Classification: TLP:CLEAR | Publication Date: 2026-10-15 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 12 New Leak-Site Listings — Sector Exposure, Verification Limits & Detection Rules

Executive Summary

N0N's leak-site feed shows 12 recent listings published between 2026-10-13 and 2026-10-15. The actor claims to have compromised organizations spanning Technology, Professional Services, Healthcare, Retail & E-Commerce, and Financial Services, with several sector fields marked Not Found and geography concentrated in US, NL, and BR where a country is present. These are criminal claims, not confirmed breaches. Treat every named organization as an allegation requiring direct verification, customer/regulator notification review, and internal telemetry checks.

Named listings exactly as posted: Company #69; Company #68; Company #67; Company #66; Interior Technologies; Trieschmann Dumala Architectural Group; Company #65; Company #63; Company #64; Hunter Neurology; MarieBelle New York; PG Group (Pure Options). Use of the word listing here means only that N0N names the organization on its leak site.

Defensive priority is not to validate the gang's marketing. It is to hunt for pre-encryption behavior that commonly precedes double-extortion publication: edge-device exploitation, exposed RDP/VPN access, phishing macro execution, PsExec/WMI lateral movement, staging of archives, shadow-copy tampering, and mass encryption preparation. The CISA KEV items below are sector-level exposure hypotheses only; this data does not tie any named organization to a specific CVE.

Sourcing & Verification

Seven of the 12 listings were independently observed by a second leak-site crawler: Company #69, Company #68, Company #67, Company #66, Interior Technologies, Trieschmann Dumala Architectural Group, and Company #65. Five appear on a single source only: Company #63, Company #64, Hunter Neurology, MarieBelle New York, and PG Group (Pure Options).

Inclusion reflects the threat actor's claim and is not confirmation of a breach. MULTI-SOURCE means two crawlers saw the gang make the claim; it still does not prove intrusion, theft, encryption, or impact. A named organization may dispute a listing, and a denial is likewise not proof the claim is false: disclosure obligations vary by jurisdiction and contract, and not every incident is reportable, so neither silence nor denial settles the question. Security Arsenal will publish corrections and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

• Known aliases: none reliably established from the provided dataset. Do not merge N0N with similarly spelled crews unless infrastructure, negotiation portals, Tox/Jabber IDs, wallet reuse, and leak-site templates independently overlap.
• Operating model: not established. Treat as an extortion operation until proven otherwise; do not assume closed-group versus RaaS affiliate behavior from victim volume alone.
• Typical ransom demands: no dependable range is present in the source data. Avoid repeating unsourced figures. Plan for negotiable demands, countdown timers, sample-data proof, and threats to resell access as generic extortion risks rather than N0N-specific facts.
• Initial access methods: no vector is proven for any named listing. For this campaign, prioritize hypotheses common to double-extortion crews: internet-facing edge defects, weak or exposed RDP/VPN, phished credentials, macro-enabled lures, abused remote management tools, and vulnerable virtualization/DevOps/control-plane assets.
• Double extortion approach: the presence of a leak site implies publication pressure is plausible, but this dataset does not prove data theft occurred. Hunt for archive creation, cloud sync tooling, unusual egress, and compression of sensitive shares before encryption.
• Average dwell time before detonation: unknown for N0N from this data. Use an operational assumption of hours-to-days after admin access is obtained, with rapid post-exploitation when valid credentials and domain privileges are already present.

Current Campaign Analysis

Sectors listed by N0N include Technology via Interior Technologies; Professional Services via Trieschmann Dumala Architectural Group; Healthcare via Hunter Neurology; Retail & E-Commerce via MarieBelle New York; Financial Services via PG Group (Pure Options); plus multiple entities whose sector is Not Found. Geographic fields, where present, point to US, NL, and BR. Several listings have unknown country or sector, which limits confidence in deliberate targeting versus opportunistic access brokering.

Victim profile is mixed. Named organizations suggest small-to-midmarket professional services, specialty healthcare, consumer retail, financial services, and technology services; anonymized Company # entries prevent reliable sizing. Revenue should therefore be treated as unknown rather than estimated for named firms. Operationally, assume organizations with lean security staffing, high-value regulated data, third-party connectivity, and externally exposed remote access are attractive to extortion actors.

Posting frequency shows clustering: four listings on 2026-10-15, two on 2026-10-14, and six on 2026-10-13. That pattern can reflect batch publication, affiliate handoff, delayed leak-site updates, or negotiation failure queues. It is not evidence of synchronized intrusion dates.

CVE linkage is hypothesis only. CISA KEV confirms ransomware use for CVE-2026-59310 VMware vCenter path traversal, CVE-2026-63077 JetBrains TeamCity deserialization, CVE-2026-20316 Cisco Secure FMC hard-coded password, CVE-2026-50751 Check Point Security Gateway improper authentication, and CVE-2026-48027 Nx Console embedded malicious code. These map to control plane, build pipeline, firewall management, VPN gateway, and developer workstation supply-chain exposure. There is no evidence in this dataset that any named organization was entered through any one of these CVEs; use them to prioritize patching and hunting where the products exist.

Detection Engineering

The rules below target behaviors consistent with common double-extortion tradecraft and the defensive hypotheses above. They are not proof that N0N used a given technique against any listed organization.

---
title: Exposed RDP Brute Force Followed By Privileged Logon
id: 9f1e8d21-8f0e-4c0d-n0n1-000000000001
status: experimental
description: Detects repeated failed RDP logons followed by a successful network logon and privilege escalation markers. Relevant to ransomware pre-positioning hypotheses; not attribution to N0N.
author: Security Arsenal
references:
  - https://securityarsenal.com/darkside
date: 2026/10/15
modified: 2026/10/15
logsource:
  product: windows
  service: security
level: high
tags:
  - attack.initial_access
  - attack.t1078
  - attack.t1110
detection:
  sel_fail:
    EventID: 4625
    LogonType: 10
  sel_success:
    EventID: 4624
    LogonType: 10
  sel_priv:
    EventID: 4672
  condition: sel_fail and sel_success and sel_priv
falsepositives:
  - VDI brokers
  - Remote support gateways
  - Misconfigured service accounts
---
title: PsExec Or WMI Style Remote Service Creation
id: 9f1e8d21-8f0e-4c0d-n0n1-000000000002
status: experimental
description: Identifies remote service creation and ADMIN$ or IPC$ style execution often used for lateral movement before encryption.
author: Security Arsenal
references:
  - https://securityarsenal.com/darkside
date: 2026/10/15
modified: 2026/10/15
logsource:
  product: windows
  service: system
level: high
tags:
  - attack.lateral_movement
  - attack.t1021
  - attack.t1569.002
detection:
  sel_service:
    EventID: 7045
  sel_image:
    EventID: 1
    Image|contains:
      - 'psexec'
      - 'wmic'
      - 'paexec'
      - 'smbexec'
  sel_cmd:
    CommandLine|contains:
      - '\\ADMIN$'
      - '\\IPC$'
      - ' start '
      - ' create '
  condition: sel_service or sel_image or sel_cmd
falsepositives:
  - Legitimate software distribution
  - EDR response actions
  - Administrative jump hosts
---
title: Pre-Ransomware Staging And Shadow Copy Tampering
id: 9f1e8d21-8f0e-4c0d-n0n1-000000000003
status: experimental
description: Detects archive staging, suspicious egress tooling, and Volume Shadow Copy deletion attempts that often precede detonation.
author: Security Arsenal
references:
  - https://securityarsenal.com/darkside
date: 2026/10/15
modified: 2026/10/15
logsource:
  category: process_creation
  product: windows
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.exfiltration
  - attack.t1048
detection:
  sel_shadow:
    CommandLine|contains:
      - 'vssadmin delete shadows'
      - 'vssadmin Delete Shadows'
      - 'wmic shadowcopy delete'
      - 'bcdedit'
      - 'wbadmin delete catalog'
  sel_stage:
    CommandLine|contains:
      - 'rar a '
      - '7z a '
      - 'makecab'
      - 'curl.exe'
      - 'rclone'
      - 'mega'
      - 'azcopy'
  condition: sel_shadow or sel_stage
falsepositives:
  - Backup maintenance windows
  - Legitimate cloud migration
  - Developer packaging scripts

let window = 7d;
let suspiciousTools = dynamic(['psexec','wmic','paexec','smbexec','rclone','curl.exe','7z','rar','vssadmin','wbadmin','bcdedit']);
union
(SecurityEvent
| where TimeGenerated > ago(window)
| where EventID in (4624,4625,4672,4688,7045)
| extend Command = coalesce(CommandLine, NewProcessName, ServiceName, '')
| where EventID in (4688,7045) or LogonType in (3,10)
| where Command has_any (suspiciousTools) or EventID in (4625,4672)
| summarize Failures=countif(EventID==4625), NetworkLogons=countif(EventID==4624 and LogonType in (3,10)), Privileged=countif(EventID==4672), ToolEvents=countif(EventID in (4688,7045)) by Computer, Account, bin(TimeGenerated,1h)
| where Failures > 20 or (NetworkLogons > 0 and ToolEvents > 0) or Privileged > 0),
(DeviceProcessEvents
| where TimeGenerated > ago(window)
| where FileName in~ ('psexec.exe','wmic.exe','rclone.exe','curl.exe','7z.exe','rar.exe','vssadmin.exe','wbadmin.exe','bcdedit.exe') or ProcessCommandLine has_any (suspiciousTools)
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName)
| order by TimeGenerated desc

$start = (Get-Date).AddDays(-7)
Write-Output 'Scheduled tasks created or modified in the last 7 days'
Get-ScheduledTask | Where-Object { $_.Date -ge $start } | Select-Object TaskName, TaskPath, Date, State
Write-Output 'Recent service installs from System log 7045'
Get-WinEvent -FilterHashtable @{ LogName='System'; Id=7045; StartTime=$start } -ErrorAction SilentlyContinue | Select-Object TimeCreated, Message
Write-Output 'RDP failures and type 10 successes'
Get-WinEvent -FilterHashtable @{ LogName='Security'; Id=4625; StartTime=$start } -ErrorAction SilentlyContinue | Where-Object { $_.Message -match 'Logon Type:\s+10' } | Group-Object -Property { ($_.Message -split 'Source Network Address:')[-1] } | Sort-Object Count -Descending | Select-Object Count, Name
Get-WinEvent -FilterHashtable @{ LogName='Security'; Id=4624; StartTime=$start } -ErrorAction SilentlyContinue | Where-Object { $_.Message -match 'Logon Type:\s+10' } | Select-Object TimeCreated, Message
Write-Output 'Shadow copy inventory and deletion indicators'
vssadmin list shadows
Get-WinEvent -FilterHashtable @{ LogName='Security'; Id=4688; StartTime=$start } -ErrorAction SilentlyContinue | Where-Object { $_.Message -match 'vssadmin|wbadmin|bcdedit|shadowcopy' } | Select-Object TimeCreated, Message

Incident Response Priorities

T-minus detection checklist, before encryption fires: confirm identity-provider alerts for impossible travel, MFA fatigue, token replay, and new app consent; review VPN, firewall, and remote access logs for password spraying and unusual source ASNs; look for new local admins, Group Policy changes, RMM tool installs, and disabled EDR services; flag archive creation on file servers, sudden reads of HR, finance, legal, clinical, customer, or backup repositories; alert on shadow-copy deletion, recovery-catalog removal, boot configuration changes, and mass file rename tests; validate that backups are immutable, offline or logically isolated, and restorable.

Critical assets this gang may prioritize for extortion pressure, based on the listed sectors rather than confirmed theft: regulated patient data at healthcare organizations such as Hunter Neurology; payment, loyalty, and customer PII at retail organizations such as MarieBelle New York; financial records and client data at financial services organizations such as PG Group (Pure Options); design files, contracts, and client confidential material at professional services firms such as Trieschmann Dumala Architectural Group; source code, build secrets, customer data, and support access at technology firms such as Interior Technologies. Treat this as risk prioritization, not an assertion that data was taken.

Containment actions ordered by urgency: isolate suspected endpoints and block egress at the edge without powering down volatile evidence; disable or rotate exposed VPN, RDP, firewall admin, vCenter, TeamCity, and CI/CD credentials; revoke sessions and refresh tokens; remove newly created admins and GPO changes; stop suspicious services and scheduled tasks; segment backup networks and protect catalog access; capture memory, triage Windows event logs, and preserve firewall/VPN/vCenter/EDR telemetry; engage counsel early for disclosure analysis if any listed organization confirms impact.

Hardening Recommendations

Immediate, 24 hours: patch or compensate for CISA KEV exposure where present, especially Check Point Security Gateway CVE-2026-50751, Cisco Secure FMC CVE-2026-20316, VMware vCenter CVE-2026-59310, JetBrains TeamCity CVE-2026-63077, and Nx Console CVE-2026-48027; verify no direct internet RDP; enforce phishing-resistant MFA for remote access and admin planes; block macros from the internet; disable legacy IKEv1 where not required; lock down vCenter, FMC, TeamCity, and build agents to management networks; deploy the Sigma and KQL logic above; test one restore from immutable backup.

Short-term, two weeks: move administration to tiered privileged access workstations; require just-in-time admin and remove standing domain admin use; segment identity, backup, virtualization, CI/CD, and user workloads; enable tamper protection and EDR in block mode; restrict PowerShell, WMI, PsExec-style service creation, and server-to-server SMB by default; centralize logs for VPN, firewall, identity, endpoint, DNS, and cloud control planes; implement egress allowlisting for servers; rehearse an extortion-only playbook covering legal, communications, cyber insurance, customer notice, and evidence handling.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub