N0N Ransomware Gang: 11 Victims Posted in 72 Hours — Multi-Sector Campaign Analysis, Detection Rules & IR Playbook

---
title: N0N Ransomware - Pre-Encryption Staging and Shadow Copy Deletion
id: 8f3a1c2e-9n0n-4a1b-a001-000000000001
status: production
description: Detects Volume Shadow Copy deletion and backup catalog tampering via vssadmin, wmic, or bcdedit — a near-universal pre-encryption behavior in N0N affiliate intrusions. Correlate with mass file rename activity for high-confidence alerting.
author: Security Arsenal Threat Intel
references:
  - https://securityarsenal.com/darkside
  - https://attack.mitre.org/techniques/T1490/
date: 2026/09/20
modified: 2026/09/20
tags:
  - attack.impact
  - attack.t1490
  - attack.t1078
logsource:
  category: process_creation
  product: windows
level: high
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
      - '\wbadmin.exe'
  selection_vss:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'resize shadowstorage'
  selection_bcd:
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
  selection_wb:
    CommandLine|contains:
      - 'delete catalog'
      - 'delete systemstatebackup'
  condition: selection_img and 1 of selection_vss, selection_bcd, selection_wb
falsepositives:
  - Legitimate backup administration (rare; vssadmin delete shadows is almost never benign in production)
fields:
  - CommandLine
  - ParentCommandLine
  - User
  - Computer
---
title: N0N Ransomware - Remote Execution via PsExec or WMI for Lateral Movement
id: 8f3a1c2e-9n0n-4a1b-a001-000000000002
status: production
description: Detects PsExec-style service creation (PSEXESVC) and WMI remote process execution consistent with affiliate lateral movement before ransomware deployment across ESXi-adjacent Windows estates.
author: Security Arsenal Threat Intel
references:
  - https://attack.mitre.org/techniques/T1569/002/
  - https://attack.mitre.org/techniques/T1047/
date: 2026/09/20
modified: 2026/09/20
tags:
  - attack.lateral_movement
  - attack.t1569.002
  - attack.t1047
  - attack.t1021.002
logsource:
  product: windows
  service: system
level: high
detection:
  selection_psexec:
    EventID: 7045
    Service_Name|contains:
      - 'PSEXESVC'
      - 'PAExec'
      - 'csexec'
      - 'remcom'
  selection_wmi:
    EventID: 7045
    Image_Path|contains:
      - 'wmiprvse.exe'
  selection_random_svc:
    EventID: 7045
    Service_Name|re: '^[A-Za-z0-9]{8,16}$'
    Image_Path|startswith: 'ADMIN$'
  condition: 1 of selection_psexec, selection_wmi, selection_random_svc
falsepositives:
  - Enterprise software distribution (SCCM, PDQ) — baseline known deployment service names and exclude
fields:
  - Service_Name
  - Image_Path
  - Account_Name
  - Computer
---
title: N0N Ransomware - Data Staging and Exfiltration Tool Execution
id: 8f3a1c2e-9n0n-4a1b-a001-000000000003
status: production
description: Detects execution of exfiltration/archiving tooling (rclone, 7zip with password flags, curl to file-sharing endpoints) frequently used by N0N affiliates to stage and exfiltrate data prior to double-extortion leaks.
author: Security Arsenal Threat Intel
references:
  - https://attack.mitre.org/techniques/T1560/001/
  - https://attack.mitre.org/techniques/T1567/002/
date: 2026/09/20
modified: 2026/09/20
tags:
  - attack.exfiltration
  - attack.t1560.001
  - attack.t1567.002
  - attack.t1048
logsource:
  category: process_creation
  product: windows
level: medium
detection:
  selection_rclone:
    Image|endswith: '\rclone.exe'
    CommandLine|contains:
      - ' copy '
      - ' sync '
      - ' move '
  selection_7z:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
    CommandLine|contains:
      - ' -p'
      - ' a -t'
  selection_curl:
    Image|endswith: '\curl.exe'
    CommandLine|contains:
      - ' -T '
      - ' --upload-file'
      - ' -F '
      - ' -d @'
  condition: 1 of selection_rclone, selection_7z, selection_curl
falsepositives:
  - Legitimate rclone backup jobs, developer use of curl — scope by service account and approved host list
fields:
  - CommandLine
  - ParentImage
  - User
  - Computer

// N0N Affiliate Hunt: Pre-Ransomware Staging & Lateral Movement Chain (Microsoft Sentinel)
// Hunts for the sequential TTP chain observed in N0N intrusions:
// suspicious auth -> remote exec tooling -> staging/archive -> shadow copy deletion
// Time window: last 14 days. Tune KnownAdmins/AllowedHosts for your estate.

let lookback = 14d;
let KnownAdminHosts = dynamic(["jumpserver01","admin-wks-07"]); // <-- customize

// 1) Shadow copy deletion events (highest fidelity pre-encryption signal)
let ShadowCopyDeletion =
    DeviceProcessEvents
    | where TimeGenerated >= ago(lookback)
    | where FileName in~ ("vssadmin.exe","wmic.exe","bcdedit.exe","wbadmin.exe")
    | where ProcessCommandLine has_any (
        "delete shadows", "shadowcopy delete", "resize shadowstorage",
        "recoveryenabled no", "ignoreallfailures", "delete catalog")
    | project ShadowTime=TimeGenerated, DeviceName, AccountName,
              ShadowCmd=ProcessCommandLine, InitiatingProcessFileName;

// 2) PsExec / suspicious service installs on the same devices
let LateralMovement =
    DeviceEvents
    | where TimeGenerated >= ago(lookback)
    | where ActionType == "ServiceInstalled"
    | extend SvcName = tostring(parse_json(AdditionalFields).ServiceName)
    | where SvcName has_any ("PSEXESVC","PAExec","remcom","csexec")
       or SvcName matches regex "^[A-Za-z0-9]{8,16}$"
    | project LateralTime=TimeGenerated, DeviceName, SvcName, InitiatingProcessAccountName;

// 3) Archive/staging tooling execution
let Staging =
    DeviceProcessEvents
    | where TimeGenerated >= ago(lookback)
    | where FileName in~ ("rclone.exe","7z.exe","7za.exe","curl.exe","winscp.com")
    | where ProcessCommandLine has_any (" copy "," sync "," -p"," --upload-file"," -T "," -F ")
    | project StageTime=TimeGenerated, DeviceName, StageCmd=ProcessCommandLine, AccountName2=AccountName;

// 4) Anomalous RDP/logon to involved devices from non-jumphost sources
let SuspiciousLogons =
    DeviceLogonEvents
    | where TimeGenerated >= ago(lookback)
    | where LogonType in ("RemoteInteractive","Network")
    | where RemoteDeviceName !in~ (KnownAdminHosts)
    | project LogonTime=TimeGenerated, DeviceName, AccountName3=AccountName,
              RemoteDeviceName, RemoteIP, LogonType;

// Correlate: devices showing >= 2 distinct chain stages within 72h
ShadowCopyDeletion
| join kind=inner (LateralMovement) on DeviceName
| join kind=inner (Staging) on DeviceName
| extend StagesHit = 3
| union (
    LateralMovement
    | join kind=inner (Staging) on DeviceName
    | extend ShadowTime=datetime(null), AccountName="", ShadowCmd="", InitiatingProcessFileName="",
             StagesHit=2
)
| summarize FirstSeen=min_of(ShadowTime, LateralTime),
            LastSeen=max_of(StageTime, LateralTime),
            ServiceNames=make_set(SvcName),
            StagingCommands=make_set(StageCmd),
            MaxStages=max(StagesHit)
    by DeviceName
| where MaxStages >= 2
| order by MaxStages desc, LastSeen desc;

<#
.SYNOPSIS
    N0N Rapid Triage & Hardening Script — Security Arsenal
.DESCRIPTION
    Rapid-response collector for suspected N0N affiliate activity. Checks:
      1. Exposed RDP (listening port + NLA status)
      2. Scheduled tasks created in the last 7 days (persistence)
      3. Volume Shadow Copy status (pre-encryption tamper indicator)
      4. Suspicious staging tools on disk (rclone, 7z standalone, psexec)
      5. Recently created local admin accounts
    Run elevated. Output written to C:\IR\N0N-Triage-<hostname>-<timestamp>.txt
.EXAMPLE
    PS> .
0n-rapid-triage.ps1
#>

$ErrorActionPreference = 'SilentlyContinue'
$out = "C:\IR"
New-Item -ItemType Directory -Path $out -Force | Out-Null
$report = "$out\N0N-Triage-$env:COMPUTERNAME-$(Get-Date -Format 'yyyyMMdd-HHmmss').txt"

function Write-Section($t) { "`n===== $t =====" | Tee-Object -FilePath $report -Append }

"N0N Rapid Triage — $(Get-Date) — Host: $env:COMPUTERNAME" | Tee-Object -FilePath $report

Write-Section "1. RDP EXPOSURE"
$rdp = Get-NetTCPConnection -LocalPort 3389 -State Listen
if ($rdp) {
    "[!] RDP LISTENING on 3389"
    $nla = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp').UserAuthentication
    if ($nla -eq 0) { "[CRITICAL] NLA DISABLED — enable immediately: Set-ItemProperty ... -Name UserAuthentication -Value 1" }
    else { "[OK] NLA enabled" }
    $fw = Get-NetFirewallRule -DisplayGroup 'Remote Desktop' | Where-Object Enabled -eq 'True'
    if ($fw) { "[!] RDP firewall rules ENABLED — restrict source IPs or disable if unused" }
} else { "[OK] RDP not listening" }

Write-Section "2. SCHEDULED TASKS CREATED IN LAST 7 DAYS"
$cutoff = (Get-Date).AddDays(-7)
$tasks = Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt $cutoff -and $_.TaskPath -notlike '\Microsoft*' }
if ($tasks) {
    $tasks | ForEach-Object {
        "[REVIEW] $($_.TaskName) | Path: $($_.TaskPath) | Created: $($_.Date)"
        ($_.Actions | ForEach-Object { "    -> $($_.Execute) $($_.Arguments)" })
    }
} else { "[OK] No new non-Microsoft scheduled tasks" }

Write-Section "3. VOLUME SHADOW COPY STATUS"
$shadows = Get-WmiObject Win32_ShadowCopy
if (-not $shadows) {
    "[CRITICAL] NO shadow copies exist — possible vssadmin deletion (T1490). Check for recent 'delete shadows' in event logs."
    Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} -MaxEvents 5000 |
      Where-Object { $_.Message -match 'vssadmin.*delete|shadowcopy.*delete' } |
      ForEach-Object { "    [HIT] $($_.TimeCreated): $($_.Message.Substring(0,[Math]::Min(300,$_.Message.Length)))" }
} else {
    "[OK] $($shadows.Count) shadow copies present. Oldest: $(($shadows | Sort-Object InstallDate | Select-Object -First 1).InstallDate)"
}

Write-Section "4. STAGING / EXFIL TOOLS ON DISK"
$suspect = @('rclone.exe','psexec.exe','psexesvc.exe','7z.exe','7za.exe','winscp.exe','megatools.exe','FileZilla.exe')
foreach ($t in $suspect) {
    Get-ChildItem -Path 'C:\','D:\' -Filter $t -Recurse -Depth 4 -Force -ErrorAction SilentlyContinue |
      Where-Object { $_.LastWriteTime -gt $cutoff } |
      ForEach-Object { "[REVIEW] $($_.FullName) | Written: $($_.LastWriteTime)" }
}

Write-Section "5. RECENTLY ADDED LOCAL ADMINS"
$admins = Get-LocalGroupMember -Group 'Administrators'
foreach ($a in $admins) {
    try {
        $u = Get-LocalUser $a.Name.Split('\')[-1]
        if ($u -and $u.PasswordLastSet -gt $cutoff) {
            "[REVIEW] $($a.Name) | PasswordLastSet: $($u.PasswordLastSet)"
        }
    } catch {}
}

Write-Section "TRIAGE COMPLETE"
"Report: $report"
"`nNEXT STEPS if CRITICAL/REVIEW hits found:`n  1. Isolate host from network (do NOT power off — preserve memory)`n  2. Block egress to unapproved file-sharing/cloud storage domains at the proxy`n  3. Reset credentials for any account seen authenticating to this host`n  4. Engage IR: https://securityarsenal.com/services/incident-response"