection Date: 2026-09-19 Confidence: HIGH (victim postings directly observed on actor-controlled infrastructure)

Executive Summary

On 2026-09-18, the N0N ransomware operation posted 10 new victims to its dark web leak site in a single 24-hour window — the largest single-day disclosure batch we have attributed to this group. The victimology is deliberately broad: Venezuela's largest ISP, a PayPal support outsourcer in Sweden, an Argentine government ministry, a U.S. investment firm, an AstraZeneca subsidiary in Türkiye, a Luxembourg digital securities platform, and education targets in Vietnam and the United States.

This pattern — high-volume, geographically dispersed, sector-agnostic — is consistent with an initial-access-broker (IAB)-fed operation purchasing access at scale rather than conducting targeted intrusions. Defenders in every affected sector should treat edge device exploitation and stolen VPN credentials as the most probable entry vectors and hunt for pre-encryption staging behavior immediately.

Threat Actor Profile — N0N

Analyst note: N0N is a relatively recent entrant, and attribution confidence on tradecraft specifics is MODERATE. However, the correlation between this campaign and edge-device CVE exploitation (below) matches the dominant access pattern across comparable mid-tier crews.

Current Campaign Analysis

Sectors Targeted (this posting batch)

• Financial Services (3): Transcom WorldWide (PayPal support ops, SE), Argentem Creek Partners (US), STOKR (LU) — payment-adjacent and investment data has high extortion leverage
• Education (2): United Federation of Teachers (US), BeLi/FSC education centers (VN)
• Government & Defense (1): Ministry of Education — Argentina
• Technology (1): Inter — Venezuela's largest internet provider; ISP compromise creates downstream exposure for thousands of subscribers
• Healthcare (1): AstraZeneca Türkiye — subsidiary-level targeting of a major pharma brand
• Professional Services (1): Konnatus legal services (BR)
• Other (1): Vietnamese betting operator (GC789 network) — suggests willingness to hit grey-market entities unlikely to involve law enforcement

Geographic Concentration

Eight countries with no single-country dominance: VE, SE, AR, US, TR, LU, BR, VN. Latin America is over-represented (VE, AR, BR) relative to most crews' victimology — a possible affiliate specialization or weaker edge-security posture in regional telecom/government infrastructure.

Victim Profile

Mixed-tier: from national-scale infrastructure (Inter, ministry) to mid-market services firms (estimated $10M–$500M revenue band for most). This is classic opportunistic volume operations, not big-game hunting — consistent with IAB-acquired access being worked in parallel by multiple affiliates.

Posting Frequency / Escalation

10 of the last 100 leak-site posts landed in a single day. Batch-posting victims simultaneously is an escalation tactic: it maximizes press coverage, pressures all named victims against a shared countdown, and signals affiliate throughput. Expect a second batch within 7–14 days if negotiations stall.

Probable Initial Access Vectors (KEV Correlation)

The following CISA KEV entries — all confirmed ransomware-exploited — map to N0N's assessed access methodology and should be treated as priority patch/verify items:

The VMware vCenter CVE is the most urgent: vCenter compromise enables mass VM encryption, and its presence in the KEV alongside this campaign is consistent with the rapid multi-victim throughput observed.

Detection Engineering

Sigma Rules

Three rules covering the kill chain: edge/RMM initial access, lateral movement via PsExec/WMI, and pre-encryption staging (shadow copy deletion + mass exfil behavior).

---
title: N0N Ransomware - Suspicious RMM or VPN Management Plane Execution
id: 7a3f1c2e-9b4d-4e8a-b1c6-2d5f8a9e3c71
status: experimental
description: Detects execution of remote access tooling (ScreenConnect, AnyDesk, ngrok) or child processes of VPN/firewall management services consistent with N0N initial access via exploited edge devices and RMM abuse (CVE-2024-1708, CVE-2026-20316, CVE-2026-50751).
author: Security Arsenal Threat Intelligence
date: 2026/09/19
references:
    - https://securityarsenal.com/darkside
logsource:
    category: process_creation
    product: windows
detection:
    selection_rmm:
        Image|endswith:
            - '\ScreenConnect.ClientService.exe'
            - '\ScreenConnect.WindowsClient.exe'
            - '\AnyDesk.exe'
            - '\ngrok.exe'
            - '\cloudflared.exe'
    selection_parent_edge:
        ParentImage|contains:
            - 'firewall'
            - 'vpn'
            - 'tomcat'
            - 'httpd'
    filter_legit_rmm:
        Image|contains:
            - 'C:\Program Files\ScreenConnect'
            - 'C:\Program Files (x86)\AnyDesk'
    condition: (selection_rmm and not filter_legit_rmm) or selection_parent_edge
falsepositives:
    - Legitimate RMM deployments in non-standard paths; baseline and allowlist per-environment
level: high
tags:
    - attack.initial_access
    - attack.t1133
    - attack.t1190
    - attack.t1219
---
title: N0N Ransomware - PsExec and WMI Lateral Movement Chain
id: 8b4e2d3f-ac5e-5f9b-c2d7-3e6a9b0f4d82
status: experimental
description: Detects PsExec service installation, WMI remote process creation, and ADMIN$/IPC$ share usage patterns observed during N0N pre-encryption lateral movement.
author: Security Arsenal Threat Intelligence
date: 2026/09/19
references:
    - https://securityarsenal.com/darkside
logsource:
    category: process_creation
    product: windows
detection:
    selection_psexec:
        Image|endswith:
            - '\PSEXESVC.exe'
            - '\psexec.exe'
            - '\paexec.exe'
    selection_wmi:
        ParentImage|endswith: '\WmiPrvSE.exe'
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\rundll32.exe'
            - '\wscript.exe'
    selection_admin_share:
        CommandLine|contains:
            - '\\ADMIN$\'
            - '\\IPC$'
    condition: selection_psexec or selection_wmi or selection_admin_share
falsepositives:
    - Enterprise management tools (SCCM, PDQ); correlate with approved deployment accounts
level: high
tags:
    - attack.lateral_movement
    - attack.t1021.002
    - attack.t1047
    - attack.t1569.002
---
title: N0N Ransomware - Pre-Encryption Staging Shadow Copy Deletion and Mass Data Access
id: 9c5f3e4a-bd6f-6a0c-d3e8-4f7b0c1a5e93
status: experimental
description: Detects Volume Shadow Copy deletion, backup catalog tampering, and boot configuration changes that precede N0N encryption detonation. Dwell-time hunts should treat these as T-minus indicators.
author: Security Arsenal Threat Intelligence
date: 2026/09/19
references:
    - https://securityarsenal.com/darkside
logsource:
    category: process_creation
    product: windows
detection:
    selection_vss:
        CommandLine|contains:
            - 'vssadmin delete shadows'
            - 'vssadmin Delete Shadows'
            - 'wmic shadowcopy delete'
            - 'Delete Shadows /all'
    selection_bcdedit:
        CommandLine|contains:
            - 'bcdedit'
            - 'recoveryenabled no'
            - 'ignoreallfailures'
    selection_wbadmin:
        CommandLine|contains:
            - 'wbadmin delete catalog'
            - 'wbadmin delete backup'
    condition: selection_vss or selection_bcdedit or selection_wbadmin
falsepositives:
    - Backup maintenance scripts; verify caller identity and change windows
level: critical
tags:
    - attack.impact
    - attack.t1490
    - attack.defense_evasion
---

KQL — Microsoft Sentinel Hunt Query

Hunts the 48–72 hour pre-detonation window: new remote sessions, unusual admin-share access, mass file enumeration, and staging directory creation clustered on a single host — the behavioral signature of an affiliate preparing exfiltration and encryption.

// N0N pre-ransomware staging hunt — correlate lateral movement + data staging on single hosts
// Lookback: 7 days (matches assessed dwell-time window)
let lookback = 7d;
let suspiciousProcs = dynamic(["psexec.exe","psexesvc.exe","wmic.exe","vssadmin.exe","wbadmin.exe","rclone.exe","megasync.exe","7z.exe","winrar.exe","nltest.exe","adfind.exe","sharpview.exe"]);
let procEvents =
    DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where FileName in~ (suspiciousProcs)
    | summarize ProcHits = count(), Procs = make_set(FileName), FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
        by DeviceName, InitiatingProcessAccountName;
let netEvents =
    DeviceNetworkEvents
    | where Timestamp > ago(lookback)
    | where RemotePort in (445, 135, 3389)
    | summarize SmbRdpConns = count(), Targets = make_set(RemoteIP) by DeviceName, InitiatingProcessAccountName;
let fileStage =
    DeviceFileEvents
    | where Timestamp > ago(lookback)
    | where FolderPath has_any ("\\staging", "\\exfil", "\\tmp\\data", "C:\\Users\\Public\\")
    | summarize StagingWrites = count() by DeviceName;
procEvents
| join kind=inner netEvents on DeviceName
| join kind=leftouter fileStage on DeviceName
| where ProcHits >= 2 or SmbRdpConns > 10
| extend RiskScore = ProcHits * 10 + SmbRdpConns + (StagingWrites * 2)
| project DeviceName, InitiatingProcessAccountName, Procs, ProcHits, SmbRdpConns, StagingWrites, RiskScore, FirstSeen, LastSeen
| order by RiskScore desc;

PowerShell — Rapid Triage Script

Run on suspected-beachhead hosts and domain controllers during active N0N response. Checks for exposed RDP, recently created scheduled tasks, shadow copy tampering, and suspicious services installed in the last 7 days.

# Security Arsenal - N0N Rapid Triage (run elevated)
$days = 7; $since = (Get-Date).AddDays(-$days)
Write-Host "=== N0N RAPID TRIAGE :: $env:COMPUTERNAME ===" -ForegroundColor Cyan

Write-Host "`n[1] RDP exposure check" -ForegroundColor Yellow
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue
if ($rdp.fDenyTSConnections -eq 0) { Write-Host "  [!] RDP ENABLED - verify NLA and source restrictions" -ForegroundColor Red }
Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue | Select-Object LocalAddress, OwningProcess | Format-Table

Write-Host "`n[2] Scheduled tasks created in last $days days" -ForegroundColor Yellow
Get-ScheduledTask | Where-Object { $_.Date -gt $since } |
  Select-Object TaskName, TaskPath, Date, @{N='Action';E={$_.Actions.Execute}} | Format-Table -AutoSize

Write-Host "`n[3] Volume Shadow Copies (absence = possible deletion)" -ForegroundColor Yellow
$shadows = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) { Write-Host "  [!!!] NO SHADOW COPIES FOUND - investigate vssadmin/wmic deletion events" -ForegroundColor Red }
else { $shadows | Select-Object InstallDate, DeviceObject | Format-Table }

Write-Host "`n[4] Services installed in last $days days" -ForegroundColor Yellow
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=$since} -ErrorAction SilentlyContinue |
  Select-Object TimeCreated, @{N='Service';E={$_.Properties[0].Value}}, @{N='Binary';E={$_.Properties[1].Value}} | Format-Table -AutoSize

Write-Host "`n[5] Suspicious binaries in user-writable paths" -ForegroundColor Yellow
Get-ChildItem 'C:\Users\Public','C:\ProgramData' -Recurse -Include *.exe,*.dll,*.ps1 -ErrorAction SilentlyContinue |
  Where-Object { $_.LastWriteTime -gt $since } | Select-Object FullName, LastWriteTime | Format-Table -AutoSize
Write-Host "`n=== TRIAGE COMPLETE ===" -ForegroundColor Cyan

Incident Response Priorities

T-Minus Detection Checklist (Before Encryption Fires)

1. vssadmin / wmic / bcdedit execution on servers — the single highest-fidelity pre-detonation signal
2. Rclone, MEGAsync, or large 7z/RAR archive creation in user-writable paths — exfil staging
3. PsExec service (Event 7045) creation on multiple hosts within minutes — lateral spread in progress
4. New domain admin / enterprise admin group additions outside change windows
5. vCenter or firewall management logins from non-admin subnets — edge foothold pivoting inward
6. EDR tampering events — sensor service stop attempts, exclusion additions

Critical Assets This Operation Prioritizes for Exfiltration

• Customer/payment data (financial victims: STOKR, Transcom/PayPal ops) — cardholder-adjacent and transaction records maximize regulatory pressure
• Citizen/student PII (ministry, teachers' union, education centers) — public-sector breach-notification leverage
• Subscriber and network data (ISP victim) — routing tables, subscriber databases
• HR, payroll, and legal files — universal pressure material across all victims

Containment Actions — Ordered by Urgency

1. Isolate affected VLANs/hosts at the switch level — do not rely solely on EDR isolation; assume tampering
2. Disable and reissue all VPN and edge-device credentials; force MFA re-enrollment; revoke active sessions
3. Block outbound traffic to known exfil endpoints (rclone remotes, MEGA, anonymous file shares) at the proxy
4. Snapshot/preserve vCenter and firewall management logs before reboot — affiliates routinely clear them
5. Freeze new admin account creation and GPO changes via privileged access workflow lockdown
6. Engage IR retainer and legal/comms early — batch-posted victims face coordinated countdown pressure

Hardening Recommendations

Immediate (24 hours)

• Verify patch status on all five KEV CVEs above — especially CVE-2026-59310 (vCenter) and CVE-2026-50751 (Check Point). If unpatched and internet-facing, take the management interface offline now
• Disable IKEv1 on Check Point gateways where not operationally required
• Audit RMM tooling: inventory every remote access agent; remove unauthorized instances; alert on new agent installs
• Enforce phishing-resistant MFA (FIDO2) on VPN, vCenter, and all remote access — IAB-purchased credentials are worthless against it
• Deploy the Sigma rules above and run the KQL hunt across the last 14 days
• Verify backup integrity and offline/immutable copies — assume shadow copies will be deleted

Short-Term (2 weeks)

• Segment vCenter and hypervisor management onto a dedicated, jump-host-gated network with no direct internet path
• Implement egress filtering with TLS inspection on server VLANs; servers should not reach arbitrary file-sharing services
• Deploy application allowlisting on servers (WDAC/AppLocker) to block PsExec-class tooling and unauthorized archivers
• Stand up honey credentials and canary file shares — early tripwires for enumeration and staging behavior
• Review third-party/BPO access pathways — the Transcom victim underscores that outsourcer compromise is a route into your brand
• Tabletop the batch-extortion scenario: simultaneous leak-site naming, media outreach, and countdown timers

Security Arsenal continues to monitor the N0N leak site. Organizations named in this batch should assume data exfiltration has already occurred and engage incident response immediately. Confidence in future posting waves: HIGH.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub