N0N Ransomware Gang: 10 Victims Posted in Single-Day Surge — Sector Targeting Analysis & Detection Engineering

---
title: Edge Device Exploitation - Suspicious Child Process from VPN/Firewall/vCenter Services
id: 9f1a2c4e-7b3d-4e5a-a1c2-n0nedgedev01
status: experimental
description: Detects shell or script interpreter execution as a child of VPN concentrator, firewall management, or VMware vCenter service processes. Consistent with post-exploitation following CVE-2026-50751 (Check Point IKEv1), CVE-2026-20316 (Cisco FMC), or CVE-2026-59310 (vCenter path traversal) as observed in N0N-style edge-device intrusions.
author: Security Arsenal Threat Intelligence
date: 2026/09/20
references:
    - https://securityarsenal.com/darkside
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: process_creation
    product: windows
    service: sysmon
detection:
    selection_parent:
        ParentImage|contains:
            - '\vpxd'
            - '\vmware-vmon'
            - '\httpd.exe'              # vCenter / FMC web services
            - '\tomcat'
            - '\cpd.exe'                # Check Point daemon proxy on Windows mgmt
            - '\ScreenConnect.'         # CVE-2024-1708 post-exploitation
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\rundll32.exe'
            - '\bash.exe'
            - '\sh.exe'
    filter_known_good:
        CommandLine|contains:
            - 'vmware-vmon --restart'
            - 'ScreenConnect.ClientService'
    condition: selection_parent and selection_child and not filter_known_good
falsepositives:
    - Legitimate vCenter or ScreenConnect administrative scripts (rare; baseline per host)
level: high
tags:
    - attack.initial_access
    - attack.t1190
    - attack.t1059
---
title: Ransomware Lateral Movement - PsExec or Remote Service Creation via ADMIN$
id: 9f1a2c4e-7b3d-4e5a-a1c2-n0nlatmov02
status: experimental
description: Detects PsExec-style lateral movement and remote service installation via ADMIN$ shares, a hallmark of N0N-affiliate playbook execution during pre-encryption spread. Covers PsExec, RemCom-style clones, and smbexec patterns.
author: Security Arsenal Threat Intelligence
date: 2026/09/20
references:
    - https://securityarsenal.com/darkside
logsource:
    category: process_creation
    product: windows
    service: sysmon
detection:
    selection_psexec:
        Image|endswith:
            - '\psexec.exe'
            - '\psexesvc.exe'
            - '\paexec.exe'
            - '\remcom.exe'
            - '\csexec.exe'
    selection_service_exec:
        CommandLine|contains:
            - 'ADMIN$\'
            - '\\*\IPC$'
    selection_suspicious_svc_names:
        CommandLine|contains:
            - 'PSEXESVC'
            - 'RemComSvc'
    condition: selection_psexec or (selection_service_exec and selection_suspicious_svc_names)
falsepositives:
    - Legitimate administrative PsExec use by IT (baseline by source account/host)
    - Some EDR deployment tooling uses similar service patterns
level: high
tags:
    - attack.lateral_movement
    - attack.t1021.002
    - attack.t1569.002
---
title: Pre-Ransomware Staging - Shadow Copy Deletion and Data Staging Indicators
id: 9f1a2c4e-7b3d-4e5a-a1c2-n0nstaging03
status: experimental
description: Detects Volume Shadow Copy deletion, backup catalog tampering, and mass-archive staging via rar/7z with password flags - the final T-minus actions before N0N detonation. Any single hit in a server context warrants immediate IR engagement.
author: Security Arsenal Threat Intelligence
date: 2026/09/20
references:
    - https://securityarsenal.com/darkside
logsource:
    category: process_creation
    product: windows
    service: sysmon
detection:
    selection_vss:
        - CommandLine|contains|all:
            - 'vssadmin'
            - 'delete'
            - 'shadows'
        - CommandLine|contains:
            - 'wmic shadowcopy delete'
            - 'bcdedit'
            - 'wbadmin delete catalog'
            - 'Get-WmiObject Win32_Shadowcopy'
    selection_staging:
        Image|endswith:
            - '\rar.exe'
            - '\7z.exe'
            - '\7za.exe'
            - '\winrar.exe'
        CommandLine|contains:
            - ' -p'                   # password-protected archive flag
    filter_recoverystatus:
        CommandLine|contains:
            - 'recoveryenabled'        # bcdedit tuning alone is not staging
    condition: (selection_vss and not filter_recoverystatus) or selection_staging
falsepositives:
    - Legitimate backup maintenance (rarely uses vssadmin delete interactively)
    - Software packaging with 7z (filter by service accounts/approved paths)
level: critical
tags:
    - attack.impact
    - attack.t1490
    - attack.t1560.001
    - attack.exfiltration

// N0N-Style Pre-Ransomware Hunt: Lateral Movement + Staging Correlation
// Microsoft Sentinel / Defender XDR — run over last 14 days
// Logic: find hosts exhibiting BOTH remote-execution artifacts AND
// staging/exfil tooling within a 24h window (affiliate T-minus pattern).

let Lookback = 14d;
let Window = 24h;

// Signal 1: Remote execution / lateral movement artifacts
let LateralMovement =
    DeviceProcessEvents
    | where Timestamp >= ago(Lookback)
    | where FileName in~ ("psexec.exe","psexesvc.exe","paexec.exe","remcom.exe","wmiprvse.exe","wsmprovhost.exe")
       or (ProcessCommandLine has_any ("ADMIN$", "PSEXESVC", "\\IPC$"))
    | project LateralTime = Timestamp, DeviceName, LateralProc = FileName,
              LateralCmd = ProcessCommandLine, InitiatingAccount = InitiatingProcessAccountName;

// Signal 2: Staging & anti-recovery tooling
let Staging =
    DeviceProcessEvents
    | where Timestamp >= ago(Lookback)
    | where (FileName in~ ("rar.exe","7z.exe","7za.exe","winrar.exe","mega.exe","rclone.exe")
             and ProcessCommandLine has_any (" -p", "--password", "copy", "sync", "move"))
       or ProcessCommandLine has_any ("vssadmin delete shadows", "wmic shadowcopy delete",
                                      "wbadmin delete catalog", "bcdedit")
    | project StageTime = Timestamp, DeviceName, StageProc = FileName,
              StageCmd = ProcessCommandLine, StageAccount = InitiatingProcessAccountName;

// Signal 3: Edge-device compromise indicators on the same estate (VPN/FMC/vCenter shells)
let EdgeShells =
    DeviceProcessEvents
    | where Timestamp >= ago(Lookback)
    | where InitiatingProcessFileName has_any ("vpxd","httpd","tomcat","ScreenConnect")
       and FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","rundll32.exe")
    | project EdgeTime = Timestamp, DeviceName, EdgeParent = InitiatingProcessFileName, EdgeCmd = ProcessCommandLine;

// Correlate: same device, staging within 24h of lateral movement
LateralMovement
| join kind=inner Staging on DeviceName
| where StageTime between (LateralTime .. (LateralTime + Window))
| extend TimeToStage = datetime_diff("minute", StageTime, LateralTime)
| join kind=leftouter EdgeShells on DeviceName
| summarize
    LateralTools = make_set(LateralProc),
    StagingTools = make_set(StageProc),
    FirstLateral = min(LateralTime),
    FirstStaging = min(StageTime),
    EdgeDeviceParent = make_set(EdgeParent)
  by DeviceName, InitiatingAccount
| extend RiskScore = iff(isnotempty(EdgeDeviceParent), "CRITICAL - edge-origin", "HIGH")
| order by FirstLateral asc;

<#
.SYNOPSIS
    Rapid-response hunt script: N0N-style pre-ransomware indicators
.DESCRIPTION
    Checks for (1) exposed RDP, (2) scheduled tasks created in the last 7 days,
    (3) deleted shadow copies, (4) suspicious archive/exfil tooling, and
    (5) recently added local admins. Run elevated. Outputs to console + CSV.
#>

$report = @()
$cutoff = (Get-Date).AddDays(-7)

Write-Host "=== N0N Rapid Response Hunt - $(Get-Date) ===" -ForegroundColor Cyan

# 1. RDP exposure check
$rdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$nlaEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -ErrorAction SilentlyContinue).UserAuthentication
$report += [pscustomobject]@{Check='RDP Enabled'; Result=$rdpEnabled; Detail="NLA=$nlaEnabled (NLA disabled = brute-force exposure)"}

# 2. Scheduled tasks created in last 7 days
$susTasks = Get-ScheduledTask | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    $reg = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\$($_.TaskName)" -ErrorAction SilentlyContinue
    [pscustomobject]@{ Name=$_.TaskName; Path=$_.TaskPath; Author=$_.Author; LastRun=$info.LastRunTime }
} | Where-Object { $_.Name -match 'update|svc|system|win|sync' -and $_.Path -notmatch 'Microsoft' }
if ($susTasks) { $report += [pscustomobject]@{Check='Suspicious Scheduled Tasks'; Result=$true; Detail=($susTasks.Name -join '; ')} }

# 3. Shadow copy status (detonation prep indicator)
$shadows = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue
$report += [pscustomobject]@{Check='Shadow Copies Present'; Result=[bool]$shadows; Detail="Count: $(@($shadows).Count) - ZERO on a server is a red flag"}

# 4. Staging/exfil tooling in user-writable paths
$tools = Get-ChildItem -Path "$env:SystemDrive\Users","$env:TEMP" -Recurse -Include rar.exe,7z.exe,7za.exe,rclone.exe,mega.exe,winscp.exe -ErrorAction SilentlyContinue |
         Where-Object { $_.LastWriteTime -gt $cutoff }
if ($tools) { $report += [pscustomobject]@{Check='Staging Tools (last 7d)'; Result=$true; Detail=($tools.FullName -join '; ')} }

# 5. New local admins
$admins = Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue
$report += [pscustomobject]@{Check='Local Administrators'; Result=$true; Detail=($admins.Name -join '; ')}

# 6. Recent successful RDP logons (Event 4624 Type 10)
$rdpLogons = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=$cutoff} -ErrorAction SilentlyContinue |
             Where-Object { $_.Message -match 'Logon Type:\s+10' } |
             Select-Object -First 20 TimeCreated, Message
$report += [pscustomobject]@{Check='RDP Logons (last 7d)'; Result=[bool]$rdpLogons; Detail="$(@($rdpLogons).Count) interactive RDP sessions detected"}

$report | Format-Table -AutoSize
$report | Export-Csv -Path ".\N0N_RapidHunt_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation
Write-Host "Report exported. If any staging/shadow-copy flags are TRUE -> invoke IR plan NOW." -ForegroundColor Yellow