Classification: TLP:CLEAR | Publication Date: 2026-10-27 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 12 New Leak-Site Listings — Sector Targeting Analysis & Detection Rules

Executive Summary

Between 2026-10-24 and 2026-10-27, the ransomware group tracked as N0N listed 12 organizations on its dark web leak site, an accelerated posting cadence that signals an active campaign wave. The claimed victims span Energy & Utilities, Manufacturing, Technology, Professional Services, and Healthcare across six countries: United Arab Emirates, Spain, Bulgaria, United States, Portugal, and Argentina. Notably, two of the most recent listings are energy-sector organizations in Spain and Bulgaria, suggesting possible sector-interest clustering alongside the group's historically opportunistic targeting.

Every listing in this dataset is an unverified claim by a criminal actor. Two of the 12 postings were independently observed by a second leak-site crawler (confirming the gang published the claim); the remaining 10 appear on a single monitoring source only. No listing — at any corroboration tier — confirms that a breach occurred. Only the named organizations or their regulators can confirm that.

Security teams in the affected sectors and geographies should treat this bulletin as a prompt to (1) run the hunt queries below against the last 30 days of telemetry, (2) verify patching posture against the KEV-listed vulnerabilities N0N is assessed to exploit, and (3) review the pre-encryption detection checklist in Section 6.

Sourcing & Verification

• Corroboration status: 2 of the 12 listings in this dataset were independently observed by a second leak-site crawler (MULTI-SOURCE: Company #111 and Ingelectus Innovative Electrical Solutions S.L.). The remaining 10 listings appear on ransomware.live only (SINGLE-SOURCE), with no second-crawler confirmation that the posting even exists.
• What inclusion means: Inclusion in this briefing reflects the threat actor's claim as published on its leak site. It is not confirmation of a breach, an intrusion, or data theft. Multi-source corroboration confirms only that the gang made the claim — nothing more.
• What it does not mean: A named organization may dispute or deny the listing. A denial is likewise not proof the claim is false — disclosure obligations vary by jurisdiction, sector, and data type, and not every incident is reportable. Neither silence nor denial settles the question.
• Corrections: Security Arsenal will publish corrections as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

Profile elements are drawn from open-source tracking and observed leak-site behavior. Attribution in the ransomware ecosystem is fluid; treat operational details as assessed, not certain.

• Aliases / tracking: Tracked as N0N; no widely accepted alternative aliases are established at this time. The group maintains its own dedicated leak site (DLS) on Tor.
• Operating model: Assessed as a closed or semi-closed operation rather than a high-volume open RaaS program. Posting volume (12 listings in a recent window) is consistent with a small crew or tightly managed affiliate set rather than mass-scale affiliate recruitment.
• Ransom demands: Observed demands in comparable mid-tier operations typically range from low six figures to low seven figures (USD, cryptocurrency), scaled to victim revenue. Double-extortion pressure (publication countdowns, incremental data teasers) is standard.
• Initial access methods (assessed): Consistent with the broader ecosystem, likely vectors include exploitation of internet-facing infrastructure (VPN concentrators, firewall management planes, virtualization management), phishing with macro/loader payloads, and exposed RDP. The KEV-listed vulnerabilities discussed in Section 4 represent sector-level exposure the gang is positioned to exploit — we have no evidence linking any specific CVE to any specific named organization in this dataset.
• Extortion model: Double extortion — data theft claimed prior to encryption, with leak-site publication used as leverage. Listings appear before or alongside negotiation windows.
• Dwell time: For operations of this profile, assessed dwell time from initial access to detonation typically ranges from days to roughly two weeks — which is precisely why pre-encryption detection (Section 6) matters more than encryption detection.

Current Campaign Analysis

Claimed victim set (as listed on N0N's leak site)

Sector targeting

• Manufacturing (4 listings) is the single largest cluster — consistent with the ecosystem-wide preference for organizations with high downtime cost and often weaker OT/IT segmentation.
• Energy & Utilities (2 listings), Technology (2), and Professional Services (2) follow. The two professional-services listings include a family law practice and an advisory firm — organizations holding highly sensitive client data where extortion pressure is amplified by confidentiality obligations.
• Healthcare (1) — Asisken Asistencia Médica S.A. in Argentina — if the claim has any substance, carries patient-data regulatory exposure under Argentine data protection law.

Geographic concentration

Six countries with no single dominant geography: US (4), then one each in AE, ES, BG, PT, AR, plus three listings with no confirmed country. The spread across the Iberian Peninsula (ES, PT), Eastern Europe (BG), and the Gulf (AE) in the same window hints at scanning-driven opportunism rather than a geographically focused intrusion set.

Victim profile

The named organizations skew toward small-to-mid-size enterprises — regional manufacturers, a family law practice, a medical assistance provider, an electrical engineering firm. Estimated revenue range: roughly $5M–$150M. This is the classic mid-market ransomware sweet spot: large enough to pay, small enough to lack 24/7 SOC coverage.

Posting frequency / escalation

12 listings across 4 consecutive days (2026-10-24 through 2026-10-27), including a five-listing day on 2026-10-25. Batch-posting of this kind often indicates either (a) a completed wave of intrusions from a single access vector being monetized simultaneously, or (b) negotiation failures being published in bulk to re-establish pressure. Either way, velocity this high typically precedes a quieter period while the crew works the next access wave.

CVE exposure hypothesis (sector-level, not victim-level)

We have no evidence that any specific CVE was used against any named organization above. However, the following actively exploited vulnerabilities (CISA KEV, confirmed ransomware use) represent plausible initial-access exposure for the sectors N0N is currently claiming, and should be treated as priority patch/verify items:

• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1 key exchange): perimeter device compromise; the single most common ransomware front door.
• CVE-2026-20316 — Cisco Secure FMC hard-coded password: management-plane takeover of the firewall fleet itself.
• CVE-2026-59310 — VMware vCenter path traversal: hypervisor management-plane access — particularly relevant given the cluster of manufacturing/energy victims whose infrastructure typically consolidates on vSphere. vCenter compromise enables mass encryption of the virtual estate in one action.
• CVE-2026-63077 — JetBrains TeamCity deserialization: CI/CD server compromise, relevant to the technology-sector listings and to supply-chain staging.
• CVE-2026-48027 — Nx Console embedded malicious code: developer-workstation supply-chain foothold.

Assessment (hypothesis only): the multi-country, multi-sector batch pattern is most consistent with opportunistic exploitation of one or two perimeter/management-plane vulnerabilities — the Check Point and Cisco FMC items are the strongest candidates for scanning-driven waves. Unpatched vCenter is the most consequential post-access exposure.

Detection Engineering

The following detections target the TTPs associated with this operational profile: perimeter exploitation follow-on activity, phishing-driven execution, RDP brute force, PsExec/WMI lateral movement, Cobalt Strike-style beaconing, and pre-encryption data staging.

---
title: N0N-Campaign — RDP Brute Force Followed by Successful Logon
id: 8f3a1c22-7b1e-4d9a-9c5f-n0n000000001
status: experimental
description: Detects burst of failed RDP logons (4625) followed by a successful network logon (4624 type 3/10) from the same source — consistent with brute-forced perimeter access observed in opportunistic ransomware waves.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
date: 2026/10/27
logsource:
  product: windows
  service: security
detection:
  selection_failed:
    EventID: 4625
    LogonType:
      - 3
      - 10
  selection_success:
    EventID: 4624
    LogonType:
      - 3
      - 10
  condition: selection_failed | count() by IpAddress > 20
  timeframe: 10m
level: high
tags:
  - attack.initial_access
  - attack.t1110
  - attack.t1021.001
---
title: N0N-Campaign — PsExec or Remote Service Execution for Lateral Movement
id: 8f3a1c22-7b1e-4d9a-9c5f-n0n000000002
status: experimental
description: Detects PsExec-style service installation (7045 with PSEXESVC) and ADMIN$ share service creation — lateral movement tradecraft used pre-encryption by mid-tier ransomware crews.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
date: 2026/10/27
logsource:
  product: windows
  service: system
detection:
  selection_service:
    EventID: 7045
  filter_psexec:
    ServiceName|contains:
      - 'PSEXESVC'
      - 'PAExec'
      - 'csexec'
  filter_random_name:
    ServiceFileName|contains: 'ADMIN$'
  condition: selection_service and 1 of filter_*
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002
---
title: N0N-Campaign — Pre-Encryption Staging — Shadow Copy Deletion and Archive Creation
id: 8f3a1c22-7b1e-4d9a-9c5f-n0n000000003
status: experimental
description: Detects Volume Shadow Copy deletion (vssadmin/wmic) and mass archive utility execution (rar/7z/WinRAR against large directories) — the two highest-signal pre-detonation behaviors in double-extortion ransomware playbooks.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
date: 2026/10/27
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    - Image|endswith: '\vssadmin.exe'
      CommandLine|contains:
        - 'delete shadows'
        - 'Delete Shadows'
    - Image|endswith: '\wmic.exe'
      CommandLine|contains: 'shadowcopy'
    - Image|endswith: '\bcdedit.exe'
      CommandLine|contains: 'recoveryenabled'
  selection_archive:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\7za.exe'
      - '\winrar.exe'
    CommandLine|contains:
      - ' a '
      - ' -p'
  condition: selection_vss or selection_archive
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.collection
  - attack.t1560.001

Microsoft Sentinel hunt query — pre-ransomware staging and lateral movement correlated per host over 24 hours:

// N0N-campaign hunt: correlate staging, lateral movement, and backup tampering per device
let lookback = 24h;
let staging =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName in~ ("rar.exe","7z.exe","7za.exe","winrar.exe")
       or ProcessCommandLine has_any ("delete shadows","shadowcopy delete","recoveryenabled no")
    | project StageTime=TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine;
let lateral =
    DeviceNetworkEvents
    | where TimeGenerated > ago(lookback)
    | where RemotePort in (445, 3389, 5985)
    | where InitiatingProcessFileName in~ ("psexec.exe","psexesvc.exe","wmiprvse.exe","powershell.exe","wmic.exe")
    | project MoveTime=TimeGenerated, DeviceName, InitiatingProcessAccountName, RemoteIP, RemotePort, InitiatingProcessFileName;
let exfil =
    DeviceNetworkEvents
    | where TimeGenerated > ago(lookback)
    | where RemoteUrl has_any ("mega.nz","file.io","transfer.sh","gofile.io","anonfiles","temp.sh")
       or (RemotePort == 443 and BytesSent > 500000000)
    | project ExfilTime=TimeGenerated, DeviceName, RemoteUrl, RemoteIP, BytesSent;
staging
| join kind=leftouter lateral on DeviceName
| join kind=leftouter exfil on DeviceName
| extend PreDetonationScore =
    iif(isnotempty(StageTime), 40, 0) +
    iif(isnotempty(MoveTime), 30, 0) +
    iif(isnotempty(ExfilTime), 30, 0)
| where PreDetonationScore >= 60
| summarize FirstSeen=min(StageTime), Signals=make_set(FileName),
    LateralTargets=make_set(RemoteIP), ExfilBytes=sum(BytesSent)
    by DeviceName, AccountName, PreDetonationScore
| order by PreDetonationScore desc;

Rapid-response PowerShell script — run on suspect hosts or via your RMM fleet-wide. Checks exposed RDP, scheduled tasks created in the last 7 days, shadow copy integrity, and recent suspicious service installs:

# N0N-Campaign Rapid Triage — Security Arsenal | TLP:CLEAR | 2026-10-27
# Run elevated. Output: console + $env:TEMP\n0n_triage_<host>.log
$log = "$env:TEMP\n0n_triage_$env:COMPUTERNAME.log"
"=== N0N Rapid Triage — $(Get-Date -Format o) on $env:COMPUTERNAME ===" | Tee-Object $log

"`n[1] RDP exposure (listening + NLA status):" | Tee-Object $log -Append
$rdp = Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue
if ($rdp) { "  RDP LISTENING on 3389" | Tee-Object $log -Append } else { "  RDP not listening" | Tee-Object $log -Append }
$nla = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue).UserAuthentication
"  NLA enabled: $(if ($nla -eq 1) {'YES'} else {'NO — HIGH RISK'})" | Tee-Object $log -Append

"`n[2] Scheduled tasks created/modified in last 7 days:" | Tee-Object $log -Append
Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt (Get-Date).AddDays(-7) } |
  ForEach-Object { "  $($_.Date) | $($_.TaskPath)$($_.TaskName) | $($_.Actions.Execute)" } | Tee-Object $log -Append

"`n[3] Services installed in last 7 days (PsExec-style check):" | Tee-Object $log -Append
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
  ForEach-Object { "  $($_.TimeCreated) | $($_.Message -split "`n" | Select-Object -First 1)" } | Tee-Object $log -Append

"`n[4] Volume Shadow Copy status:" | Tee-Object $log -Append
$vss = vssadmin list shadows 2>$null
if ($vss -match 'Shadow Copy Volume') { ($vss | Select-String 'creation time').Line | Tee-Object $log -Append }
else { "  NO SHADOW COPIES FOUND — possible T1490 tampering" | Tee-Object $log -Append }

"`n[5] Failed logon burst check (4625, last 24h, top sources):" | Tee-Object $log -Append
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)} -ErrorAction SilentlyContinue |
  Group-Object { $_.Properties[19].Value } | Sort-Object Count -Descending | Select-Object -First 5 |
  ForEach-Object { "  Source $($_.Name): $($_.Count) failures" } | Tee-Object $log -Append

"`n=== Triage complete. Escalate if [3],[4], or [5] show anomalies. ===" | Tee-Object $log -Append

Incident Response Priorities

T-minus detection checklist — before encryption fires

Double-extortion crews of this profile telegraph detonation. Hunt for, in order of signal value:

1. Shadow copy deletion / bcdedit tampering (T1490) — usually executed hours before detonation.
2. Mass archive creation (rar/7z with password flags against file shares) — data staging for exfil.
3. New service installations (Event 7045) — PsExec clones or ransomware deployment services.
4. EDR/security tool tampering — stopped services, deleted agents, new exclusions in Defender.
5. Unusual SMB fan-out — one host suddenly touching 445 on dozens of peers.
6. Bulk outbound 443 to file-sharing domains or sustained multi-GB uploads from a server that never uploads.
7. GPO modification events — ransomware is frequently deployed via Group Policy once Domain Admin is achieved.

Critical assets this profile prioritizes for exfiltration

• File servers / NAS holding client, patient, or project data (especially relevant for the law-practice, healthcare, and professional-services listing pattern).
• Email archives of legal/finance/HR mailboxes.
• Backup infrastructure (Veeam/Commvault servers) — targeted both for data and destruction.
• vCenter / hypervisor management plane — the force multiplier; one compromise encrypts the whole estate.
• Domain controllers — NTDS.dit theft enables the entire deployment phase.

Containment actions, ordered by urgency

1. Isolate, don't power off — network-quarantine suspect hosts via EDR/switch ACLs to preserve volatile evidence.
2. Disable compromised accounts and reset krbtgt twice if DC access is suspected.
3. Block outbound to known exfil destinations at the proxy/firewall; sinkhole new DNS domains <30 days old.
4. Freeze the backup plane — take backup infrastructure off the network until integrity is verified (immutable copies first).
5. Pull and preserve logs now — VPN concentrator, firewall, and EDR telemetry have short retention; the intrusion vector evidence expires fast.
6. Engage IR retainer / legal counsel before any contact with the actor; do not confirm or deny the leak-site claim publicly without counsel.

Hardening Recommendations

Immediate (24 hours)

• Patch or mitigate the KEV perimeter set: Check Point Security Gateway (CVE-2026-50751), Cisco Secure FMC (CVE-2026-20316), VMware vCenter (CVE-2026-59310). If patching isn't possible tonight, ACL management interfaces to known admin IPs or take them off the internet entirely.
• Verify NLA + MFA on all remote access; disable internet-facing RDP outright. If RDP must exist, gateway it.
• Audit vCenter access — SSO admin accounts, recent logins, and abnormal API sessions; segment the management plane from production VLANs.
• Deploy the Sigma rules above and run the KQL hunt across the last 30 days, not just 24 hours.
• Confirm backups are immutable and offline copies exist — and test one restore today.
• Block macro execution from the internet zone (Mark-of-the-Web policy) if not already enforced.

Short-term (2 weeks)

• Segment OT/IT and management planes — the energy and manufacturing listings are a reminder that flat networks turn one phished credential into full-estate encryption.
• Deploy honey credentials and canary file shares wired to high-severity alerting — near-zero false positives, catches staging phase.
• Implement egress filtering with per-host baselining so multi-GB anomalous uploads alert before exfil completes.
• Move CI/CD (TeamCity-class) and developer tooling behind identity-aware proxies and off flat network segments (CVE-2026-63077, CVE-2026-48027 exposure).
• Establish a leak-site monitoring process — if your organization appears on a DLS, your detection clock starts at publication, not at your first alert.
• Tabletop the double-extortion scenario with legal, comms, and executives: decide in advance who speaks, what disclosure obligations apply per jurisdiction (the six countries in this dataset all differ), and what the ransom decision framework is.

This briefing reflects unverified threat-actor claims collected from dark web leak-site monitoring. Security Arsenal will update or correct this bulletin as new information emerges. Named organizations are invited to contact security@securityarsenal.com.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub