N0N Ransomware Gang: 14 Leak-Site Listings — Sector Targeting Analysis & Detection Rules

Classification: TLP:CLEAR | Publication Date: 2026-10-16 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

Executive Summary

N0N's leak site shows 14 recent listings spanning Technology, Professional Services, Healthcare, Retail & E-Commerce, Financial Services and several uncategorized entries, with claimed countries concentrated in EG, US, NL and BR. The named organizations include Interior Technologies, Trieschmann Dumala Architectural Group, Hunter Neurology, MarieBelle New York, and PG Group (Pure Options), plus nine anonymized Company # listings. Security Arsenal treats every entry as an unverified criminal accusation: N0N claims to have compromised these organizations, but this dataset does not confirm intrusion, encryption, theft, or operational impact. Defenders in the listed sectors should prioritize edge-device patching, remote-access hardening, pre-encryption staging detection, and exfiltration controls.

Sourcing & Verification

Nine of 14 listings were independently observed by a second leak-site crawler and are marked MULTI-SOURCE; five appear only on ransomware.live and are marked SINGLE-SOURCE. Inclusion reflects the threat actor's claim and is not confirmation of a breach. A named organization may dispute a listing, and a denial is likewise not proof the claim is false; disclosure obligations vary by jurisdiction and not every incident is reportable, so neither silence nor denial settles the question. Security Arsenal will publish corrections and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

• Aliases: No validated aliases are established from the provided corpus. Treat alias claims circulating elsewhere as unconfirmed unless independently corroborated.
• Operating model: RaaS versus closed-group cannot be asserted from this telemetry. The presence of a leak site and multiple sector claims is consistent with an extortion-enabled operation, but affiliation, builder access, and affiliate count are unknown.
• Ransom demands: No reliable demand range is present in the dataset. Do not benchmark negotiations from unsourced figures.
• Likely initial access themes: Not victim-specific. At sector level, defenders should assume exposure to internet-facing edge services, VPN/firewall management planes, RDP, phishing-led macro execution, and developer/CI supply-chain paths where the relevant KEVs apply.
• Extortion approach: Naming on a leak site is consistent with double-extortion pressure, but this dataset does not prove data theft or encryption occurred.
• Dwell time: No defensible average dwell time can be calculated from leak posts alone. Use pre-encryption staging detections rather than relying on a fixed timer.

Current Campaign Analysis

• Targeted sectors from the provided listings: Technology, Professional Services, Healthcare, Retail & E-Commerce, Financial Services, plus uncategorized 'Not Found' entries. Healthcare and financial services listings create elevated regulatory sensitivity even while claims remain unverified.
• Geographic concentration: Explicit country tags are EG, US, NL and BR; several listings have unknown geography, so treat this as opportunistic multi-region rather than a single-country operation.
• Listed organizations: Company #70 EG; Company #73 unknown; Company #69 unknown; Company #68 US; Company #67 NL; Company #66 unknown; Interior Technologies; Trieschmann Dumala Architectural Group; Company #65 BR; Company #63 unknown; Company #64 unknown; Hunter Neurology; MarieBelle New York US; PG Group (Pure Options). N0N has listed or claims to have compromised these organizations; breach status remains unconfirmed for all.
• Posting cadence: Clustered publication on 2026-10-13 through 2026-10-15 suggests batching or a recent claim surge. Nine multi-source posts strengthen confidence that the gang published those claims; five single-source posts require extra caution before escalation.
• Victim profile: Named entries imply small-to-midmarket and specialty organizations across architecture/design, neurology care, luxury retail, technology and financial services. Revenue cannot be estimated responsibly from the provided fields; assume limited in-house IR capacity and heavy dependence on MSPs, SaaS and edge appliances until proven otherwise.
• CVE linkage as hypothesis only: No evidence ties any named organization to a specific CVE. However, the active KEV set maps to plausible N0N-relevant exposure: VMware vCenter path traversal CVE-2026-59310 for virtualization control planes; JetBrains TeamCity deserialization CVE-2026-63077 for CI/CD takeover; Cisco FMC hard-coded password CVE-2026-20316 and Check Point improper authentication CVE-2026-50751 for network edge management; Nx Console malicious code CVE-2026-48027 for developer workstation supply-chain risk. Patch and isolate these surfaces regardless of gang attribution.

Detection Engineering

---
title: 'N0N-style edge and remote access intrusion precursors'
id: '8f3a1c4e-1a7b-4f6e-9b1a-n0nedge001'
status: 'experimental'
description: 'Detects failed remote access bursts, new local admin creation, and suspicious logon patterns consistent with ransomware pre-staging after VPN, firewall, RDP, or phishing-led access.'
author: 'Security Arsenal'
date: 2026/10/16
logsource:
  product: 'windows'
  service: 'security'
detection:
  selection_auth_fail:
    EventID: 4625
    LogonType: [3, 10]
  selection_new_admin:
    EventID: [4720, 4732, 4728]
  selection_rdp:
    EventID: 4624
    LogonType: 10
  timeframe: '10m'
  condition: 'selection_auth_fail and (selection_new_admin or selection_rdp)'
falsepositives:
  - 'Managed service provider maintenance'
  - 'Password spray against honeypot or lab accounts'
level: 'high'
tags:
  - 'attack.initial_access'
  - 'attack.t1078'
  - 'attack.t1133'
---
title: 'N0N-style lateral movement and ransomware staging'
id: '7d2b9aa1-5c42-4d35-a2f7-n0nlat002'
status: 'experimental'
description: 'Finds PsExec or service creation, WMI remote execution, encoded PowerShell, and suspicious Cobalt Strike-style named pipes before encryption.'
author: 'Security Arsenal'
date: 2026/10/16
logsource:
  product: 'windows'
  category: 'process_creation'
detection:
  selection_psexec:
    Image|endswith: ['\\PSEXESVC.exe', '\\psexec.exe']
  selection_wmi:
    ParentImage|endswith: '\\WmiPrvSE.exe'
    Image|endswith: ['\\powershell.exe', '\\cmd.exe', '\\rundll32.exe']
  selection_encoded_ps:
    CommandLine|contains: [' -enc ', ' -ec ', 'FromBase64String']
  selection_pipe:
    CommandLine|contains: ['\\.\\pipe\\', 'MSSE-', 'postex']
  condition: '1 of selection_*'
falsepositives:
  - 'Administrative software deployment'
  - 'EDR or vulnerability management remote execution'
level: 'critical'
tags:
  - 'attack.lateral_movement'
  - 'attack.t1021'
  - 'attack.t1569'
---
title: 'N0N-style data staging and exfiltration before detonation'
id: '3c77d2d0-9c13-43c8-bb61-n0nexf003'
status: 'experimental'
description: 'Detects archive creation in odd directories, cloud sync or rclone-like tooling, shadow copy tampering, and large outbound transfers shortly before encryption.'
author: 'Security Arsenal'
date: 2026/10/16
logsource:
  product: 'windows'
  category: 'process_creation'
detection:
  selection_archive:
    Image|endswith: ['\\rar.exe', '\\7z.exe', '\\winrar.exe']
    CommandLine|contains: [' a ', ' -hp', '.zip', '.rar']
  selection_exfil_tool:
    Image|contains: ['rclone', 'megasync', 'filezilla', 'winscp']
  selection_vss:
    Image|endswith: ['\\vssadmin.exe', '\\wmic.exe', '\\bcdedit.exe']
    CommandLine|contains: ['delete shadows', 'resize shadowstorage', 'recoveryenabled no']
  condition: 'selection_archive and selection_exfil_tool or selection_vss'
falsepositives:
  - 'Backup administrators using compression tools'
  - 'Legitimate cloud sync clients in approved paths'
level: 'high'
tags:
  - 'attack.exfiltration'
  - 'attack.t1560'
  - 'attack.t1490'

let Lookback = 7d;
let SuspiciousProc = dynamic(["psexec.exe","PSEXESVC.exe","rclone.exe","7z.exe","rar.exe","vssadmin.exe","wmic.exe","bcdedit.exe"]);
let SuspiciousCmd = dynamic([" -enc ","FromBase64String","delete shadows","recoveryenabled no","\\.\\pipe\\","MSSE-","postex"]);
DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where FileName in~ (SuspiciousProc) or ProcessCommandLine has_any (SuspiciousCmd)
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Commands=make_set(ProcessCommandLine, 10), Files=make_set(FileName, 10) by DeviceName, AccountName, InitiatingProcessFileName
| join kind=leftouter (DeviceNetworkEvents | where TimeGenerated > ago(Lookback) | summarize NetBytes=sum(SentBytes), RemoteIPs=make_set(RemoteIP, 10) by DeviceName) on DeviceName
| extend RiskScore = (array_length(Commands) * 10) + iff(NetBytes > 500000000, 50, 0)
| sort by RiskScore desc

# Rapid triage for N0N-style pre-ransomware staging. Run elevated on suspect Windows hosts.
$since = (Get-Date).AddDays(-7)
Write-Output '[+] Recent scheduled tasks'
Get-ScheduledTask | Where-Object {$_.Date -gt $since} | Select-Object TaskName,TaskPath,Date | Format-Table -AutoSize
Write-Output '[+] Failed logons and Type 10 RDP successes'
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4625; StartTime=$since} -ErrorAction SilentlyContinue | Where-Object {$_.Message -match 'Logon Type:\s*(3|10)'} | Select-Object TimeCreated,Id,Message | Format-List
Write-Output '[+] New local administrators and services'
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4720,4728,4732,7045; StartTime=$since} -ErrorAction SilentlyContinue | Select-Object TimeCreated,Id,Message | Format-List
Write-Output '[+] Shadow copy state'
vssadmin list shadows
bcdedit /enum | Select-String -Pattern 'recoveryenabled'
Write-Output '[+] Listening RDP and edge remote management'
Get-NetTCPConnection -State Listen | Where-Object {$_.LocalPort -in 3389,5985,5986,443,8443} | Select-Object LocalAddress,LocalPort,OwningProcess | Format-Table -AutoSize
Write-Output '[+] Archive or exfil tools in user-writable paths'
Get-ChildItem -Path $env:ProgramFiles, ${env:ProgramFiles(x86)}, $env:LOCALAPPDATA -Recurse -ErrorAction SilentlyContinue | Where-Object {$_.Name -match '^(rclone|7z|rar|winscp|filezilla|megasync)'} | Select-Object FullName,LastWriteTime | Format-Table -AutoSize

Incident Response Priorities

• T-minus checklist before encryption: unexpected admin creation after VPN/RDP failures; WmiPrvSE spawning cmd or PowerShell; PsExec service artifacts; encoded PowerShell; new scheduled tasks; rclone, 7z, RAR or WinSCP outside approved paths; vssadmin delete shadows; bcdedit recovery disabled; large egress to unknown IPs; authentication to backup consoles outside change windows.
• Assets to protect first based on likely extortion value: identity providers and privileged access workstations, VMware vCenter and backup repositories, NAS and file shares, EHR or clinical systems for healthcare claims, PCI and payment-adjacent systems for retail, finance ledgers and customer PII for financial services, CI/CD servers and code-signing keys for technology firms.
• Containment order: disable compromised accounts and revoke tokens; isolate affected subnets and edge appliances; block egress to staging and exfil infrastructure; preserve firewall, VPN, EDR, hypervisor and SaaS logs; protect backups and snapshot integrity; rotate credentials exposed to the affected segment; engage counsel before confirming any external claim.

Hardening Recommendations

Immediate 24h: patch or isolate vCenter, TeamCity, Cisco FMC, Check Point gateways and developer tooling affected by CVE-2026-59310, CVE-2026-63077, CVE-2026-20316, CVE-2026-50751 and CVE-2026-48027 where applicable; enforce MFA and conditional access on VPN and RDP; disable public RDP; block outbound rclone and unapproved cloud sync; enable tamper protection; alert on shadow-copy deletion and service creation; snapshot backups and verify offline copies. Short-term 2 weeks: move management planes behind jump hosts and PAM; segment backup, hypervisor, EHR, PCI and CI/CD enclaves; deploy application allowlisting for servers; centralize Windows Security, Sysmon, firewall, VPN and EDR telemetry in Sentinel; require phishing-resistant MFA for admins; restrict macro execution; add egress data-loss thresholds; rehearse an extortion-only and encryption-plus-exfil playbook with legal, comms and regulator-aware decision points.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub