Classification: TLP:CLEAR | Publication Date: 2026-11-05 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 12 New Leak-Site Postings — Sector Targeting Analysis & Detection Rules

Executive Summary

Between 2026-11-03 and 2026-11-05, the ransomware group tracked as N0N published 12 new listings to its dark web leak site. Two of those listings name identifiable US organizations — Delta Dental of Missouri (Healthcare) and The Container Store (Retail & E-Commerce) — while the remaining ten are anonymized placeholder entries ("Company #123"–"Company #132") spanning the US, Germany (DE), Saudi Arabia (SA), and one unknown country.

Every listing is an unverified claim by a criminal actor. N0N claims to have compromised these organizations; no listing in this dataset constitutes confirmation of a breach. Only the named organizations or their regulators can confirm or refute the claims. This briefing translates the gang's posting behavior, historical tradecraft, and sector exposure into actionable detection and hardening guidance for enterprise defenders — particularly healthcare, dental/insurance, and retail organizations with US, German, or Saudi footprints.

Sourcing & Verification

This briefing is built from monitoring of the N0N leak site via ransomware.live, with a corroboration tier applied to each listing:

• 7 of 12 listings were independently observed by a second leak-site crawler (MULTI-SOURCE): Delta Dental of Missouri, The Container Store, and Companies #128–#132. This means two independent collectors saw the gang publish the claim.
• 5 of 12 listings appear on a single source only (SINGLE-SOURCE): Companies #123–#127, with no second-crawler confirmation that the postings even exist.

Critical caveats for readers:

• Inclusion in this briefing reflects the threat actor's claim and is NOT confirmation of a breach. No corroboration tier in this data — including MULTI-SOURCE — confirms that any intrusion occurred. It only confirms the gang made the claim.
• A named organization may dispute the listing. A denial is likewise not proof the claim is false: disclosure obligations vary by jurisdiction and sector, and not every incident is reportable. Neither silence nor denial settles the question.
• Security Arsenal will publish corrections as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

Model and structure. N0N operates as a closed ransomware operation with RaaS-adjacent characteristics: it recruits a small circle of affiliates rather than running an open program, and it maintains its own leak infrastructure rather than renting a shared platform. No widely corroborated aliases are currently in circulation; the group brands itself simply as "N0N" across its .onion properties.

Extortion approach. N0N follows the standard double-extortion playbook: exfiltrate first, encrypt second, then publish victim names on the leak site with a countdown to full data release. The heavy use of anonymized "Company #NNN" entries in the current wave is consistent with an escalation ladder — organizations that do not engage get unmasked in later posts. Two of the twelve current listings have already been unmasked (the named US entities), suggesting negotiations with those entities either failed or never began.

Ransom demands. Observed demands from comparable mid-tier crews in this lane typically scale to victim revenue, ranging from the low six figures for SMBs into the mid-seven figures for healthcare and retail entities with regulatory exposure. No verified demand figures for the current listings are available; treat any number circulating outside the gang's own site as unconfirmed.

Initial access methods (sector-level tradecraft, not victim-specific attribution):

• Exploitation of internet-facing remote access: VPN concentrators, firewall management planes, and RDP exposed to the internet with weak MFA posture.
• Spear-phishing with macro-enabled documents or malicious IDE/browser extensions as the execution vector.
• Abuse of edge infrastructure — notably network security appliances and CI/CD tooling — as a quiet initial foothold.

Dwell time. Crews in this tier typically dwell 5–14 days between initial access and detonation, using the window for discovery, credential theft, staged exfiltration to cloud storage (MEGA, Rclone-to-S3 patterns), and backup destruction. The posting cadence below (clusters on consecutive days) suggests N0N runs a pipeline: intrusions mature and are published in batches rather than in real time.

Current Campaign Analysis

Sector targeting

From the 12 current listings:

The visible named victims skew toward US organizations holding regulated or monetizable personal data: dental benefits data (which frequently includes PII and limited health information) and retail customer/loyalty data. This matches the gang's economics — data that pressures a victim through regulatory and reputational exposure rather than raw operational disruption.

Geographic concentration

• US: 8 of 12 listings (including both named organizations)
• DE: 1
• SA: 1
• Unknown: 2

A pronounced US-weighted footprint with opportunistic reach into German and Saudi enterprises — a pattern consistent with affiliate-driven initial access brokering rather than deliberate regional strategy.

Victim profile

The named organizations are established mid-to-large enterprises. Based on the sectors represented, expected victims are organizations with annual revenue roughly in the $50M–$1B+ range — large enough to pay, small enough to lack 24/7 detection depth. The ten anonymized listings likely skew smaller, as unmasking is the gang's escalation tool against recalcitrant mid-market victims.

Posting cadence and escalation pattern

• 2026-11-03: 5 listings (all SINGLE-SOURCE, all anonymized)
• 2026-11-04: 5 listings (all MULTI-SOURCE, all anonymized)
• 2026-11-05: 2 listings (both MULTI-SOURCE, both named US entities)

The progression — two days of anonymized bulk postings followed by named disclosures — is a textbook pressure sequence. Organizations in the same sectors should treat the unmasking of Delta Dental of Missouri and The Container Store as a signal that N0N is willing to name names quickly in this campaign wave.

CVE exposure context (hypothesis, not attribution)

We have no evidence linking any specific listing above to a specific CVE. However, N0N's known preference for edge-device and remote-access exploitation aligns with several vulnerabilities currently on CISA's Known Exploited Vulnerabilities catalog with confirmed ransomware use. Defenders in targeted sectors should treat the following as priority exposure hypotheses:

• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1 key exchange). Edge VPN auth bypass is a canonical initial access vector for crews in this tier.
• CVE-2026-20316 — Cisco Secure Firewall Management Center hard-coded password. Management-plane compromise enables both access and blind-spot creation.
• CVE-2026-59310 — VMware vCenter path traversal. Hypervisor-layer access is a force multiplier for mass encryption of virtualized estates.
• CVE-2026-63077 — JetBrains TeamCity deserialization. CI/CD compromise doubles as supply-chain staging and a source of high-value secrets.
• CVE-2026-48027 — Nx Console embedded malicious code. Malicious IDE extensions are a plausible phishing-adjacent execution vector against developer workstations.

Patch posture on these five should be verified this week for any organization in healthcare, dental/insurance, or retail with US/DE/SA operations.

Detection Engineering

The following detections target the TTPs N0N-tier crews are known to use: VPN/edge exploitation followed by internal discovery, RDP brute forcing, PsExec/WMI lateral movement, Cobalt Strike-style beaconing, and pre-encryption data staging with shadow copy destruction.

---
title: N0N - RDP Brute Force Followed by Successful Logon
id: 8f2a1c3e-n0n1-4a5b-9c1d-rdpbrute0001
status: experimental
description: Detects a burst of failed RDP logons (4625) from a single source followed by a successful network logon (4624 Type 10) within 10 minutes — consistent with N0N-tier VPN/RDP initial access.
author: Security Arsenal Threat Intelligence
logsource:
  product: windows
  service: security
  category: logon
detection:
  selection_failed:
    EventID: 4625
    LogonType: 10
  selection_success:
    EventID: 4624
    LogonType: 10
    AuthenticationPackageName: Negotiate
  condition: selection_failed | count() by SourceAddress > 20
  timeframe: 10m
fields:
  - SourceAddress
  - TargetUserName
  - WorkstationName
falsepositives:
  - Misconfigured RDP clients retrying expired credentials
  - Vulnerability scanners
level: high
tags:
  - attack.initial_access
  - attack.t1133
  - attack.t1110
---
title: N0N - PsExec or WMI Remote Service Creation for Lateral Movement
id: 8f2a1c3e-n0n1-4a5b-9c1d-psewmi000002
status: experimental
description: Detects remote service installation (7045) and suspicious pipe usage consistent with PsExec-style tooling, a staple of N0N-tier lateral movement during pre-encryption staging.
author: Security Arsenal Threat Intelligence
logsource:
  product: windows
  category: process_creation
detection:
  selection_psexec:
    Image|endswith:
      - '\PSEXESVC.exe'
      - '\paexec.exe'
      - '\csexec.exe'
  selection_wmi:
    ParentImage|endswith: '\WmiPrvSE.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\rundll32.exe'
  selection_service:
    EventID: 7045
    ServiceFileName|contains:
      - 'ADMIN$'
      - '\\127.0.0.1\\'
      - '%COMSPEC%'
  condition: 1 of selection_*
fields:
  - Image
  - ParentImage
  - CommandLine
  - ServiceName
falsepositives:
  - Legitimate admin tooling (SCCM, PDQ) — baseline known deployment servers
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1047
  - attack.t1569.002
---
title: N0N - Pre-Encryption Staging - Shadow Copy Deletion and Exfil Archiving
id: 8f2a1c3e-n0n1-4a5b-9c1d-staging00003
status: experimental
description: Detects Volume Shadow Copy deletion, boot config tampering, and mass archive creation (rar/7z on sensitive paths) — hallmark N0N-tier actions in the 24-48h before detonation.
author: Security Arsenal Threat Intelligence
logsource:
  product: windows
  category: process_creation
detection:
  selection_vss:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
      - '\wbadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'recoveryenabled no'
      - 'delete catalog'
  selection_archive:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\7za.exe'
      - '\winrar.exe'
    CommandLine|contains:
      - ' a '
      - ' -p'
  condition: selection_vss or selection_archive
fields:
  - Image
  - CommandLine
  - ParentImage
  - User
falsepositives:
  - Backup administrators running catalog maintenance
  - Legitimate archiving by finance/HR — alert on server paths and off-hours execution
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.collection
  - attack.t1560.001

// N0N pre-ransomware staging hunt: lateral movement + exfil staging correlation
// Microsoft Sentinel / Defender XDR — run over last 7 days, tune KnownAdminServers
let KnownAdminServers = dynamic(["SCCM01","PDQDEPLOY01"]);  // baseline your estate
let Lookback = 7d;
let SuspiciousRemoteExec =
    DeviceProcessEvents
    | where TimeGenerated >= ago(Lookback)
    | where ProcessVersionInfoOriginalFileName in~ ("PsExec.exe","psexesvc.exe")
       or (InitiatingProcessFileName =~ "WmiPrvSE.exe"
           and FileName in~ ("cmd.exe","powershell.exe","rundll32.exe"))
       or (FileName =~ "winrs.exe")
    | where DeviceName !in~ (KnownAdminServers)
    | project LateralTime=TimeGenerated, DeviceName, AccountName,
              FileName, ProcessCommandLine, InitiatingProcessFileName, RemoteIP;
let StagingActivity =
    DeviceProcessEvents
    | where TimeGenerated >= ago(Lookback)
    | where (FileName in~ ("vssadmin.exe","bcdedit.exe","wbadmin.exe")
             and ProcessCommandLine has_any ("delete shadows","recoveryenabled no","delete catalog"))
       or (FileName in~ ("rar.exe","7z.exe","7za.exe","rclone.exe","megacmd.exe")
             and ProcessCommandLine has_any (" a "," -p","copy","sync","--transfers"))
    | project StagingTime=TimeGenerated, DeviceName, AccountName,
              FileName, ProcessCommandLine;
SuspiciousRemoteExec
| join kind=inner StagingActivity on DeviceName, AccountName
| where abs(datetime_diff('minute', StagingTime, LateralTime)) <= 720  // within 12h
| project DeviceName, AccountName, LateralTime, FileName, ProcessCommandLine,
          RemoteIP, StagingTime, StagingFileName=FileName1, StagingCommandLine=ProcessCommandLine1
| summarize FirstSeen=min(LateralTime), LastSeen=max(StagingTime),
            ActivityCount=count(),
            Actions=make_set(strcat(FileName, " :: ", ProcessCommandLine), 20)
    by DeviceName, AccountName
| sort by ActivityCount desc

# N0N Rapid Triage: exposed RDP, recent scheduled tasks, shadow copy state, suspicious services
# Run elevated on suspect hosts or via your EDR remote shell. Output: CSV bundle for IR.
$out = "C:\IR-Triage-$($env:COMPUTERNAME)-$(Get-Date -Format 'yyyyMMdd-HHmm')"
New-Item -ItemType Directory -Path $out -Force | Out-Null

# 1) Is RDP exposed? Check listener + firewall rules allowing 3389 from broad scopes
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue
"RDP_Enabled: $(if ($rdp.fDenyTSConnections -eq 0) {'YES - investigate exposure'} else {'no'})" |
    Out-File "$out\rdp-status.txt"
Get-NetFirewallRule -DisplayGroup 'Remote Desktop' -ErrorAction SilentlyContinue |
    Where-Object Enabled -eq 'True' |
    Select-Object DisplayName, Profile, Direction, Action |
    Export-Csv "$out\rdp-firewall.csv" -NoTypeInformation

# 2) Scheduled tasks created or modified in the last 7 days (common persistence)
Get-ScheduledTask | ForEach-Object {
    $i = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    [PSCustomObject]@{ Name=$_.TaskName; Path=$_.TaskPath; State=$_.State;
        Author=$_.Author; LastRun=$i.LastRunTime;
        Action=($_.Actions | ForEach-Object { "$($_.Execute) $($_.Arguments)" }) -join ' ; ' }
} | Where-Object { $_.Author -notmatch 'Microsoft' -and $_.Action -ne '' } |
  Export-Csv "$out\scheduled-tasks-nonms.csv" -NoTypeInformation

# 3) Volume Shadow Copy state — vssadmin deletion is a pre-encryption hallmark
vssadmin list shadows | Out-File "$out\vss-shadows.txt"
wevtutil qe System /q:"*[System[(EventID=524)]]" /f:text /c:50 |
    Out-File "$out\vss-delete-events.txt"   # EventID 524 = shadow copy deletion logged

# 4) Recently installed services (PsExec-style staging leaves services behind)
Get-CimInstance Win32_Service |
    Where-Object { $_.PathName -match 'ADMIN\$|PSEXESVC|paexec|temp|tmp' } |
    Select-Object Name, DisplayName, State, StartMode, PathName, StartName |
    Export-Csv "$out\suspicious-services.csv" -NoTypeInformation

# 5) Failed-logon burst check (RDP brute force signal) on the local Security log
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-2)} `
    -ErrorAction SilentlyContinue |
  Group-Object { $_.Properties[19].Value } |
  Where-Object Count -gt 20 |
  Select-Object Name, Count |
  Export-Csv "$out\failed-logon-bursts.csv" -NoTypeInformation

Write-Host "Triage bundle written to $out — collect and escalate to IR." -ForegroundColor Cyan

Incident Response Priorities

T-minus detection checklist (before encryption fires)

1. VSS telemetry: Any vssadmin delete shadows, bcdedit ... recoveryenabled no, or EventID 524 on servers is a near-term detonation indicator — treat as a sev-1 page, not a queue ticket.
2. Staging archives: Watch for rar/7z/rclone/megacmd execution on file servers, database hosts, and finance/HR shares — especially by accounts that don't normally touch those hosts.
3. Lateral movement bursts: PsExec service installs, WMI-spawned shells, or WinRM from non-admin workstations sweeping multiple hosts within minutes.
4. Edge device anomalies: New local admin accounts on VPN/firewall appliances, config exports, or management-plane logins from unusual ASNs — correlate with CVE-2026-50751 and CVE-2026-20316 exposure.
5. Beacon cadence: Low-and-slow egress (DNS, HTTPS to rare domains, fixed-interval connections) from servers — N0N-tier crews commonly stage Cobalt Strike on internal servers rather than endpoints to survive EDR-heavy desktop fleets.

Critical assets this gang historically prioritizes for exfiltration

• PII/PHI-adjacent data stores — for a dental/healthcare-lane gang: benefits administration databases, claims data, member rosters. These maximize regulatory pressure.
• Customer and loyalty databases in retail — payment-adjacent PII and purchase history.
• Finance, HR, and legal shares — payroll, SSNs, contracts, litigation files.
• Backup catalogs and hypervisor management planes (vCenter) — both for destruction leverage and because vCenter compromise enables mass encryption; validate CVE-2026-59310 posture.

Containment actions, ordered by urgency

1. Isolate edge infrastructure (VPN concentrators, firewall management interfaces) from the internet if any compromise indicator exists — do not wait for confirmation.
2. Disable or restrict RDP and WinRM estate-wide except from named jump hosts; block 3389/5985 at the perimeter.
3. Force password resets for any account observed in lateral movement telemetry; revoke active sessions and Kerberos tickets (klist purge, krbtgt double-reset if domain-wide).
4. Snapshot and protect backups now — verify immutability/offline copies before any containment noise tips off the operator.
5. Block known exfil destinations (consumer cloud storage, rare TLDs) at the proxy; alert on large outbound transfers from servers.
6. Preserve evidence before remediation: memory captures on staging hosts, Security/System event log exports, edge device configs.

Hardening Recommendations

Immediate (24 hours)

• Patch or mitigate the five KEV CVEs above — Check Point (CVE-2026-50751), Cisco FMC (CVE-2026-20316), vCenter (CVE-2026-59310), TeamCity (CVE-2026-63077), Nx Console (CVE-2026-48027). If patching isn't possible in-window, pull the management interfaces off routable exposure.
• Enforce phishing-resistant MFA (FIDO2/number-matching at minimum) on all remote access — VPN, RDP gateways, and cloud SSO. N0N-tier crews prey on push-fatigue MFA and legacy OTP.
• Deploy the Sigma rules above and run the KQL hunt across the last 14 days, not 7 — dwell time estimates suggest intrusions may already be in progress.
• Verify backup immutability and test one restore. Shadow copy deletion only hurts if your backups were the shadow copies.
• Enable Office macro blocking from the internet (Mark-of-the-Web) and audit IDE extension allowlists given CVE-2026-48027's malicious-extension vector.

Short-term (2 weeks)

• Segment the estate: isolate backup infrastructure, hypervisor management, and CI/CD into restricted enclaves with dedicated admin accounts (tiered administration). A vCenter or TeamCity compromise should not be a domain-wide sentence.
• Egress filtering and DLP on server VLANs: servers should not reach consumer cloud storage; alert on any server-initiated upload above baseline.
• Decommission or gate RDP entirely behind a ZTNA/jump-host model; remove standing local admin rights in favor of LAPS + JIT elevation.
• Tabletop a double-extortion scenario with legal, comms, and cyber insurance: decide now how you'll respond to a leak-site listing naming your organization, including your public posture on unverified criminal claims.
• Dark web monitoring for your brand: named listings escalate fast in this campaign's pattern — early awareness of an unmasked post buys negotiation and disclosure runway.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub