Classification: TLP:CLEAR | Publication Date: 2026-10-12 | Source: ransomware.live leak-site monitoring | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 12 New Leak-Site Listings — Sector Targeting Analysis & Detection Rules

Executive Summary

N0N has listed 12 organizations on its dark web leak site in a compressed posting window dated 2026-10-11, with claimed victims concentrated in Canada, the United States and Australia. The visible sector mix includes Healthcare, Technology and Professional Services, plus several listings with sector marked Not Found. All 12 postings were independently observed by a second leak-site crawler, which corroborates that N0N made the claims; it does not confirm that any listed organization suffered a breach. Security teams in the affected countries should treat this as an unverified but actionable campaign signal: prioritize pre-encryption detection, identity and remote-access hardening, backup integrity checks, and review of edge products named in CISA KEV as hypothesis-level exposure only.

Sourcing & Verification

• Corroboration posture: 12 of 12 listings were independently observed by a second crawler; 0 appear on a single source only.
• Inclusion reflects the threat actor's claim and is NOT confirmation of a breach. No tier in this dataset confirms compromise.
• A named organization may dispute a listing, and a denial is likewise not proof the claim is false. Disclosure obligations vary by jurisdiction, contract and regulator, and not every incident is reportable; neither silence nor denial settles the question.
• Security Arsenal will publish corrections and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

Public, verifiable detail on N0N remains limited in the data available here. The profile below separates observed leak-site behavior from common ransomware playbook assessment.

• Aliases: No verified aliases are present in the supplied dataset. Treat third-party alias claims as unconfirmed unless tied to infrastructure, payloads or negotiation artifacts.
• Operating model: Not established. The cadence and multi-victim posting pattern is consistent with either a small closed crew or an emerging RaaS testing affiliate throughput, but the dataset does not prove either model.
• Ransom demands: No reliable public demand range is available in this dataset. Do not assume demands scale with sector; healthcare and professional services listings may reflect data-sensitivity pressure rather than proven payment outcomes.
• Initial access methods: Not victim-confirmed. Sector-level hypothesis only: exposed remote access, phishing-driven credential theft, abused edge appliances, vulnerable virtualization management planes and CI/CD or developer-tool compromise are common ransomware entry paths and align with several CISA KEV items listed below.
• Extortion approach: The presence of a leak site and named claims indicates double-extortion pressure: threaten publication while claiming access to internal data. It does not prove data theft occurred.
• Dwell time: No verified average dwell time can be derived from leak-site posts alone. Use a practical hunt assumption of days to weeks between access and detonation, and prioritize telemetry that catches staging before encryption.

Current Campaign Analysis

Sectors being targeted

Observed claimed sectors: Not Found, Technology, Professional Services and Healthcare. The three healthcare listings are notable because even unverified claims can trigger regulatory, contractual and patient-sensitivity reviews. Technology and Professional Services claims carry downstream concern because those firms may hold client data, source code, legal records or privileged access into other environments.

Geographic concentration

Claimed countries are CA, US and AU. That spread suggests English-language or Western-market pressure economics rather than a single-country focus. The presence of Canada and Australia alongside the US may indicate opportunistic access-broker inventory rather than a deliberate regional doctrine.

Victim profile

The dataset does not provide revenue or employee counts, so no organization-specific size claim is made. Based only on sector mix, defenders should assume an SMB-to-midmarket bias with some larger entities possible: healthcare and professional services often hold high-value regulated data, while technology firms can create supply-chain amplification. Treat revenue estimates as planning context only, not attribution.

Observed posting frequency / escalation patterns

All 12 visible listings share a 2026-10-11 publication date, indicating burst posting rather than a slow drip. Burst behavior can mean a backlog of claimed access, an affiliate push, negotiation failures being published together, or an attempt to inflate perceived momentum. If the gang is credible, the next escalation typically includes sample data, countdown timers, re-posting after denials, or renaming a listing to pressure counsel and insurers. None of those steps are confirmed here.

CVE exposure — hypothesis only, not victim linkage

No evidence links any listed organization to a specific CVE. The following CISA KEV items are relevant as sector-level exposure to validate because ransomware operators broadly exploit edge, management-plane and developer-tool weaknesses:

• CVE-2026-59310, Broadcom VMware vCenter path traversal, added 2026-08-18: prioritize vCenter patching and management-network isolation.
• CVE-2026-63077, JetBrains TeamCity deserialization of untrusted data, added 2026-08-05: audit build servers, service accounts and artifact repositories.
• CVE-2026-20316, Cisco Secure FMC hard-coded password, added 2026-07-29: review firewall management access and credential rotation.
• CVE-2026-50751, Check Point Security Gateway improper authentication in IKEv1 key exchange, added 2026-06-08: disable legacy VPN paths where feasible and monitor IKEv1 anomalies.
• CVE-2026-48027, Nx Console embedded malicious code, added 2026-05-27: investigate developer workstation extensions, package provenance and unexpected outbound connections.

Detection Engineering

---
title: N0N Campaign Hypothesis - Pre-Ransomware Staging And Defense Evasion
id: 7b2f9c10-6f2f-4d64-9c7a-n0n20261012a
status: experimental
description: Detects common pre-encryption staging seen across ransomware campaigns and relevant to unverified N0N claims; tune to environment before production.
author: Security Arsenal
references:
  - https://securityarsenal.com/darkside
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
date: 2026/10/12
modified: 2026/10/12
tags:
  - attack.impact
  - attack.t1490
  - attack.t1562.001
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_tools:
    Image|contains:
      - 'vssadmin.exe'
      - 'wbadmin.exe'
      - 'bcdedit.exe'
      - 'wmic.exe'
      - 'powershell.exe'
  selection_actions:
    CommandLine|contains:
      - 'delete shadows'
      - 'resize shadowstorage'
      - 'delete catalog'
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
      - 'shadowcopy delete'
      - 'win32_shadowcopy.delete'
  condition: selection_tools and selection_actions
falsepositives:
  - Backup administrators
  - Imaging and maintenance windows
level: high
---
title: N0N Campaign Hypothesis - Lateral Movement Via Admin Tooling
id: 7b2f9c10-6f2f-4d64-9c7a-n0n20261012b
status: experimental
description: Identifies PsExec-style service execution, WMI remote process creation and encoded PowerShell used for lateral movement before ransomware deployment.
author: Security Arsenal
date: 2026/10/12
modified: 2026/10/12
tags:
  - attack.lateral_movement
  - attack.t1569.002
  - attack.t1047
  - attack.t1021.002
  - attack.t1027
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec:
    Image|contains:
      - 'psexec.exe'
      - 'psexesvc.exe'
      - 'paexec.exe'
      - 'remcom.exe'
  selection_wmi:
    ParentImage|contains: 'wmiprvse.exe'
    Image|contains:
      - 'powershell.exe'
      - 'cmd.exe'
      - 'rundll32.exe'
      - 'mshta.exe'
  selection_encoded:
    CommandLine|contains:
      - ' -enc '
      - ' -ec '
      - 'frombase64string'
      - 'hidden'
  condition: selection_psexec or selection_wmi or (selection_wmi and selection_encoded)
falsepositives:
  - Enterprise software deployment
  - SCCM and remote administration
level: high
---
title: N0N Campaign Hypothesis - Edge And Management Plane Exploit Follow-On Activity
id: 7b2f9c10-6f2f-4d64-9c7a-n0n20261012c
status: experimental
description: Correlates authentication anomalies and process launches after exposure of VPN, firewall management, vCenter, TeamCity or developer tooling; use with asset inventory for KEV systems.
author: Security Arsenal
date: 2026/10/12
modified: 2026/10/12
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t1078
  - attack.t1133
logsource:
  category: authentication
  product: windows
detection:
  selection_logon:
    EventID:
      - 4624
      - 4625
    LogonType:
      - 3
      - 10
  selection_context:
    IpAddress|contains:
      - 'vpn'
      - 'rdp'
      - 'gateway'
    TargetUserName|contains:
      - 'svc'
      - 'admin'
      - 'backup'
      - 'vcenter'
      - 'teamcity'
  timeframe: 15m
  condition: selection_logon and selection_context
falsepositives:
  - Managed service providers
  - Vulnerability scanners
  - Jump hosts
level: medium

let Lookback = 7d;
let SuspiciousTools = dynamic(['psexec.exe','psexesvc.exe','paexec.exe','remcom.exe','wmic.exe','powershell.exe','rundll32.exe','mshta.exe','vssadmin.exe','wbadmin.exe','bcdedit.exe','rar.exe','7z.exe','megacmd.exe','rclone.exe']);
let StagingTerms = dynamic(['delete shadows','delete catalog','recoveryenabled no','ignoreallfailures','shadowcopy delete','frombase64string',' -enc ','hidden','/copy','/move']);
DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where FileName in~ (SuspiciousTools) or ProcessCommandLine has_any (StagingTerms)
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Commands=make_set(ProcessCommandLine, 20), Hosts=dcount(DeviceId) by AccountName, FileName, InitiatingProcessFileName, bin(TimeGenerated, 1h)
| join kind=leftouter (
    DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where RemotePort in (445,3389,5985,5986,135,22,443)
    | summarize NetTargets=make_set(RemoteUrl, 20), RemotePorts=make_set(RemotePort, 10) by DeviceId, bin(TimeGenerated, 1h)
  ) on TimeGenerated
| project FirstSeen, LastSeen, AccountName, FileName, InitiatingProcessFileName, Hosts, Commands, NetTargets, RemotePorts
| order by Hosts desc, FirstSeen asc;

# Rapid response check: recent scheduled tasks, risky services, shadow copies and exposed remote access.
$Start = (Get-Date).AddDays(-7)
Write-Output '=== Scheduled tasks created or changed in last 7 days ==='
Get-ScheduledTask | ForEach-Object {
  $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
  [PSCustomObject]@{ TaskName=$_.TaskName; TaskPath=$_.TaskPath; Author=$_.Author; State=$_.State; LastRunTime=$info.LastRunTime; NextRunTime=$info.NextRunTime }
} | Where-Object { $_.LastRunTime -gt $Start -or $_.NextRunTime -gt (Get-Date) } | Format-Table -AutoSize

Write-Output '=== New or modified files in common staging locations ==='
$Paths = @($env:ProgramData, $env:TEMP, $env:PUBLIC)
foreach ($Path in $Paths) {
  if (Test-Path $Path) {
    Get-ChildItem $Path -Recurse -File -ErrorAction SilentlyContinue | Where-Object { $_.LastWriteTime -gt $Start -and $_.Length -gt 50MB } | Select-Object FullName, Length, LastWriteTime
  }
}

Write-Output '=== Volume shadow copy inventory ==='
vssadmin list shadows

Write-Output '=== Remote access listeners ==='
Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue | Where-Object { $_.LocalPort -in 3389,5985,5986,22,445 } | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort -Unique

Write-Output '=== Local administrators ==='
Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue | Select-Object Name, ObjectClass, PrincipalSource

Incident Response Priorities

T-minus detection checklist: before encryption fires

• Alert on shadow-copy deletion, backup catalog deletion, boot recovery changes and mass file rename bursts.
• Hunt for archive utilities and cloud sync tools on servers that do not normally package data.
• Trace any new service creation, remote thread creation, WMI-spawned child processes and PsExec-style service binaries.
• Validate impossible travel, legacy VPN/IKEv1 logons, RDP logons outside change windows and first-seen accounts touching many hosts in under an hour.
• Confirm EDR coverage on domain controllers, backup servers, vCenter, firewall management hosts, build servers and file shares.
• Snapshot and preserve firewall, VPN, identity provider, EDR and hypervisor logs before retention rolls over.

Critical assets this gang historically pressures

Because N0N-specific exfiltration history is not established in the supplied data, prioritize the assets ransomware crews most often weaponize for extortion in these sectors: patient or client records, HR and payroll exports, legal matter files, source code and CI secrets, finance and tax data, backups, domain credentials, and documentation that proves regulated-data exposure.

Containment actions ordered by urgency

1. Isolate suspected hosts at the network and identity layer without powering off volatile evidence unless encryption is actively spreading.
2. Disable or constrain compromised accounts, revoke tokens, rotate exposed service credentials and block suspect egress.
3. Protect backups: pause backup deletion jobs, verify immutable copies, and separate backup control plane credentials.
4. Patch or isolate KEV-exposed edge and management systems; do not wait for attribution.
5. Activate legal, privacy and communications review for any listed organization, while preserving the distinction between actor claim and confirmed breach.
6. Capture forensic images and memory for systems showing staging, then rebuild from known-good media after evidence preservation.

Hardening Recommendations

Immediate — 24 hours

• Apply or verify mitigations for CVE-2026-59310, CVE-2026-63077, CVE-2026-20316, CVE-2026-50751 and CVE-2026-48027; if patching is impossible, restrict management interfaces to jump hosts and add compensating monitoring.
• Enforce phishing-resistant MFA for VPN, RDP gateways, firewall management, vCenter, CI/CD and cloud consoles; disable legacy IKEv1 paths where operationally possible.
• Block inbound RDP from the internet, require brokered access, alert on LogonType 10 outside approved sources and lock down local administrator reuse with LAPS or equivalent.
• Deploy the Sigma and KQL logic in detect-only mode, then escalate true-positive staging behavior.
• Audit macro execution, browser-delivered archives, developer extensions and package updates on workstations used by administrators and developers.
• Test restore of one critical system and verify shadow copies, offline/immutable backups and backup account separation.

Short-term — 2 weeks

• Segment management planes: vCenter, backup, firewall management, CI/CD and security tooling should not be reachable from general user VLANs.
• Implement tiered administration with dedicated privileged access workstations and just-in-time elevation for domain, backup and hypervisor roles.
• Add application control for servers, restricting archive tools, remote shells and unsigned service binaries to approved deployment paths.
• Establish egress baselines and alert on uncommon cloud storage destinations, high-volume compression plus outbound transfer, and new destinations from servers.
• Run purple-team validation against the pre-encryption chain: edge exploit hypothesis, credential reuse, lateral admin tooling, staging, exfil and backup sabotage.
• Pre-negotiate IR retainers, outside counsel and regulator decision trees so an unverified leak-site claim does not consume the first 12 hours of response.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub