Classification: TLP:CLEAR | Publication Date: 2026-10-12 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 12 Leak-Site Listings in One Week — Healthcare & Tech Targeting Analysis with Detection Rules

Executive Summary

Between 2026-10-07 and 2026-10-11, the ransomware group tracked as N0N published 12 victim listings on its dark web leak site, according to monitoring via ransomware.live. Eleven of those listings were published in a single 24-hour window on 2026-10-11 — a burst pattern consistent with either a batch-detonation campaign or a staged publicity push following a period of quiet intrusion activity.

The listings name organizations in Healthcare (3), Technology (2), and Professional Services (1), with six additional listings carrying no sector classification. Geographically, the claims concentrate in the United States (5), Canada (1), and Australia (1), with five listings lacking country attribution.

Critical caveat: every listing below is an unverified claim made by a criminal group on its own infrastructure. None of the named organizations has been confirmed as breached by this data, and readers must treat each entry as an accusation requiring independent verification — not as an incident record.

Defenders in healthcare, technology, and professional services across North America and Australia should treat this burst as a trigger condition for the threat hunts in the Detection Engineering section below.

Sourcing & Verification

• Corroboration status: 11 of the 12 listings in this briefing were independently observed by a second leak-site crawler (MULTI-SOURCE), meaning two separate monitoring pipelines saw N0N publish the claim. One listing (Chibitek) appears on ransomware.live only (SINGLE-SOURCE) and lacks even second-crawler confirmation that the posting exists.
• What corroboration does NOT mean: Multi-source observation confirms only that the gang made the claim. It does not confirm a breach, intrusion, or data theft occurred. No tier in our sourcing pipeline can confirm a breach — only the named organization or its regulator can do that.
• Named organizations may dispute these listings. A denial, however, is likewise not proof the claim is false. Disclosure obligations vary by jurisdiction and sector, and not every incident is legally reportable. Neither silence nor denial settles the question, and Security Arsenal makes no assertion either way.
• Corrections: Security Arsenal will publish corrections to this briefing if any claim is retracted, disputed with evidence, or independently verified. We welcome contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

Public reporting on N0N remains thin, and much of what circulates in vendor telemetry is low-confidence. The profile below reflects observed leak-site behavior plus patterns consistent with mid-tier ransomware operations; items marked (assessed) are analyst judgment, not established fact.

• Aliases / branding: Operates under the name 'N0N' on its Tor-hosted leak site. No confirmed rebrand lineage to a prior crew has been established at the time of writing.
• Operating model (assessed): The burst posting pattern — 11 listings in a single day — is characteristic of a small closed crew or a lean RaaS operation with a limited affiliate pool, rather than a high-volume open RaaS program. Batch posting often indicates intrusions completed earlier and staged for maximum pressure.
• Extortion model: Double extortion. The leak-site listing itself is the pressure mechanism; the gang claims to hold exfiltrated data and threatens publication. No listing in this batch includes verified proof-of-data samples in our collection.
• Ransom demands: Not publicly documented for this group. Mid-tier crews targeting professional services and mid-market healthcare typically open in the low-to-mid six figures USD, but N0N-specific demand data is unavailable.
• Initial access methods (assessed, sector-level): No confirmed initial-access vector exists for any listing in this batch. Consistent with 2026 ransomware tradecraft broadly, plausible vectors include exploitation of edge/remote-access appliances, phished or purchased VPN credentials, and exposed RDP. See the CVE hypothesis discussion in Campaign Analysis.
• Dwell time (assessed): The clustering of 11 same-day posts suggests intrusions that matured in parallel — a pattern consistent with dwell times of days-to-weeks before detonation or extortion, rather than smash-and-grab encryption.

Current Campaign Analysis

Victim listings observed (all claims unverified)

Sector targeting

Where classification exists, healthcare is the single largest named sector (3 listings), followed by technology (2) and professional services (1). Healthcare remains a high-pressure extortion target because of regulatory exposure (HIPAA in the US, the Notifiable Data Breaches scheme in Australia) and operational intolerance for downtime. The six unclassified listings prevent firm conclusions about the campaign's center of gravity — treat the healthcare skew as directional, not definitive.

Geographic concentration

The United States dominates named attribution (5 of 7 country-tagged listings), with single listings in Canada and Australia. This is a Five Eyes–concentrated campaign in claimed targeting, matching the broader ransomware economy's preference for high-GDP, English-language, cyber-insurance-penetrated markets.

Victim profile

Named and classified victims skew toward mid-market organizations — regional healthcare providers, technology services firms, and professional services shops — typically the 50–1,000 employee band where security staffing is real but thin. Revenue estimates would be speculative given the anonymized listings; defenders should instead note that this size band historically yields the fastest extortion payments because incident response budgets are smaller than enterprise peers but operational dependence on IT is total.

Posting frequency and escalation

The temporal signature is the story: one listing on 2026-10-07 (the single-source Chibitek claim), silence, then 11 listings in one day. Three plausible explanations, none provable from leak-site data alone: (1) a coordinated batch of intrusions reached extortion stage simultaneously; (2) the gang accumulated claims and dumped them for publicity impact; (3) some listings are recycled or fabricated padding to inflate the crew's apparent tempo. Leak-site inflation is a documented tactic across the ecosystem and cannot be ruled out here.

CVE exposure hypothesis — NOT a claimed attribution

We have no evidence linking any CVE to any N0N listing. The following is sector-level exposure analysis only: several vulnerabilities currently on the CISA Known Exploited Vulnerabilities catalog with confirmed ransomware usage affect exactly the infrastructure classes this gang's apparent victim set depends on:

• CVE-2026-50751 (Check Point Security Gateway, improper authentication in IKEv1) — edge VPN concentrators are the classic entry point for crews hitting mid-market healthcare and professional services.
• CVE-2026-20316 (Cisco Secure FMC, hard-coded password) — management-plane compromise of perimeter firewalls.
• CVE-2026-59310 (VMware vCenter path traversal) — virtualization-layer access enabling mass hypervisor encryption, the highest-impact ransomware detonation pattern.
• CVE-2026-63077 (JetBrains TeamCity deserialization) — CI/CD server compromise, acutely relevant to the technology-sector listings and to supply-chain pivot risk.
• CVE-2026-48027 (Nx Console embedded malicious code) — developer-workstation supply-chain exposure, again relevant to the technology firms claimed.

Organizations in the targeted sectors should treat unpatched instances of these products as assumed-contested, regardless of the N0N campaign.

Detection Engineering

The following detections target the generic pre-encryption playbook N0N's observed pattern implies: edge/VPN initial access, lateral movement via admin tooling, staged exfiltration, and backup destruction before detonation.

---
title: N0N Campaign - RDP or VPN Brute Force Followed by Successful Logon
id: 8f3a2c11-n0n1-4a01-9b02-0a1b2c3d4e01
status: experimental
description: Detects a burst of failed logons followed by a successful interactive or network logon from the same source, consistent with brute-forced RDP/VPN entry observed in mid-tier ransomware intrusions.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
logsource:
  product: windows
  service: security
detection:
  sel_failed:
    EventID: 4625
  sel_success:
    EventID: 4624
    LogonType:
      - 3
      - 10
  condition: sel_failed | count() by SourceAddress > 20
  timeframe: 10m
falsepositives:
  - Misconfigured service accounts
  - Legitimate password-spray from vulnerability scanners
level: high
tags:
  - attack.t1110
  - attack.t1078
---
title: N0N Campaign - PsExec or WMI Remote Service Execution
id: 8f3a2c11-n0n1-4a02-9b02-0a1b2c3d4e02
status: experimental
description: Detects remote service creation via PsExec-style named pipes or WMI process spawn, a standard lateral movement step in ransomware pre-detonation playbooks.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  sel_psexec:
    Image|endswith:
      - '\\PSEXESVC.exe'
      - '\\psexec.exe'
      - '\\paexec.exe'
  sel_wmi_spawn:
    ParentImage|endswith: '\\WmiPrvSE.exe'
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\pwsh.exe'
      - '\\rundll32.exe'
  condition: sel_psexec or sel_wmi_spawn
falsepositives:
  - Enterprise software distribution (SCCM, PDQ) — baseline and whitelist known deployment servers
level: high
tags:
  - attack.t1569.002
  - attack.t1047
  - attack.s0029
---
title: N0N Campaign - Pre-Encryption Staging and Backup Destruction
id: 8f3a2c11-n0n1-4a03-9b02-0a1b2c3d4e03
status: experimental
description: Detects volume shadow copy deletion, boot config tampering, or mass archive creation via rar/7z — the final T-minus actions before ransomware detonation and double-extortion staging.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  sel_vss:
    Image|endswith:
      - '\\vssadmin.exe'
      - '\\wmic.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'resize shadowstorage'
  sel_bcd:
    Image|endswith: '\\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'ignoreallfailures'
  sel_archive:
    Image|endswith:
      - '\\rar.exe'
      - '\\7z.exe'
      - '\\7za.exe'
    CommandLine|contains:
      - ' a '
      - '-p'
  condition: sel_vss or sel_bcd or sel_archive
falsepositives:
  - Backup administrators performing legitimate shadow copy maintenance
  - Developers creating password-protected archives
level: critical
tags:
  - attack.t1490
  - attack.t1560.001
  - attack.t1486

KQL — Microsoft Sentinel: pre-ransomware staging hunt

This query hunts the T-minus window: hosts that show archive-utility execution, shadow copy tampering, or unusual outbound transfer volume within a 24-hour sliding window — the staging signature before a N0N-style double-extortion detonation.

let lookback = 7d;
let staging_procs = dynamic(["rar.exe","7z.exe","7za.exe","winrar.exe","vssadmin.exe","bcdedit.exe","wmic.exe","rclone.exe","megasync.exe"]);
let SuspiciousStaging =
    DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where FileName in~ (staging_procs)
    | extend SuspiciousCmd =
        case(
            ProcessCommandLine has_any ("delete shadows","shadowcopy delete","recoveryenabled no","ignoreallfailures","-p","copy \\\\"), 1,
            0)
    | where SuspiciousCmd == 1 or FileName in~ ("rar.exe","7z.exe","7za.exe","rclone.exe")
    | summarize StagingEvents=count(), Commands=make_set(ProcessCommandLine, 5), FirstSeen=min(Timestamp), LastSeen=max(Timestamp)
        by DeviceName, InitiatingProcessAccountName
    | where StagingEvents >= 1;
let BeaconingHosts =
    DeviceNetworkEvents
    | where Timestamp > ago(lookback)
    | where RemotePort in (443, 8443, 8080)
    | summarize Connections=count(), UniqueDestinations=dcount(RemoteIP), TotalBytesSent=sum(SentBytes)
        by DeviceName, bin(Timestamp, 1h)
    | where TotalBytesSent > 500000000 or (Connections > 100 and UniqueDestinations < 5)
    | summarize HighVolumeHours=count(), MaxBytesPerHour=max(TotalBytesSent) by DeviceName;
SuspiciousStaging
| join kind=inner BeaconingHosts on DeviceName
| project DeviceName, InitiatingProcessAccountName, StagingEvents, HighVolumeHours, MaxBytesPerHour, FirstSeen, LastSeen, Commands
| order by HighVolumeHours desc

A host appearing in both sets — staging tooling plus sustained high-volume egress to few destinations — is a priority-one investigation. That combination rarely has a benign explanation.

Rapid response — PowerShell: T-minus indicator sweep

Run this on any host flagged by the detections above. It checks the four fastest pre-encryption indicators: exposed RDP, shadow copy integrity, scheduled tasks created in the last 7 days (persistence), and recent suspicious service installations.

# N0N T-minus indicator sweep - run elevated
$days = 7
$cutoff = (Get-Date).AddDays(-$days)
$report = @()

# 1. RDP exposure check
$rdpEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue).fDenyTSConnections
$nlaEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue).UserAuthentication
$rdpListening = (Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue) -ne $null
$report += [pscustomobject]@{Check='RDP_Status'; Finding="RDP Listening=$rdpListening, Enabled=($rdpEnabled -eq 0), NLA=($nlaEnabled -eq 1)"}

# 2. Volume Shadow Copy integrity - ransomware deletes these first
$shadows = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue
$shadowCount = ($shadows | Measure-Object).Count
$report += [pscustomobject]@{Check='ShadowCopies'; Finding="$shadowCount shadow copies present (0 after backups ran = RED FLAG)"}

# 3. Scheduled tasks created in last 7 days (persistence / detonation scheduling)
$newTasks = Get-ScheduledTask | Where-Object {$_.Date -and ([datetime]$_.Date) -gt $cutoff} |
    Select-Object TaskName, TaskPath, Date, @{N='Action';E={($_.Actions | Select-Object -First 1).Execute}}
foreach ($t in $newTasks) { $report += [pscustomobject]@{Check='NewScheduledTask'; Finding="$($t.TaskPath)$($t.TaskName) -> $($t.Action) [created $($t.Date)]"} }

# 4. Recently installed services with suspicious binary paths (TEMP, AppData, ProgramData)
$svcEvents = Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=$cutoff} -ErrorAction SilentlyContinue
foreach ($e in $svcEvents) {
    $msg = $e.Message
    if ($msg -match 'AppData|ProgramData|\\Temp\\|users\\public') {
        $report += [pscustomobject]@{Check='SuspiciousService'; Finding="Service installed $($e.TimeCreated): $($msg.Substring(0,[Math]::Min(200,$msg.Length)))"}
    }
}

$report | Format-Table -AutoSize -Wrap
$report | Export-Csv -Path "$env:TEMP\n0n_tsweep_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation
if (($report | Where-Object {$_.Check -in 'NewScheduledTask','SuspiciousService'}) -or $shadowCount -eq 0) {
    Write-Warning 'T-minus indicators present. Escalate to IR immediately and isolate this host.'
}

Incident Response Priorities

T-minus detection checklist — before encryption fires

1. Shadow copy deletion events (vssadmin, wmic, PowerShell Get-WmiObject Win32_ShadowCopy | Remove) — the single highest-fidelity pre-detonation signal.
2. Mass archive creation (rar/7z with password flags) on file servers or executive/HR/finance endpoints — exfil staging for the double-extortion claim.
3. New scheduled tasks or 7045 service installs across multiple hosts within a short window — detonation scheduling.
4. EDR/AV tampering: service stop attempts on security tooling, defender exclusion additions, or driver-based EDR killers.
5. Egress anomalies: sustained multi-GB/hour outbound to unfamiliar ASNs or file-sharing endpoints (MEGA, rclone remotes).
6. Backup console logins from unusual admin accounts — crews delete backups before detonating.

Assets this profile of gang historically prioritizes for exfiltration

• Healthcare victims: patient records, billing data, and anything triggering HIPAA/HITECH or Australian NDB notification — maximum regulatory leverage.
• Professional services: client confidential files, legal matters, M&A material — leverage extends to their clients.
• Technology firms: source code, signing certificates, CI/CD credentials, customer contracts — plus supply-chain pivot potential (note the TeamCity and Nx CVE exposure above).
• All sectors: finance department mailboxes, HR/payroll exports, cyber-insurance policy documents (gangs read the policy to size the demand).

Containment actions, ordered by urgency

1. Isolate, do not power off suspected staging hosts — volatile memory holds encryption keys and beacon configs needed for forensics.
2. Disable the staging accounts identified in the KQL hunt; force enterprise-wide credential resets for any account seen in lateral movement telemetry, prioritizing Tier-0.
3. Block egress to exfil destinations at the proxy/firewall; enable TLS inspection alerting on high-volume uploads if not already active.
4. Snapshot and protect backups NOW — move backup infrastructure behind a jump host, verify immutability, and pull one restore test before assuming recoverability.
5. Patch the KEV edge cases immediately (Check Point IKEv1, Cisco FMC, vCenter) — if the gang's access vector is an unpatched edge device, containment fails until it is closed.
6. Engage IR retainers and counsel early — for healthcare entities, regulatory clocks (HIPAA 60-day, NDB 30-day assessment) start on awareness of a suspected incident, not confirmation.

Hardening Recommendations

Immediate (24 hours)

• Patch or mitigate all five KEV entries listed above where present in your environment — Check Point IKEv1 authentication, Cisco FMC hard-coded credentials, vCenter path traversal, TeamCity deserialization, and the Nx Console supply-chain incident. These are confirmed ransomware-used vulnerabilities; this is not discretionary.
• Deploy the three Sigma rules and the Sentinel hunt from this briefing; run the KQL retrospectively over the last 14 days.
• Kill direct RDP exposure: verify zero 3389 listeners are internet-reachable; enforce NLA; move admin access behind VPN + MFA or, preferably, a PAM/jump solution.
• Enable MFA on every remote-access path — VPN, VDI, OWA, and remote management tooling. Mid-tier crews overwhelmingly enter through phished or purchased credentials on un-MFA'd paths.
• Run the PowerShell T-minus sweep on domain controllers, file servers, backup servers, and hypervisor management hosts.

Short-term (2 weeks)

• Segment hypervisor and backup planes: vCenter and backup consoles on isolated management VLANs, reachable only from PAWs, with no route from general user subnets. Hypervisor-level encryption is the highest-impact ransomware outcome; make the management plane unreachable.
• Deploy decoy artifacts: canary file shares and honey credentials that alert on any touch — ransomware staging trips these reliably.
• Immutable, offline, and tested backups: 3-2-1 with at least one copy logically air-gapped; automate restore testing. N0N's double-extortion model means backups solve availability but not confidentiality — plan disclosure decision trees with counsel in advance.
• Egress control architecture: default-deny outbound for servers, DNS filtering, and byte-volume alerting per host. Exfil is the extortion engine; choking it changes the economics.
• Attack surface management for edge devices: continuous external scanning for VPN concentrators, firewall management interfaces, and CI/CD servers — the exact product classes in the current KEV set.

Security Arsenal monitors ransomware leak sites continuously. Listings described here are threat-actor claims; organizations named have not been confirmed breached. If your organization appears on a leak site or you have information about these claims, contact security@securityarsenal.com.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub