N0N Ransomware Gang: 11 Victims in 48 Hours — Cross-Sector Campaign Analysis, Leak-Site Intelligence & Detection Rules

Classification: TLP:CLEAR | Source: ransomware.live aggregation of N0N .onion leak site | Report date: 2026-09-21

Executive Summary

Between 2026-09-18 and 2026-09-20, the N0N ransomware operation published 11 new victims to its dark web leak site — an unusually dense posting burst that signals either a coordinated encryption wave or a backlog dump following negotiations collapse. The victim set spans eight sectors and eight countries, with a clear gravitational pull toward financial services (3 victims) and education (2 victims), plus high-value single hits against a global retail platform (Fanatics), a national ISP (Inter Venezuela), a pharmaceutical subsidiary (AstraZeneca Türkiye), and a government ministry (Argentina Ministry of Education).

Security teams in financial services, education, retail/e-commerce, and healthcare — particularly those operating in the US and Latin America — should treat this as an active-campaign indicator and immediately sweep for the initial-access CVEs correlated with this operation's tradecraft window.

Threat Actor Profile — N0N

Current Campaign Analysis

Sector Targeting (last 100 postings: 11 recent)

• Financial Services — 3 victims (Argentem Creek Partners, STOKR, Transcom WorldWide/PayPal support ops). Financial data commands premium extortion leverage; note the supply-chain angle: Transcom is a BPO operating PayPal support — third-party/BPO compromise as a route into brand-name financial targets.
• Education — 2 victims (United Federation of Teachers, BeLi Teacher/FSC education centers). Education remains a soft-target staple: large identity stores, weak EDR coverage, seasonal budget pressure.
• Retail & E-Commerce — 1 (Fanatics). Global sports commerce platform: massive PII + payment-adjacent data, high brand-damage pressure.
• Government & Defense — 1 (Argentina Ministry of Education). Citizen data at national scale.
• Healthcare — 1 (AstraZeneca Türkiye). Regional subsidiary targeting is a common pattern — softer perimeter than global HQ, same brand leverage.
• Technology — 1 (Inter, Venezuela's largest ISP). ISP compromise implies potential downstream/cascade risk to that provider's customer base.
• Professional Services / Other — 3 (Konnatus legal services BR; GC789 betting network VN).

Geographic Concentration

US (2), VE (1), SE (1), AR (1), TR (1), LU (1), BR (2), VN (2). Two observations: (1) Latin America is overweight (VE, AR, BR — 3 of 11), consistent with expanding operator focus on regions with lower law-enforcement friction and weaker baseline hardening; (2) Vietnam appears twice, including a betting operator — gray-market victims rarely involve law enforcement, making them low-risk extortion targets.

Victim Profile

Deliberately heterogeneous: global enterprises (Fanatics, AstraZeneca subsidiary, PayPal BPO), mid-market financial firms (Argentem Creek, STOKR), a national ISP, a government ministry, and small professional-services shops (Konnatus). This is opportunistic access-driven victimology, not vertical specialization — the actor is monetizing whatever access it obtains or purchases. Revenue range: low eight figures to multi-billion USD.

Posting Frequency / Escalation Pattern

9 of 11 victims were posted on a single day (2026-09-18), followed by Fanatics on 2026-09-20. Batch-dump posting typically indicates one of: (a) a synchronized encryption wave from a shared access window, (b) mass negotiation expiry, or (c) a new leak-site operator cadence. Defenders should assume (a) is possible and that unposted victims from the same access wave may still be pre-detonation.

CVE Correlation (CISA KEV — confirmed ransomware use)

The following actively exploited CVEs fall inside this campaign's operational window and represent the most probable initial-access surface:

• CVE-2026-59310 — VMware vCenter path traversal (KEV 2026-08-18). vCenter compromise = keys to the virtualization kingdom; direct path to mass encryption of VM estates and VSS destruction. Highest-priority correlation.
• CVE-2026-20316 — Cisco Secure FMC hard-coded password (KEV 2026-07-29). Firewall management plane takeover → policy tampering, persistent access, log blind spots.
• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1) (KEV 2026-06-08). Classic edge-VPN initial access; Check Point exploitation has been a top ransomware entry vector for three consecutive years.
• CVE-2026-48027 — Nx Console embedded malicious code (KEV 2026-05-27). Supply-chain/developer-workstation vector; relevant given the Technology-sector victim and AWS-hosted education victim.
• CVE-2024-1708 — ConnectWise ScreenConnect path traversal / RCE (KEV 2026-04-28). MSP/RMM vector — strongly consistent with the BPO (Transcom) and education-vendor (AWS-hosted BeLi/FSC) victims. RMM tooling remains the fastest lateral-movement accelerant in ransomware intrusions.

Assessment: The victim mix (BPO, MSP-adjacent education vendor, ISP, enterprises with large virtualized estates) maps well onto a ScreenConnect/RMM + edge-VPN + vCenter intrusion chain. Treat these five CVEs as the campaign's probable access surface until contradicted by forensic evidence.

Detection Engineering

Sigma Rules

Three rules targeting N0N's assessed playbook: edge-VPN exploitation artifacts, pre-encryption staging (VSS destruction + mass exfil), and RMM/PsExec-style lateral movement.

---
title: Edge VPN or Firewall Management Plane Anomalous Authentication - N0N Campaign
description: Detects successful authentication to VPN/firewall management interfaces from external or unusual sources, consistent with exploitation of Check Point CVE-2026-50751 or Cisco FMC CVE-2026-20316 as ransomware initial access.
id: 8f1a2b3c-n0n1-4a7b-9c2d-202609210001
status: experimental
author: Security Arsenal Threat Intelligence
 date: 2026/09/21
references:
  - https://securityarsenal.com/darkside
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  category: firewall
  product: checkpoint
  definition: 'Also applicable to Cisco FMC/FTD and generic VPN auth logs via field mapping'
detection:
  selection_auth:
    action|contains:
      - 'accept'
      - 'success'
      - 'logged in'
      - 'authenticated'
  selection_external:
    src_ip|cidr:
      - '0.0.0.0/0'
  filter_rfc1918:
    src_ip|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  filter_known_jump:
    src_ip|cidr:
      - '203.0.113.0/24'  # REPLACE: known bastion/jump-host ranges
  condition: selection_auth and selection_external and not filter_rfc1918 and not filter_known_jump
falsepositives:
  - Legitimate remote administration (mitigate by enumerating admin source ranges)
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t1133
---
title: Pre-Ransomware Staging - Shadow Copy Deletion and Backup Tampering - N0N Playbook
description: Detects Volume Shadow Copy deletion, boot configuration tampering, and backup catalog destruction via command line - near-universal pre-encryption behavior across double-extortion ransomware operations.
id: 8f1a2b3c-n0n1-4a7b-9c2d-202609210002
status: experimental
author: Security Arsenal Threat Intelligence
date: 2026/09/21
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'resize shadowstorage'
  selection_wmic:
    Image|endswith: '\wmic.exe'
    CommandLine|contains: 'shadowcopy'
  selection_bcdedit:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'ignoreallfailures'
  selection_wbadmin:
    Image|endswith: '\wbadmin.exe'
    CommandLine|contains:
      - 'delete catalog'
      - 'delete backup'
  condition: 1 of selection_*
falsepositives:
  - Backup administrators performing maintenance (correlate with change windows)
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.defense_evasion
---
title: RMM Tool or PsExec Remote Service Execution - N0N Lateral Movement
description: Detects service installation/execution patterns associated with PsExec-style tooling and abused RMM agents (ScreenConnect and clones) used for ransomware lateral movement and mass deployment.
id: 8f1a2b3c-n0n1-4a7b-9c2d-202609210003
status: experimental
author: Security Arsenal Threat Intelligence
date: 2026/09/21
references:
  - https://securityarsenal.com/darkside
logsource:
  product: windows
  service: system
  definition: 'Windows Event ID 7045 - Service Installation'
detection:
  selection_event:
    EventID: 7045
  selection_psexec:
    ServiceName|contains:
      - 'PSEXESVC'
      - 'PAExec'
      - 'RemCom'
  selection_rmm_abuse:
    ImagePath|contains:
      - '\AppData\Local\Temp\'
      - '\ProgramData\'
      - 'screenconnect'
      - '\users\public\'
  filter_approved_rmm:
    ServiceName|startswith:
      - 'APPROVED_RMM_PREFIX'  # REPLACE: your sanctioned RMM agent service names
  condition: selection_event and (selection_psexec or selection_rmm_abuse) and not filter_approved_rmm
falsepositives:
  - Sanctioned IT remote administration tools (allowlist by service name and signer)
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002
  - attack.t1219

KQL — Microsoft Sentinel Pre-Ransomware Staging Hunt

Hunt for the 48-hour pre-encryption pattern: new admin-ish logons + suspicious process staging + mass file access from a single host. Run across the last 14 days given the burst posting timeline.

// N0N campaign hunt: pre-encryption staging behavior cluster
// Looks for hosts exhibiting >=2 of: VSS tampering, mass file rename/write,
// suspicious tooling execution, and anomalous admin logon - within 6h windows
let Lookback = 14d;
let VssTamper =
    DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where ProcessCommandLine has_any ("delete shadows", "resize shadowstorage",
        "shadowcopy delete", "recoveryenabled no", "delete catalog")
    | summarize VssEvents=count(), VssCmds=make_set(ProcessCommandLine, 5)
        by DeviceName, bin(Timestamp, 6h);
let MassFileActivity =
    DeviceFileEvents
    | where Timestamp > ago(Lookback)
    | where ActionType in ("FileRenamed", "FileModified")
    | summarize FileOps=count(), DistinctExtensions=dcount(parse_path(FileName).Extension)
        by DeviceName, InitiatingProcessAccountName, bin(Timestamp, 6h)
    | where FileOps > 5000 and DistinctExtensions > 20;
let SuspiciousTooling =
    DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where FileName has_any ("psexec", "psexesvc", "paexec", "remcom", "rclone",
        "megasync", "7z.exe", "winrar", "nltest", "adfind", "sharpHound".tolower())
       or ProcessCommandLine has_any ("rclone copy", "rclone sync", "--transfers",
        "bloodhound", "collectionmethods")
    | summarize ToolExecs=count(), Tools=make_set(FileName, 10)
        by DeviceName, bin(Timestamp, 6h);
let AnomalousAdminLogon =
    DeviceLogonEvents
    | where Timestamp > ago(Lookback)
    | where LogonType in ("RemoteInteractive", "Network")
    | where AccountName endswith "$" == false
    | summarize AdminLogons=count(), Sources=make_set(RemoteIP, 10)
        by DeviceName, AccountName, bin(Timestamp, 6h)
    | where AdminLogons > 20;
VssTamper
| join kind=fullouter MassFileActivity on DeviceName, Timestamp
| join kind=fullouter SuspiciousTooling on DeviceName, Timestamp
| join kind=fullouter AnomalousAdminLogon on DeviceName, Timestamp
| extend SignalCount = iff(isnotnull(VssEvents),1,0) + iff(isnotnull(FileOps),1,0)
    + iff(isnotnull(ToolExecs),1,0) + iff(isnotnull(AdminLogons),1,0)
| where SignalCount >= 2
| project Timestamp, DeviceName, SignalCount, VssEvents, FileOps, ToolExecs,
    Tools, AdminLogons, AccountName, Sources
| order by SignalCount desc, Timestamp desc;

Rapid Response Script — Pre-Detonation Triage

Run on any host flagged by the hunts above, or fleet-wide via your RMM/EDR live response when this campaign's indicators appear. Collects the evidence that matters in the T-minus window.

# N0N Campaign Rapid Triage - run as SYSTEM/admin. Read-only collection.
# Output: C:\IR-Triage-<hostname>-<timestamp>.txt
$out = "C:\IR-Triage-$env:COMPUTERNAME-$(Get-Date -Format 'yyyyMMdd-HHmmss').txt"
"=== N0N RAPID TRIAGE - $(Get-Date) ===" | Out-File $out

"`n[1] EXPOSED RDP CHECK" | Out-File $out -Append
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -EA SilentlyContinue
"RDP Enabled: $(if($rdp.fDenyTSConnections -eq 0){'YES - INVESTIGATE EXPOSURE'}else{'No'})" | Out-File $out -Append
Get-NetTCPConnection -LocalPort 3389 -State Listen -EA SilentlyContinue |
  Select-Object LocalAddress,LocalPort,State | Out-File $out -Append

"`n[2] VOLUME SHADOW COPIES (expect existing copies; ZERO copies on a server = red flag)" | Out-File $out -Append
vssadmin list shadows 2>&1 | Out-File $out -Append

"`n[3] SCHEDULED TASKS CREATED/MODIFIED - LAST 7 DAYS" | Out-File $out -Append
Get-ScheduledTask | ForEach-Object {
  $i = $_ | Get-ScheduledTaskInfo -EA SilentlyContinue
  [PSCustomObject]@{ Name=$_.TaskName; Path=$_.TaskPath; LastRun=$i.LastRunTime; Author=$_.Author }
} | Where-Object { $_.LastRun -gt (Get-Date).AddDays(-7) -and $_.Author -notmatch 'Microsoft' } |
  Format-Table -Auto | Out-File $out -Append

"`n[4] NEW LOCAL ADMINS - LAST 14 DAYS" | Out-File $out -Append
Get-LocalGroupMember -Group 'Administrators' -EA SilentlyContinue |
  Select-Object Name,ObjectClass,PrincipalSource | Format-Table -Auto | Out-File $out -Append

"`n[5] SUSPICIOUS PROCESSES (exfil/staging tooling)" | Out-File $out -Append
Get-Process | Where-Object { $_.Name -match 'rclone|mega|7z|winrar|psexec|adfind|nltest|screenconnect' } |
  Select-Object Name,Id,Path,StartTime | Format-Table -Auto | Out-File $out -Append

"`n[6] SERVICES INSTALLED FROM TEMP/PROGRAMDATA (7045 proxy)" | Out-File $out -Append
Get-CimInstance Win32_Service | Where-Object {
  $_.PathName -match 'Temp|ProgramData|Users\\Public|screenconnect' -and $_.PathName -notmatch 'Windows\\Temp\\[a-z0-9]+\\(MsMpEng|Office)' } |
  Select-Object Name,State,StartMode,PathName | Format-List | Out-File $out -Append

"`n[7] RECENT EVENT 1102 (LOG CLEAR) AND 4690/4688 VSS PROCESS HITS" | Out-File $out -Append
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=1102; StartTime=(Get-Date).AddDays(-7)} -EA SilentlyContinue |
  Select-Object TimeCreated,Message | Format-List | Out-File $out -Append

"`n[8] OUTBOUND GB-LEVEL TRANSFERS LAST 24H (top talkers)" | Out-File $out -Append
Get-NetTCPConnection -State Established -EA SilentlyContinue |
  Where-Object { $_.RemoteAddress -notmatch '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)' } |
  Group-Object RemoteAddress | Sort-Object Count -Descending | Select-Object -First 15 Name,Count |
  Format-Table -Auto | Out-File $out -Append

Write-Host "Triage complete: $out" -ForegroundColor Green

Incident Response Priorities

T-Minus Detection Checklist (before encryption fires)

1. VSS/backup tampering commands — vssadmin, wmic shadowcopy, bcdedit, wbadmin (highest-fidelity pre-detonation signal; see Sigma rule 2).
2. Mass staging archives — multi-GB .zip/.7z/.rar files in ProgramData, user temp, or file-server roots.
3. Exfil tooling — rclone, MEGAsync, FileZilla, or unexpected cloud-storage processes; sustained >50GB outbound to a single external IP.
4. New RMM agents or PsExec-style services — Event 7045 from temp paths; any remote-access tool not on your sanctioned list.
5. Discovery bursts — nltest /dclist, adfind, BloodHound/SharpHound, net group "Domain Admins" across multiple hosts in a short window.
6. EDR/log tampering — Event 1102 (log clear), sensor service stops, Set-MpPreference -DisableRealtimeMonitoring $true.
7. Edge-device anomalies — VPN logons from impossible-travel or non-corporate ASNs, especially outside change windows (CVE-2026-50751 / CVE-2026-20316 surface).

Assets This Actor Profile Prioritizes for Exfiltration

• Financial/transactional data stores (consistent with 3 FS victims) — customer PII, payment-adjacent records, investor documentation.
• HR and identity stores (education/union victims) — member records, SSNs, payroll.
• Legal and contractual documents (professional services victim).
• Email archives of executives and legal counsel — negotiation-leverage material.
• Backup catalogs and virtualization management planes (vCenter correlation) — targeted for destruction, not just exfil.

Containment Actions (ordered by urgency)

1. Isolate, don't power off — network-quarantine suspected hosts via EDR; preserve memory for forensic capture.
2. Kill the edge — disable compromised VPN/firewall management access; force credential resets for all accounts that authenticated through the suspect appliance in the last 30 days. Patch or isolate Check Point / Cisco FMC / vCenter / ScreenConnect instances immediately.
3. Disable suspect accounts and sessions — revoke tokens, reset krbtgt twice if domain-wide lateral movement is confirmed.
4. Block exfil egress — emergency egress filtering on non-standard ports and unsanctioned cloud storage domains at the proxy/firewall.
5. Protect backups — verify offline/immutable copies are actually isolated; disable backup-job deletion permissions pending investigation.
6. Hunt laterally before declaring scope — assume the quiet hosts are compromised too; run the KQL cluster query fleet-wide.

Hardening Recommendations

Immediate (24 hours)

• Patch or isolate the five KEV CVEs: CVE-2026-59310 (vCenter), CVE-2026-20316 (Cisco FMC), CVE-2026-50751 (Check Point IKEv1 — disable IKEv1 if unused), CVE-2026-48027 (Nx Console — pin and verify package integrity), CVE-2024-1708 (ScreenConnect — upgrade or decommission internet-facing instances).
• Inventory and restrict all RMM tooling — remove unauthorized instances; alert on any new remote-access service install (Sigma rule 3).
• Enforce phishing-resistant MFA on all VPN and remote access; block IKEv1 aggressive mode.
• Deploy the Sigma rules and KQL hunt above; alert-critical on VSS tampering.
• Verify backup immutability and test one restore this week — assume encryption is the endgame.
• Third-party/BPO review — the Transcom/PayPal posting is a supply-chain warning: audit which vendors hold your data and require incident-notification SLAs.

Short-Term (2 weeks)

• Segment virtualization management — vCenter on a dedicated management network, reachable only from PAWs; no direct internet or general-user-VLAN access.
• Egress control architecture — default-deny outbound for servers; proxy all user egress with cloud-storage categorization and rclone/MEGA signature blocking.
• EDR in block mode fleet-wide, including servers and domain controllers; enable tamper protection.
• Tiered administration — separate admin accounts, no DA logons to workstations, LAPS on all endpoints (breaks the lateral-movement chain that batch-victim campaigns depend on).
• Attack surface reduction for education/finance subsidiaries — the AstraZeneca Türkiye pattern (regional subsidiary hit) argues for extending parent-org controls to regional entities rather than treating them as separate risk domains.

This briefing is derived from live leak-site telemetry aggregated via ransomware.live and CISA KEV correlation. Victim postings reflect actor claims; inclusion does not independently confirm compromise. Organizations named should be considered in active-extortion status and may be managing ongoing incidents.

Related Resources

Security Arsenal Incident Response

Managed SOC & MDR Services

AlertMonitor Threat Detection

From The Dark Side Intel Hub