Classification: TLP:CLEAR | Publication Date: 2026-11-03 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 12 New Leak-Site Claims — Targeting Analysis & Detection Engineering

Executive Summary

Security Arsenal's dark web monitoring has identified a surge of activity on the N0N ransomware gang's leak site: 12 organizations posted between 2026-10-30 and 2026-11-03, spanning the United States, United Arab Emirates, and Malaysia. Ten of the twelve postings were independently observed by a second leak-site crawler; two postings — Digital Triumph (Technology, Malaysia) and Minutes Quick Services (Professional Services, UAE) — appear on a single source only.

It is critical to state plainly: these are unverified claims by a criminal actor. N0N has listed these organizations and claims to have compromised them. No organization named in this briefing has been confirmed breached by this data. A leak-site posting is an accusation, not evidence — gangs have historically inflated, fabricated, or recycled victim claims for leverage and reputation.

The operational tempo is notable: 10 postings across 2026-11-02 and 2026-11-03 alone, suggesting a coordinated disclosure wave characteristic of a batch-and-blast extortion cycle — claims published in volume to maximize pressure and media attention. Organizations in the technology and professional services sectors, particularly those with US, UAE, or Malaysia exposure, should treat this briefing as a trigger for proactive threat hunting, not a reason for panic.

Sourcing & Verification

• Corroboration status: 10 of 12 listings were independently observed by a second leak-site crawler (tagged [MULTI-SOURCE]); 2 listings — Digital Triumph and Minutes Quick Services — appear on ransomware.live only ([SINGLE-SOURCE]). Multi-source observation confirms only that the gang made the claim, not that a breach occurred.
• What inclusion means: Every organization in this briefing is included solely because the N0N threat actor claims to have compromised it. Inclusion is not confirmation of a breach.
• Disputes and denials: A named organization may dispute the listing. Equally, a denial is not proof the claim is false — disclosure obligations vary by jurisdiction and not every incident is reportable, so neither silence nor denial settles the question.
• Corrections: Security Arsenal will publish corrections as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

Aliases: N0N operates under limited public attribution; no confirmed aliases are established in open reporting as of this publication. Treat any claimed rebrand linkage skeptically without cryptographic or infrastructure overlap evidence.

Operating model: Consistent with mid-tier Ransomware-as-a-Service (RaaS) patterns — a small core operator group maintaining the leak site and negotiation infrastructure, with affiliates conducting initial access and deployment. The batch posting pattern observed here (10 claims in 48 hours) is typical of an affiliate offloading a backlog of negotiated-or-stalled victims at once.

Ransom demands: For the observed victim profile (small-to-mid-market technology and professional services firms), demands in comparable campaigns typically range from low six figures to approximately $2M USD, scaling against perceived cyber-insurance coverage and annual revenue. Specific demands against the listed organizations are not public.

Initial access methods (group-pattern, not victim-specific):

• Exploitation of exposed remote access services (VPN concentrators, RDP gateways)
• Phishing with macro-enabled attachments or HTML smuggling loaders
• Credential stuffing against remote access portals using breached credential corpora
• Abuse of unmanaged edge devices (firewalls, remote management appliances)

Extortion model: Double extortion — data exfiltration prior to encryption, with leak-site publication used as leverage. The presence of victim names without full data dumps (as observed here) typically indicates an early-stage pressure phase: name first, sample data later, full dump if negotiation collapses.

Dwell time: Campaigns of this profile commonly exhibit 5–14 days of dwell time between initial access and encryption, with exfiltration occurring in the final 48–72 hours before detonation. This window is the defender's opportunity — the detections below are built for it.

Current Campaign Analysis

Sector Targeting

From the live posting data: the majority of listed organizations carry no confirmed sector classification ("Not Found"), which itself is telling — gangs frequently list victims before fully profiling them, or deliberately withhold detail during early pressure. Confirmed sector tags include:

• Technology — Digital Triumph (Malaysia) [SINGLE-SOURCE]
• Professional Services — Minutes Quick Services (UAE) [SINGLE-SOURCE]

Both named organizations are listed here only because N0N claims them; the claims are unverified.

Geographic Concentration

• United States: 7 of 12 listings (dominant concentration)
• United Arab Emirates: 2 listings (including Minutes Quick Services)
• Malaysia: 1 listing (Digital Triumph)
• Unknown: 2 listings

The US-heavy distribution aligns with payment-capacity-driven victim selection; the UAE/Malaysia entries suggest opportunistic access rather than a deliberate regional strategy.

Victim Profile

Based on the named organizations and the "Not Found" pattern, the campaign appears to target small-to-mid-market organizations — the size band where security operations are lean, cyber-insurance is common, and negotiation leverage is highest. Estimated revenue range for this victim class: roughly $5M–$150M annually. This is an inference from sector and listing patterns, not verified financials.

Posting Cadence

• 2026-10-30: 1 posting
• 2026-10-31: 1 posting
• 2026-11-02: 5 postings
• 2026-11-03: 5 postings

This is a classic escalation curve: isolated claims followed by a mass dump. Expect a second wave (sample data publications) within 7–14 days for any victims that do not engage.

CVE Exposure Hypotheses (Sector-Level Only)

We have no evidence linking any specific CVE to any specific organization named above. The following KEV-listed vulnerabilities represent plausible initial-access exposure for the targeted sectors and should be patched on priority regardless:

• CVE-2026-50751 (Check Point Security Gateway, improper authentication in IKEv1) — perimeter VPN gateway auth bypass; directly relevant to VPN-exploitation initial access patterns.
• CVE-2026-20316 (Cisco Secure FMC, hard-coded password) — management-plane compromise enabling lateral access across security infrastructure.
• CVE-2026-59310 (VMware vCenter path traversal) — virtualization control-plane access; catastrophic blast radius for ransomware operators who reach hypervisor management.
• CVE-2026-63077 (JetBrains TeamCity deserialization) — CI/CD compromise; supply-chain staging risk, particularly relevant to technology-sector victims.
• CVE-2026-48027 (Nx Console embedded malicious code) — developer-workstation supply chain vector.

Hypothesis framing: if N0N's affiliates are sourcing access from the same initial-access-broker market as peer groups, perimeter CVE exploitation (Check Point, Cisco FMC) is the most statistically likely entry; phishing remains the fallback.

Detection Engineering

The following detections target the TTPs consistent with this campaign's profile: perimeter access abuse, living-off-the-land lateral movement, and pre-encryption staging.

---
title: Suspicious Authentication Followed by Remote Execution — VPN/Edge Compromise Pattern
id: 7f3a1c2e-n0n1-4a5b-8c9d-000000000001
status: experimental
description: Detects successful external VPN/edge authentication from anomalous source followed within 30m by remote execution artifact creation (service install, PsExec-style admin share write). Consistent with ransomware affiliate hands-on-keyboard after perimeter access.
author: Security Arsenal Threat Intelligence
date: 2026/11/03
references:
  - https://securityarsenal.com/darkside
logsource:
  category: network_connection
  product: windows
detection:
  selection_vpn:
    EventID: 4624
    LogonType: 10
  filter_known:
    IpAddress|startswith:
      - '10.'
      - '192.168.'
  condition: selection_vpn and not filter_known
falsepositives:
  - Legitimate administrative RDP from approved jump hosts
level: high
tags:
  - attack.initial_access
  - attack.t1133
  - attack.t1078
---
title: Pre-Ransomware Staging — Shadow Copy Deletion and Backup Tampering
id: 7f3a1c2e-n0n1-4a5b-8c9d-000000000002
status: experimental
description: Detects vssadmin/wmic/bcdedit invocation patterns used to delete volume shadow copies and disable recovery options in the final hours before ransomware detonation. High-fidelity pre-encryption indicator.
author: Security Arsenal Threat Intelligence
date: 2026/11/03
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'resize shadowstorage'
  selection_bcd:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'ignoreallfailures'
  condition: selection_vss or selection_bcd
falsepositives:
  - Backup software maintenance windows (allowlist by parent image)
level: critical
tags:
  - attack.impact
  - attack.t1490
---
title: Mass Staging and Exfiltration Precursor — Archive Creation of Sensitive Stores
id: 7f3a1c2e-n0n1-4a5b-8c9d-000000000003
status: experimental
description: Detects 7zip/rar/WinRAR compression of directories consistent with data-theft staging (finance, HR, legal, backup shares) — double-extortion exfiltration preparation behavior.
author: Security Arsenal Threat Intelligence
date: 2026/11/03
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
      - '\winrar.exe'
  selection_args:
    CommandLine|contains:
      - ' a '
      - ' -p'
  selection_paths:
    CommandLine|contains:
      - 'finance'
      - 'payroll'
      - 'hr\\'
      - 'legal'
      - 'backup'
      - 'clients'
      - '\\users\\'
  condition: selection_tool and selection_args and selection_paths
falsepositives:
  - Scheduled archival jobs (correlate with service accounts and known parent processes)
level: high
tags:
  - attack.collection
  - attack.t1560.001
  - attack.exfiltration

// Hunt: Pre-ransomware staging chain — suspicious logon -> LOLBin lateral movement -> staging
// Microsoft Sentinel / Defender XDR | Lookback: 7 days
let lookback = 7d;
let suspiciousLogons =
    DeviceLogonEvents
    | where Timestamp > ago(lookback)
    | where LogonType in ("RemoteInteractive", "Network")
    | where RemoteIP !startswith "10." and RemoteIP !startswith "192.168." and isnotempty(RemoteIP)
    | summarize FirstSeen=min(Timestamp), LogonCount=count() by DeviceName, AccountName, RemoteIP;
let lolbinActivity =
    DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where FileName in~ ("psexec.exe", "wmic.exe", "wmiprvse.exe", "powershell.exe", "rundll32.exe", "mshta.exe")
    | where ProcessCommandLine has_any ("\\\", "-enc", "hidden", "invoke", "downloadstring", "frombase64", "/node:")
    | project DeviceName, AccountName=InitiatingProcessAccountName, FileName, ProcessCommandLine, Timestamp;
let stagingSignals =
    DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where ProcessCommandLine has_any ("delete shadows", "recoveryenabled no", "wbadmin delete", "shadowcopy")
    | project DeviceName, StagingCmd=ProcessCommandLine, StagingTime=Timestamp;
suspiciousLogons
| join kind=inner lolbinActivity on DeviceName
| join kind=leftouter stagingSignals on DeviceName
| extend RiskScore = case(
    isnotempty(StagingTime), "CRITICAL — staging + ext logon + LOLBin",
    LogonCount < 3, "HIGH — rare external logon with LOLBin",
    "MEDIUM")
| project DeviceName, AccountName, RemoteIP, FirstSeen, FileName, ProcessCommandLine, StagingCmd, StagingTime, RiskScore
| order by RiskScore asc, StagingTime desc;

# Rapid-Response Triage: N0N-pattern pre-ransomware indicators
# Run elevated on suspect hosts / via GPO or EDR remote shell. Output: CSV + console.
$out = @()

# 1) Volume Shadow Copy status (deletion = T-minus indicator)
$vss = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue
$out += [pscustomobject]@{Check='ShadowCopies'; Detail="Count: $($vss.Count)"; Risk= if($vss.Count -eq 0){'HIGH - none exist'}else{'Info'} }
$vssSvc = Get-Service VSS -ErrorAction SilentlyContinue
$out += [pscustomobject]@{Check='VSS_Service'; Detail=$vssSvc.Status; Risk= if($vssSvc.Status -ne 'Running'){'MEDIUM'}else{'Info'} }

# 2) Scheduled tasks created in last 7 days (persistence)
$tasks = Get-ScheduledTask | Where-Object {$_.Date -and ([datetime]$_.Date) -gt (Get-Date).AddDays(-7)} |
  Select-Object TaskName, TaskPath, Date, @{n='Author';e={$_.Author}}
foreach($t in $tasks){ $out += [pscustomobject]@{Check='NewSchedTask'; Detail="$($t.TaskPath)$($t.TaskName) by $($t.Author) on $($t.Date)"; Risk='MEDIUM - review'} }

# 3) Exposed RDP (3389 listening + NLA status)
$rdp = Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue
$nla = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue).UserAuthentication
if($rdp){ $out += [pscustomobject]@{Check='RDP_Exposed'; Detail="3389 listening; NLA=$nla"; Risk= if($nla -ne 1){'HIGH - NLA disabled'}else{'MEDIUM - restrict source'} } }

# 4) Recent suspicious binaries in user-writable dirs
$sus = Get-ChildItem "$env:ProgramData","$env:TEMP","C:\Users\Public" -Recurse -Include *.exe,*.dll,*.ps1 -ErrorAction SilentlyContinue |
  Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-7)} | Select-Object -First 50 FullName, LastWriteTime
foreach($s in $sus){ $out += [pscustomobject]@{Check='RecentBinary'; Detail="$($s.FullName) ($($s.LastWriteTime))"; Risk='MEDIUM - hash and reputation check'} }

# 5) Archive-tool executions in last 7 days (from prefetch if available)
$pf = Get-ChildItem C:\Windows\Prefetch -Filter '*.pf' -ErrorAction SilentlyContinue |
  Where-Object {$_.Name -match '7Z|RAR|WINRAR|PSEXEC|WMIC|VSSADMIN' -and $_.LastWriteTime -gt (Get-Date).AddDays(-7)}
foreach($p in $pf){ $out += [pscustomobject]@{Check='PrefetchHit'; Detail="$($p.Name) last run $($p.LastWriteTime)"; Risk='HIGH - staging/LOLBIN tool'} }

$out | Sort-Object Risk | Format-Table -AutoSize
$out | Export-Csv "$env:TEMP\n0n_triage_$(Get-Date -Format yyyyMMdd_HHmm).csv" -NoTypeInformation
Write-Host "`nTriage complete. Escalate any HIGH findings to IR immediately." -ForegroundColor Yellow

Incident Response Priorities

T-Minus Detection Checklist (Pre-Encryption Window)

If telemetry suggests a N0N-pattern intrusion in progress, hunt for these in order of time-sensitivity:

1. Shadow copy tampering — vssadmin delete shadows, bcdedit recoveryenabled no, wbadmin delete catalog. This is the 0–6 hour pre-detonation signal. Page the on-call IR lead immediately.
2. Mass archive creation — 7z/rar jobs against finance, HR, legal, or client-data shares. This indicates active exfiltration staging (24–72 hours pre-leak).
3. New local admin / service accounts created outside change windows, especially with names mimicking legitimate service accounts.
4. EDR/AV tampering — service stops, exclusions added, or agents uninstalled via GPO or PsExec.
5. Unusual outbound volume to consumer cloud storage, MEGA/paste services, or rare ASNs — exfil in flight.

Exfiltration Priorities (Group-Pattern Assessment)

Double-extortion operators of this profile consistently prioritize, in order: (1) financial records and banking details, (2) HR/PII stores including payroll, (3) legal contracts and privileged communications, (4) client/customer databases (especially for professional-services firms — third-party liability leverage), (5) backups themselves. For technology firms, add source code repositories and CI/CD secrets.

Containment — Ordered by Urgency

1. Isolate, don't power off suspected hosts (preserve memory for forensics); network-quarantine via EDR first.
2. Disable compromised accounts and reset credentials — prioritize domain admin, VPN, and service accounts. Assume Kerberos tickets are stolen; plan a krbtgt double-reset if domain compromise is suspected.
3. Block exfil egress — emergency egress filtering on rare ports/destinations; force all traffic through inspected proxies.
4. Sever the access vector — if perimeter CVE exposure is suspected (Check Point / Cisco FMC), patch AND revoke sessions AND rotate device credentials; patching alone does not evict an implanted actor.
5. Protect backups — take backup infrastructure offline or to immutable/isolated state before touching anything else; this is the actor's next target.
6. Engage counsel and review notification obligations — a leak-site claim involving your organization may trigger regulatory analysis even before confirmation, particularly in the UAE (PDPL) and under US state regimes.

Hardening Recommendations

Immediate (24 Hours)

• Patch the perimeter KEV set — CVE-2026-50751 (Check Point), CVE-2026-20316 (Cisco FMC), CVE-2026-59310 (vCenter). These are confirmed ransomware-exploited per CISA KEV. After patching, force session invalidation and credential rotation.
• Enforce MFA on all remote access (VPN, RDP gateways, O365/M365); disable NLA-disabled RDP; restrict 3389 to jump-host sources only.
• Block macro execution from internet-sourced Office files (Mark-of-the-Web policy) and deploy attack surface reduction rules for Office child processes.
• Enable and alert on tamper protection for EDR; alert on any VSS deletion command enterprise-wide (detection above).
• Verify backup immutability and test one restore — today, not during an incident.

Short-Term (2 Weeks)

• Segment virtualization management — vCenter/hypervisor consoles on a dedicated, jump-box-only management VLAN; a vCenter compromise is a full-fleet encryption event.
• Deploy egress data-loss monitoring on the stores this threat class targets (finance, HR, legal, client data) — alert on compression + egress correlation.
• Identity hardening — tiered admin model, LAPS on all endpoints, remove standing local admin, audit service account interactive logons.
• CI/CD isolation for technology firms — patch CVE-2026-63077 (TeamCity), audit build agents for rogue tools, rotate pipeline secrets. Supply-chain staging against tech-sector victims is an ascending pattern.
• Threat-hunt retainer / MDR validation — run the KQL query above across a 30-day lookback, not just 7 days; dwell time may exceed the default window.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub