N0N Ransomware Gang: 11 Victims in 4 Days — Cross-Sector Extortion Campaign Targeting FinServ, Education & Critical Telecom

---
title: N0N Campaign — Edge VPN/Firewall Exploitation Follow-On Process Execution
id: 9f3a1c2e-7b41-4e8d-a1f2-n0nedgedetect01
status: experimental
description: Detects suspicious child processes spawned by edge VPN, firewall management, or remote access services — consistent with post-exploitation after Check Point IKEv1 auth bypass (CVE-2026-50751), Cisco FMC compromise (CVE-2026-20316), or ScreenConnect RCE (CVE-2024-1708).
author: Security Arsenal Threat Intelligence
date: 2026/09/21
references:
  - https://securityarsenal.com/darkside
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\vpn.exe'
      - '\vpnd.exe'
      - '\ScreenConnect.Service.exe'
      - '\ScreenConnect.ClientService.exe'
      - '\httpd.exe'               # Cisco FMC / appliance web planes
      - '\cpwd.exe'                # Check Point watchdog
      - '\fwm.exe'                 # Check Point management
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
      - '\whoami.exe'
      - '\net.exe'
      - '\nltest.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate RMM admin sessions via ScreenConnect (tune by ParentCommandLine and admin account)
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t1133
---
title: N0N Campaign — Pre-Encryption Data Staging and Exfiltration Tooling
id: 8e2b0d1f-6c30-4d7c-b0e3-n0nstaging002
status: experimental
description: Detects archive creation and cloud exfiltration tooling (rclone, 7z/rar with password flags, MEGA/megacmd) observed in pre-encryption staging phases of double-extortion ransomware operations including N0N.
author: Security Arsenal Threat Intelligence
date: 2026/09/21
logsource:
  category: process_creation
  product: windows
detection:
  selection_exfil_tools:
    Image|endswith:
      - '\rclone.exe'
      - '\megacmd.exe'
      - '\MEGAcmd.exe'
      - '\filezilla.exe'
      - '\winscp.exe'
      - '\restic.exe'
  selection_archive:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
      - '\winrar.exe'
    CommandLine|contains:
      - ' -p'          # password-protected archive
      - ' -mhe'        # encrypted headers
      - ' a '          # add-to-archive verb
  selection_staging_dir:
    CommandLine|contains:
      - '\ProgramData\'
      - '\Perflogs\'
      - 'C:\Users\Public\'
      - '\staging\'
      - '\exfil\'
  condition: selection_exfil_tools or (selection_archive and selection_staging_dir)
falsepositives:
  - Enterprise backup jobs using 7-Zip; legitimate rclone sync (allowlist by service account and destination remote)
level: high
tags:
  - attack.collection
  - attack.t1560.001
  - attack.exfiltration
  - attack.t1567.002
---
title: N0N Campaign — Lateral Movement via PsExec / WMI with Shadow Copy Pre-Deletion
id: 7d1c9e0a-5f2f-4c6b-c9d4-n0nlatmove003
status: experimental
description: Detects remote service execution (PsExec-style), WMI remote process creation, and Volume Shadow Copy deletion — the pre-detonation lateral movement and anti-recovery sequence used by N0N and comparable ransomware crews.
author: Security Arsenal Threat Intelligence
date: 2026/09/21
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec:
    - Image|endswith: '\PSEXESVC.exe'
    - OriginalFileName: 'psexesvc.exe'
    - CommandLine|contains: 'psexec'
  selection_wmi_remote:
    ParentImage|endswith: '\WmiPrvSE.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\msiexec.exe'
  selection_vss:
    CommandLine|contains:
      - 'vssadmin delete shadows'
      - 'vssadmin resize shadowstorage'
      - 'wmic shadowcopy delete'
      - 'bcdedit'  # often paired with recoveryenabled no
      - 'DeleteShadows'  # WMIC/PowerShell alias
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\powershell.exe'
      - '\wbadmin.exe'
  condition: selection_psexec or selection_wmi_remote or selection_vss
falsepositives:
  - Admin PsExec usage for software deployment (allowlist named deployment accounts and source IPs)
  - Backup solutions resizing shadow storage (allowlist by parent process)
level: critical
tags:
  - attack.lateral_movement
  - attack.t1569.002
  - attack.t1047
  - attack.impact
  - attack.t1490

// N0N Campaign Hunt — Staging, Lateral Movement, Anti-Recovery (14d)
let Lookback = 14d;
let DeployAccounts = dynamic(["svc_deploy", "svc_sccm"]);   // tune per environment
let Staging =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName in~ ("rclone.exe","megacmd.exe","restic.exe","7z.exe","7za.exe","rar.exe","winscp.exe")
       or ProcessCommandLine has_any (" -p", " -mhe", "rclone copy", "rclone sync", "mega-put")
    | where not(InitiatingProcessAccountName in~ (DeployAccounts))
    | project StagingTime=TimeGenerated, DeviceName, StagingAccount=AccountName, StagingCmd=ProcessCommandLine, StagingProc=FileName;
let Lateral =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName =~ "PSEXESVC.exe"
       or (InitiatingProcessFileName =~ "WmiPrvSE.exe" and FileName in~ ("cmd.exe","powershell.exe","msiexec.exe"))
    | project LateralTime=TimeGenerated, DeviceName, LateralAccount=AccountName, LateralCmd=ProcessCommandLine;
let AntiRecovery =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where ProcessCommandLine has_any ("vssadmin delete shadows","shadowcopy delete","resize shadowstorage","recoveryenabled no","wbadmin delete")
    | project ARTime=TimeGenerated, DeviceName, ARAccount=AccountName, ARCmd=ProcessCommandLine;
Staging
| join kind=inner Lateral on DeviceName
| join kind=inner AntiRecovery on DeviceName
| where LateralTime between (StagingTime .. StagingTime + 5d)
   and ARTime between (LateralTime .. LateralTime + 2d)
| project DeviceName, StagingTime, StagingAccount, StagingCmd, LateralTime, LateralCmd, ARTime, ARCmd
| order by ARTime desc;
// Any hit = device exhibiting full pre-ransomware kill chain -> isolate immediately

# N0N Rapid Triage — scheduled tasks (7d), RDP exposure, shadow copy state, staging dirs
# Run elevated. Output to CSV for IR collection.
$out = @(); $cutoff = (Get-Date).AddDays(-7)

Write-Host "[1] Scheduled tasks created/modified in last 7 days..." -ForegroundColor Cyan
Get-ScheduledTask | ForEach-Object {
    $i = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    $reg = (Get-Item "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\$($_.PSChildName)" -ErrorAction SilentlyContinue)
    if ($i -and $i.LastRunTime -gt $cutoff -and $_.TaskPath -notlike "\Microsoft*") {
        $out += [pscustomobject]@{Type="SchedTask"; Name=$_.TaskName; Path=$_.TaskPath; LastRun=$i.LastRunTime; Action=($_.Actions.Execute + " " + $_.Actions.Arguments)}
    }
}

Write-Host "[2] RDP exposure & NLA state..." -ForegroundColor Cyan
$rdp = Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" -Name fDenyTSConnections -ErrorAction SilentlyContinue
$nla = Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name UserAuthentication -ErrorAction SilentlyContinue
$out += [pscustomobject]@{Type="RDP"; Name="RDP_Enabled=$($rdp.fDenyTSConnections -eq 0) | NLA=$($nla.UserAuthentication)"; Path=""; LastRun=""; Action="If RDP enabled w/o NLA -> immediate risk"}

Write-Host "[3] Volume Shadow Copies..." -ForegroundColor Cyan
$vss = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $vss) { $out += [pscustomobject]@{Type="VSS"; Name="NO SHADOW COPIES FOUND"; Path=""; LastRun=Get-Date; Action="POSSIBLE ANTI-RECOVERY ACTIVITY"} }
else { $vss | ForEach-Object { $out += [pscustomobject]@{Type="VSS"; Name=$_.ID; Path=$_.DeviceObject; LastRun=$_.InstallDate; Action=""} } }

Write-Host "[4] Common staging directories (modified last 7d)..." -ForegroundColor Cyan
$dirs = @("C:\ProgramData","C:\Users\Public","C:\Perflogs","C:\Windows\Temp")
foreach ($d in $dirs) {
    Get-ChildItem $d -Recurse -Depth 2 -ErrorAction SilentlyContinue |
      Where-Object { $_.LastWriteTime -gt $cutoff -and $_.Length -gt 100MB } |
      ForEach-Object { $out += [pscustomobject]@{Type="StagingFile"; Name=$_.Name; Path=$_.FullName; LastRun=$_.LastWriteTime; Action="$([math]::Round($_.Length/1MB))MB - investigate"} }
}

Write-Host "[5] Edge/RMM tooling presence (ScreenConnect, unmanaged)..." -ForegroundColor Cyan
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*","HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" -ErrorAction SilentlyContinue |
  Where-Object { $_.DisplayName -match "ScreenConnect|ConnectWise|AnyDesk|TeamViewer|Splashtop" } |
  ForEach-Object { $out += [pscustomobject]@{Type="RMM"; Name=$_.DisplayName; Path=$_.InstallLocation; LastRun=""; Action="Verify authorized RMM — remove if unknown"} }

$out | Export-Csv ".\n0n_triage_$(Get-Date -Format yyyyMMdd_HHmm).csv" -NoTypeInformation
$out | Format-Table -AutoSize