N0N Ransomware: 23 Leak-Site Listings — Sector Targeting Analysis & Detection Rules

Classification: TLP:CLEAR | Publication Date: 2026-10-23 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

Executive Summary

N0N has listed 23 organizations or unnamed placeholders across its recent leak-site activity, with 19 listings independently observed by a second crawler and 4 seen on a single source only. The named entries visible in the current pull are Performance Ford Inc, Heritage Senior Living, Hanjin Information Systems & Telecommunication Co., Ltd., and TheHomeMag NorCal, alongside numbered entries such as Company #99 through Company #109. These are threat-actor claims, not confirmed breaches. Sector tags cluster around Retail & E-Commerce, Healthcare, Technology, and a large Not Found bucket; country tags include US, BG, KR, PT, ET, TN, TT, and CH. Defenders in healthcare, retail/e-commerce, technology, automotive retail, senior care, and Korean telecom/IT supply chains should prioritize edge-access review, RDP/VPN authentication telemetry, lateral movement detection, data staging discovery, and exfiltration controls.

Sourcing & Verification

Nineteen of 23 listings were independently observed by a second leak-site crawler; four listings appear on a single source only. Inclusion reflects N0N's claim and is not confirmation that any named organization was breached, attacked, hit, or is managing an active incident. A named organization may dispute a listing, and a denial is likewise not proof the claim is false: disclosure obligations vary by jurisdiction and sector, and not every incident is reportable, so neither silence nor denial settles the question. Security Arsenal will publish corrections and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

Publicly verifiable detail on N0N remains limited in the provided dataset, so this profile separates observed leak-site behavior from hypothesis. Known aliases: none are reliably established in the current pull. Operating model: the presence of a dedicated leak site, numbered placeholder entries, and batch publication is consistent with either a closed crew or a compact RaaS/affiliate program, but the dataset does not prove which. Typical ransom demands: not present in the feed; do not infer amounts. Likely initial access methods, framed as sector-level hypothesis rather than victim-specific attribution: phishing with macro or script execution, exposed or weakly authenticated RDP, VPN/edge appliance exploitation, remote services misconfiguration, and abuse of vulnerable management planes. Extortion approach: the leak-site model implies double extortion, meaning claimed theft plus threatened publication even where encryption is not confirmed. Average dwell time: not evidenced here; enterprise planning should assume hands-on-keyboard operators may stage for days to weeks before detonation or publication.

Current Campaign Analysis

Sectors being targeted, based strictly on the listing tags: Retail & E-Commerce appears through Performance Ford Inc and TheHomeMag NorCal; Healthcare appears through Heritage Senior Living; Technology appears through Hanjin Information Systems & Telecommunication Co., Ltd.; the repeated Company # entries are tagged Not Found and should be treated as unclassified rather than assigned to a sector. Geographic concentration: named listings skew US, with additional country tags for BG, KR, and PT; the broader targeted-country set also includes ET, TN, TT, and CH, but several listings lack country resolution. Victim profile: the visible named set suggests small-to-mid-market and regional organizations rather than only global enterprises, but the feed contains no reliable revenue or employee-count fields, so revenue estimates would be speculative. Posting frequency and escalation: 15 of the visible entries were published on 2026-10-21 and 2026-10-22, inside a recent-100 window containing 23 postings, indicating batching and possible pressure to inflate perceived operational tempo. CVE linkage: no evidence ties CVE-2026-59310, CVE-2026-63077, CVE-2026-20316, CVE-2026-50751, or CVE-2026-48027 to any named listing. Treat them as exposed-sector hypotheses: vCenter and TeamCity for technology and managed build environments, Cisco FMC and Check Point gateway for edge access, and Nx Console for developer workstation/supply-chain risk.

Detection Engineering

The following rules emphasize pre-encryption behavior: password guessing against remote access, suspicious service creation or remote execution, and destructive anti-recovery actions that often precede ransomware impact.

---
title: N0N Hunt - RDP or SMB Password Spraying Followed by Admin Logon
id: 6e2a7f0e-6b4d-4d22-9f2e-n0nrdp0001
status: experimental
description: Detects bursts of failed logons followed by a successful interactive or network logon on the same host, consistent with RDP brute force or password spraying before ransomware staging.
author: Security Arsenal
date: 2026/10/23
logsource:
  product: windows
  service: security
level: high
detection:
  failed:
    EventID: 4625
  success:
    EventID: 4624
    LogonType:
      - 3
      - 10
  timeframe: 15m
  condition: failed and success
  aggregation:
    - by: TargetComputerName
      count: failed >= 10
falsepositives:
  - vulnerability scanners
  - misconfigured service accounts
references:
  - https://attack.mitre.org/techniques/T1110/
  - https://attack.mitre.org/techniques/T1021/001/
tags:
  - attack.t1110
  - attack.t1021.001
  - n0n
---
title: N0N Hunt - PsExec WMI or Remote Service Creation for Lateral Movement
id: 7b3c8a1f-2e77-4f10-a911-n0nlat0002
status: experimental
description: Detects remote execution tooling and service installation patterns frequently used before enterprise-wide encryption, including PsExec-like services, WMI process creation, and ADMIN$ style deployment.
author: Security Arsenal
date: 2026/10/23
logsource:
  product: windows
  service: security
level: critical
detection:
  service_install:
    EventID: 7045
    ServiceFileName|contains:
      - 'psexec'
      - 'paexec'
      - 'remcom'
      - 'ADMIN$'
      - '\\'
  process_create:
    EventID: 4688
    CommandLine|contains:
      - 'wmic process call create'
      - 'powershell -enc'
      - 'rundll32'
      - 'regsvr32'
      - 'msiexec /i'
  condition: service_install or process_create
falsepositives:
  - legitimate software deployment
  - EDR and IT administration tools
references:
  - https://attack.mitre.org/techniques/T1021/002/
  - https://attack.mitre.org/techniques/T1047/
  - https://attack.mitre.org/techniques/T1569/002/
tags:
  - attack.t1021.002
  - attack.t1047
  - attack.t1569.002
  - n0n
---
title: N0N Hunt - Shadow Copy Deletion and Backup Interference Before Encryption
id: 91dd44c2-9ac1-44cb-bf01-n0nimp0003
status: experimental
description: Detects attempts to delete Volume Shadow Copies, disable recovery, stop backup services, or clear logs shortly before ransomware impact.
author: Security Arsenal
date: 2026/10/23
logsource:
  product: windows
  service: security
level: critical
detection:
  commandline:
    EventID: 4688
    CommandLine|contains:
      - 'vssadmin delete shadows'
      - 'vssadmin resize shadowstorage'
      - 'wbadmin delete catalog'
      - 'bcdedit /set {default} recoveryenabled no'
      - 'bcdedit /set {default} bootstatuspolicy ignoreallfailures'
      - 'wevtutil cl'
      - 'net stop' 
  powershell:
    EventID: 4104
    ScriptBlockText|contains:
      - 'DeleteShadows'
      - 'Win32_ShadowCopy'
      - 'Stop-Service'
      - 'Clear-EventLog'
  condition: commandline or powershell
falsepositives:
  - backup maintenance windows
  - administrator cleanup scripts
references:
  - https://attack.mitre.org/techniques/T1490/
  - https://attack.mitre.org/techniques/T1070/001/
tags:
  - attack.t1490
  - attack.t1070.001
  - n0n

Use this Microsoft Sentinel hunt to find a compact pre-ransom sequence: repeated remote logon failure, success from an unusual source, remote execution artifact, backup interference, then outbound transfer.

let lookback = 14d;
let fail = SecurityEvent
| where TimeGenerated >= ago(lookback)
| where EventID == 4625
| summarize FailedCount=count(), FailedSources=make_set(IpAddress) by Computer, bin(TimeGenerated, 15m)
| where FailedCount >= 10;
let success = SecurityEvent
| where TimeGenerated >= ago(lookback)
| where EventID == 4624 and LogonType in ('3','10')
| project SuccessTime=TimeGenerated, Computer, Account, IpAddress, LogonType;
let exec = union isfuzzy=true
  (SecurityEvent | where EventID == 7045 | extend Evidence=ServiceFileName, Kind='ServiceInstall'),
  (SecurityEvent | where EventID == 4688 | extend Evidence=CommandLine, Kind='ProcessCreate'),
  (DeviceProcessEvents | where TimeGenerated >= ago(lookback) | extend Evidence=ProcessCommandLine, Kind='MDEProcess', Computer=DeviceName, SuccessTime=TimeGenerated)
| where Evidence has_any ('psexec','wmic process call create','vssadmin delete shadows','wbadmin delete catalog','bcdedit','wevtutil cl','rundll32','regsvr32','powershell -enc','ADMIN$');
fail
| join kind=inner success on Computer
| where SuccessTime between (TimeGenerated .. TimeGenerated + 2h)
| join kind=inner exec on Computer
| where SuccessTime between (SuccessTime .. SuccessTime + 4h)
| summarize FirstFail=min(TimeGenerated), FirstSuccess=min(SuccessTime), Artifacts=make_set(Evidence), Kinds=make_set(Kind), Sources=make_set(IpAddress) by Computer, Account
| extend RiskScore = array_length(Artifacts) + FailedCount
| order by RiskScore desc;

Rapid triage script for exposed RDP, new persistence, shadow-copy health, suspicious recent binaries, and large outbound listeners. Run from an elevated PowerShell session and export for the IR bridge.

$out = Join-Path $env:TEMP ('n0n_triage_' + (Get-Date -Format 'yyyyMMdd_HHmmss') + '.txt')
'== N0N rapid triage ==' | Out-File $out
'== RDP state ==' | Out-File $out -Append
Get-ItemProperty 'HKLM:/System/CurrentControlSet/Control/Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue | Out-File $out -Append
Get-NetTCPConnection -LocalPort 3389 -ErrorAction SilentlyContinue | Select-Object State,LocalAddress,LocalPort,RemoteAddress,RemotePort,OwningProcess | Out-File $out -Append
'== Scheduled tasks created or changed in last 7 days ==' | Out-File $out -Append
Get-ScheduledTask | Where-Object {$_.Date -gt (Get-Date).AddDays(-7)} | Select-Object TaskName,TaskPath,Date,Author | Out-File $out -Append
'== Services created recently ==' | Out-File $out -Append
Get-CimInstance Win32_Service | Where-Object {$_.InstallDate -gt (Get-Date).AddDays(-7)} | Select-Object Name,DisplayName,PathName,StartMode,State,InstallDate | Out-File $out -Append
'== Shadow copies ==' | Out-File $out -Append
vssadmin list shadows 2>&1 | Out-File $out -Append
'== Recent executables in user-writable paths ==' | Out-File $out -Append
$paths = @($env:APPDATA,$env:LOCALAPPDATA,$env:ProgramData,$env:TEMP)
Get-ChildItem $paths -Recurse -Include *.exe,*.dll,*.ps1,*.bat,*.js,*.vbs -ErrorAction SilentlyContinue | Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-7)} | Select-Object FullName,Length,CreationTime,LastWriteTime | Sort-Object LastWriteTime -Descending | Select-Object -First 200 | Out-File $out -Append
'== Large outbound connections by process ==' | Out-File $out -Append
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | Where-Object {$_.RemoteAddress -notmatch '^(10\.|172\.|192\.168\.|127\.)'} | Group-Object OwningProcess | Sort-Object Count -Descending | Select-Object Name,Count -First 50 | Out-File $out -Append
Write-Output $out

Incident Response Priorities

T-minus detection checklist, before encryption fires: confirm impossible-travel or brute-force success against VPN/RDP; isolate hosts with new services, PsExec-like binaries, WMI process creation, encoded PowerShell, or suspicious rundll32/regsvr32 execution; alert on vssadmin, wbadmin, bcdedit, wevtutil, backup service stops, and mass file rename entropy; watch for archive utilities in user-writable paths; flag cloud sync clients, Rclone-like tools, FTP/SFTP bursts, and large egress to rare ASNs; verify EDR tamper attempts and new local admin creation. Critical assets this playbook typically pressures first: domain controllers, backup servers and Veeam repositories, file shares with PHI/PII and payment-adjacent data, EHR or care-management exports in healthcare, e-commerce order/customer databases in retail, build servers and source repositories in technology, and virtualization management planes such as vCenter. Containment ordered by urgency: 1) disable compromised accounts and revoke sessions/tokens; 2) isolate affected VLANs and block outbound egress except approved IR channels; 3) protect backups by taking repositories offline or immutable where possible; 4) reset exposed VPN, RDP, service, and local admin credentials in a controlled sequence; 5) preserve memory, logs, prefetch, USN journal, $MFT, and EDR telemetry before reimage; 6) only after evidence capture, rebuild from known-good media and validate restoration integrity.

Hardening Recommendations

Immediate, 24 hours: enforce phishing-resistant MFA on VPN, RDP gateways, SSO, email, and privileged remote tools; block direct RDP from the internet and place admin access behind a broker with just-in-time approval; patch or mitigate edge and management exposure represented by CISA KEV items CVE-2026-50751, CVE-2026-20316, CVE-2026-59310, CVE-2026-63077, and CVE-2026-48027, prioritizing internet-facing Check Point, Cisco FMC, vCenter, TeamCity, and developer endpoints; disable Office macros from the internet and enable ASR rules; alert on shadow-copy deletion, backup catalog deletion, bcdedit recovery changes, and event-log clearing; restrict PsExec, WMI, WinRM, and SMB admin shares to a small admin tier; turn on tamper protection and isolate backup credentials from domain admin. Short term, two weeks: implement tiered administration with dedicated PAWs, remove standing Domain Admin use, and require ephemeral admin credentials; segment healthcare, retail POS/e-commerce, build systems, backups, and virtualization management into separate trust zones; deploy egress filtering with TLS inspection where lawful and baseline rare-destination transfers; make backups immutable with offline copies and test restore under time pressure; centralize logs for VPN, firewall, EDR, DHCP, DNS, identity, backup, hypervisor, and CI/CD into Sentinel with at least 90 days hot retention; create ransomware playbooks that assume extortion-only claims may precede or replace encryption.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub