N0N Ransomware Gang: 11 New Victims Posted — Sector Targeting Analysis & Detection Rules | Security Arsenal

Briefing date: 2026-09-20
Source: ransomware.live aggregation of N0N .onion leak site postings; CISA KEV for exploited CVE context
Confidence: Moderate on observed victims; low-to-moderate on actor internals because public reporting on N0N remains limited and leak-site claims are not independently verified.

Executive Assessment

N0N's leak site showed a concentrated posting burst: 11 victims across 8 countries and 8 sectors, with the most recent observed publication on 2026-09-20 and a cluster posted 2026-09-18. The victim mix spans high-value commerce and financial brands, public-sector education, healthcare/pharma, telecommunications, legal services, and a betting operator. This pattern is consistent with opportunistic double-extortion operations that prioritize data theft leverage, rapid public naming, and broad sector coverage rather than a single vertical campaign.

Security teams in Retail & E-Commerce, Financial Services, Technology/ISP, Government & Defense, Healthcare, Professional Services, and Education should treat this as an active warning: audit edge exposure, hunt for pre-ransomware staging, validate backup isolation, and confirm that KEV-listed edge products are patched or mitigated.

Threat Actor Profile — N0N

Aliases: No widely corroborated aliases are confirmed in the provided dataset. Treat N0N as the primary leak-site brand until clustering proves otherwise.
Model: Assessed closed or semi-closed ransomware/extortion operation. There is no reliable evidence in the supplied data of a mature public RaaS affiliate program, but the victim breadth suggests either multiple operators, purchased access, or broker-driven intrusions.
Ransom demands: Not disclosed in the provided data. Comparable multi-sector extortion crews commonly calibrate demands to perceived revenue, cyber-insurance limits, regulatory exposure, and sensitivity of stolen data. Expect six-to-seven figure USD demands for large enterprises and lower demands for regional entities; do not treat this as verified N0N-specific pricing.
Initial access methods: Likely mix of edge-device exploitation, exposed remote access, phishing-led credential theft, and access-broker procurement. The adjacent KEV set points to perimeter and management-plane weaknesses: VMware vCenter path traversal, Cisco FMC hard-coded password, Check Point IKEv1 improper authentication, malicious Nx Console package exposure, and ConnectWise ScreenConnect path traversal.
Extortion approach: Double extortion is likely: public leak-site naming plus threatened or actual data publication. Sector mix implies interest in regulated PII, payment-adjacent operations, student/staff records, patient or trial-adjacent data, legal case files, and financial deal documents.
Dwell time: Not directly observable from leak posts. For comparable campaigns, assume days to weeks from access to encryption, with a shorter window from data staging to public naming. Use a hunting assumption of 3-21 days, not a fixed attribution claim.

Current Campaign Analysis

Sectors targeted

Observed victim sectors: Retail & E-Commerce; Technology; Financial Services; Government & Defense; Healthcare; Professional Services; Education; Other. This is a broad opportunistic spread rather than a narrow vertical. The presence of Fanatics, PayPal support operations via Transcom WorldWide, Argentem Creek Partners, STOKR, AstraZeneca Türkiye, Inter, Ministry of Education Argentina, United Federation of Teachers, and Vietnamese education/betting entities indicates N0N is selecting victims where downtime, confidentiality, and regulatory pressure create negotiation leverage.

Geographic concentration

Countries observed: US, VE, SE, AR, TR, LU, BR, VN. The United States appears repeatedly, but Latin America, Europe, and Vietnam are also represented. This argues against a single-region access vector and supports either globally sprayed edge exploitation or multiple access sources.

Victim profile

The set ranges from global enterprises and major service providers to regional government, education, legal, investment, and gambling-adjacent organizations. Estimated revenue/exposure bands are mixed: large global brands and financial platforms may exceed hundreds of millions to billions USD in revenue or assets under management, while education, legal services, and regional providers are smaller but still sensitive due to personal data and operational dependence.

Posting frequency / escalation

A burst of 10 postings on 2026-09-18 followed by Fanatics on 2026-09-20 suggests batch disclosure after a collection/negotiation window. Watch for follow-on dumps, proof-pack releases, re-posting of non-payers, and recycled victim claims.

CVE linkage as initial access

No provided evidence proves each victim was entered via these CVEs. However, the listed KEV items are plausible initial-access or persistence enablers and should be treated as priority exposure checks:

CVE-2026-59310 VMware vCenter path traversal — virtualization control-plane risk; can accelerate domain-wide blast radius.
CVE-2026-20316 Cisco Secure FMC hard-coded password — management plane compromise of firewall estate.
CVE-2026-50751 Check Point IKEv1 improper authentication — VPN edge access risk.
CVE-2026-48027 Nx Console embedded malicious code — developer workstation/supply-chain path into source and CI/CD.
CVE-2024-1708 ConnectWise ScreenConnect path traversal — RMM abuse for rapid execution and lateral movement.

Priority hypothesis: edge VPN/firewall or virtualization management compromise, followed by credential theft, RMM/remote tooling, staging, exfiltration, then encryption and leak posting.

Detection Engineering

YAML

---
title: N0N Campaign - Edge VPN Or Management Plane Exploitation Followed By Suspicious Logon
id: 9f2a7d10-6d6a-4f6a-9a10-n0nedge001
status: experimental
description: Detects suspicious authentication or process execution after edge VPN, firewall management, virtualization management, or RMM exposure relevant to N0N campaign hypotheses.
author: Security Arsenal
references:
  - https://securityarsenal.com/darkside
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
date: 2026/09/20
modified: 2026/09/20
logsource:
  category: authentication
  product: windows
detection:
  selection_remote:
    EventID:
      - 4624
      - 4625
    LogonType:
      - 3
      - 10
  selection_src:
    IpAddress|contains:
      - '10.'
      - '172.'
      - '192.168.'
  filter_admin_success:
    EventID: 4624
    TargetUserName|contains:
      - 'admin'
      - 'svc'
  condition: selection_remote and selection_src and not filter_admin_success
falsepositives:
  - Managed service provider access
  - Approved jump hosts
level: medium
---
title: N0N Campaign - PsExec WMI Or RMM Style Remote Service Creation
id: 1d7aa210-9ba6-4c7d-9b20-n0nlat002
status: experimental
description: Detects remote service creation and admin share execution consistent with PsExec, WMI, ScreenConnect abuse, or ransomware staging tool deployment.
author: Security Arsenal
references:
  - https://securityarsenal.com/darkside
date: 2026/09/20
modified: 2026/09/20
logsource:
  product: windows
  service: system
detection:
  selection_service:
    EventID: 7045
  selection_names:
    ServiceName|contains:
      - 'PSEXESVC'
      - 'ScreenConnect'
      - 'ConnectWise'
      - 'paexec'
      - 'remcom'
  selection_path:
    ImagePath|contains:
      - '\ADMIN$'
      - '\IPC$'
      - '\Temp\'
      - '\ProgramData\'
  condition: selection_service and (selection_names or selection_path)
falsepositives:
  - Enterprise software distribution
  - Approved RMM agents
level: high
---
title: N0N Campaign - Pre Encryption Staging Compression Exfil And Shadow Copy Tampering
id: 77c0a910-91fd-4bd9-9c30-n0nstg003
status: experimental
description: Detects compression utilities, archive staging in unusual paths, cloud sync or exfil tools, and Volume Shadow Copy deletion shortly before ransomware detonation.
author: Security Arsenal
references:
  - https://securityarsenal.com/darkside
date: 2026/09/20
modified: 2026/09/20
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\rclone.exe'
      - '\7z.exe'
      - '\winrar.exe'
      - '\rar.exe'
      - '\megasync.exe'
      - '\vssadmin.exe'
      - '\wbadmin.exe'
      - '\bcdedit.exe'
      - '\powershell.exe'
      - '\wmic.exe'
  selection_cmd:
    CommandLine|contains:
      - 'delete shadows'
      - 'resize shadowstorage'
      - 'recoveryenabled no'
      - 'ignoreallfailures'
      - 'copy '
      - 'sync '
      - '--config'
      - '\AppData\Local\Temp\'
      - '\ProgramData\'
  condition: selection_img and selection_cmd
falsepositives:
  - Backup administrators
  - Archival jobs
  - Developer package tooling
level: high

KQL — Microsoft Sentinel / Defender

// N0N campaign hypothesis: hunt for pre-ransomware staging, remote execution, edge-sourced logons, and backup tampering in Microsoft Sentinel
let lookback = 14d;
let stagingProc = dynamic(['rclone.exe','7z.exe','winrar.exe','rar.exe','megasync.exe','vssadmin.exe','wbadmin.exe','bcdedit.exe','wmic.exe','psexec.exe','paexec.exe','ScreenConnect.ClientService.exe']);
let suspiciousCmd = dynamic(['delete shadows','resize shadowstorage','recoveryenabled no','ignoreallfailures','\\admin$','\\programdata\\','\\appdata\\local\\temp\\','--config','copy ','sync ']);
union isfuzzy=true
(
  SecurityEvent
  | where TimeGenerated >= ago(lookback)
  | where EventID in (4624,4625,4648,4672,4768,4769,4770,4776)
  | where LogonType in ('3','10') or EventID in (4648,4672)
  | extend EdgeHint = iff(IpAddress matches regex '^(10\.|172\.|192\.168\.)', 'internal-or-vpn', 'external-or-unknown')
  | summarize Logons=count(), Failed=countif(EventID==4625), ExplicitCreds=countif(EventID==4648) by Account, Computer, IpAddress, EdgeHint, bin(TimeGenerated,1h)
),
(
  DeviceProcessEvents
  | where TimeGenerated >= ago(lookback)
  | where FileName in~ (stagingProc) or ProcessCommandLine has_any (suspiciousCmd)
  | extend Tamper = iff(ProcessCommandLine has_any ('delete shadows','resize shadowstorage','recoveryenabled no','ignoreallfailures'), 1, 0)
  | extend Staging = iff(ProcessCommandLine has_any ('rclone','7z ','rar a','winrar','megasync','--config'), 1, 0)
  | summarize ProcCount=count(), TamperHits=sum(Tamper), StagingHits=sum(Staging), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by DeviceName, InitiatingProcessAccountName, FileName, bin(TimeGenerated,1h)
),
(
  DeviceNetworkEvents
  | where TimeGenerated >= ago(lookback)
  | where RemotePort in (3389,5985,5986,445,443,8443,22)
  | where InitiatingProcessFileName in~ (stagingProc) or InitiatingProcessCommandLine has_any (suspiciousCmd)
  | summarize NetEvents=count(), UniqueRemoteIPs=dcount(RemoteIP), Ports=make_set(RemotePort) by DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, bin(TimeGenerated,1h)
)
| order by TimeGenerated desc

PowerShell

# Rapid N0N-campaign readiness check: exposed RDP, recent services/tasks, shadow copies, suspicious staging artifacts
$ErrorActionPreference = 'SilentlyContinue'
$since = (Get-Date).AddDays(-7)
$report = [ordered]@{}
$report.RdpListening = [bool](Get-NetTCPConnection -LocalPort 3389 -State Listen)
$report.SmbListening = [bool](Get-NetTCPConnection -LocalPort 445 -State Listen)
$report.WinRmListening = [bool](Get-NetTCPConnection -LocalPort 5985 -State Listen)
$report.RecentServices = Get-CimInstance Win32_Service | Where-Object { $_.InstallDate -ge $since -or $_.PathName -match 'Temp|ProgramData|AppData|PSEXESVC|ScreenConnect|ConnectWise|rclone|7z|winrar' } | Select-Object Name,DisplayName,State,StartMode,PathName,InstallDate
$report.RecentScheduledTasks = Get-ScheduledTask | Where-Object { $_.Date -ge $since -or $_.TaskPath -match 'Update|Maintenance|OneDrive|Google|MicrosoftEdge' } | Select-Object TaskName,TaskPath,State,Date
$report.ShadowCopies = Get-CimInstance Win32_ShadowCopy | Select-Object ID,InstallDate,VolumeName,DeviceObject
$report.ShadowStorage = (vssadmin list shadowstorage) 2>&1
$report.SuspiciousFiles = Get-ChildItem 'C:\ProgramData','C:\Users\Public','C:\Windows\Temp' -Recurse -Force -ErrorAction SilentlyContinue | Where-Object { $_.LastWriteTime -ge $since -and $_.Extension -in '.exe','.dll','.ps1','.bat','.zip','.7z','.rar' } | Select-Object FullName,Length,LastWriteTime
$report.RecentProcessArtifacts = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=$since} | Select-Object -First 200 TimeCreated,Message
$report | ConvertTo-Json -Depth 5 | Out-File "$env:ProgramData\n0n_rapid_triage_$(Get-Date -Format yyyyMMdd_HHmmss).json"
Write-Output "Wrote triage JSON under $env:ProgramData. Investigate any true RDP exposure, new services/tasks, deleted shadows, or staging archives."

Incident Response Priorities

T-minus detection checklist: before encryption fires

New or abnormal VPN/firewall admin logons, especially outside change windows and from impossible travel or ASNs.
Cisco FMC, Check Point, vCenter, ScreenConnect, or Nx Console compromise indicators: unexpected plugins, unknown admin users, management-plane logins, or package/version anomalies.
Explicit credential use, DCSync behavior, Kerberos anomalies, and sudden privileged group additions.
PsExec/WMI/service creation, ADMIN$ writes, RMM tools outside approved inventory, and unsigned binaries in ProgramData or Temp.
Archive creation bursts, rclone/MEGA/cloud sync configs, large outbound transfers, and access to file shares holding finance, HR, legal, student, patient, or customer data.
vssadmin/wbadmin/bcdedit tampering, backup console logons, snapshot deletion, and EDR isolation attempts.

Critical assets historically prioritized for exfiltration

Identity stores and credential vaults; AD database backups; VPN concentrator configs; firewall and virtualization management backups.
Finance: payment operations support data, wire/ACH documents, investment deal rooms, KYC/AML, banking credentials.
Retail/e-commerce: customer PII, order history, loyalty data, payment-adjacent tokens, support tickets.
Healthcare/pharma: patient records, clinical operations, regional affiliate data, regulated research or quality documents.
Education/government: student records, staff HR, union membership data, ministry communications.
Legal/professional services: case files, contracts, usucapião/property documentation, privileged client work product.

Containment actions ordered by urgency

Isolate affected subnets and disable compromised edge VPN/firewall accounts; block outbound exfil destinations and known RMM infrastructure.
Revoke and rotate exposed credentials, prioritizing domain admin, VPN admin, vCenter, FMC, Check Point, backup, and service accounts.
Preserve memory, EDR telemetry, VPN logs, firewall management logs, vCenter events, and leak-site proof artifacts before remediation overwrites evidence.
Disable suspect RMM/ScreenConnect instances and quarantine developer endpoints with suspicious Nx Console or package cache anomalies.
Protect backups: offline/immutable copies, delete stale snapshots, lock backup console, and verify restoration before negotiating.
Activate legal, privacy, insurance, communications, and regulator workflows based on sector and geography.

Hardening Recommendations

Immediate — 24 hours

Patch or mitigate KEV exposures: CVE-2026-59310, CVE-2026-20316, CVE-2026-50751, CVE-2026-48027, CVE-2024-1708. If patching is impossible, restrict management interfaces to jump hosts, disable IKEv1 where feasible, remove hard-coded/default credentials, and isolate RMM.
Enforce phishing-resistant MFA on VPN, firewall management, vCenter, cloud consoles, email, and remote support tooling.
Block inbound RDP/SMB/WinRM from the internet; require VPN plus device compliance for administrative protocols.
Alert on vssadmin/wbadmin/bcdedit, rclone/7z/WinRAR outside approved backup windows, PsExec/service creation, and new admin-share writes.
Verify EDR is in block mode, tamper protection is enabled, and backups are immutable/offline with a tested restore.

Short-term — two weeks

Segment identity, backup, virtualization management, firewall management, PCI/finance, healthcare, and education data enclaves; deny workstation-to-server lateral movement by default.
Deploy just-in-time admin, tiered administration, dedicated privileged access workstations, and automatic service-account rotation.
Control RMM and remote support tools through allowlisting, signed package requirements, egress restrictions, and session recording.
Add DLP and egress anomaly detection for archive creation, cloud sync tools, uncommon ports, and sustained outbound transfer from servers.
Run attack-path management to remove AD privilege escalation routes and audit developer supply chain controls for IDE extensions and npm/Nx package integrity.

Related Resources

Security Arsenal Incident Response
Managed SOC & MDR Services
AlertMonitor Threat Detection
From The Dark Side Intel Hub

N0N Ransomware Gang: 11 New Victims Posted — Sector Targeting Analysis & Detection Rules