Classification: TLP:CLEAR | Publication Date: 2026-10-27 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 14 New Leak-Site Listings in 5 Days — Sector Targeting Analysis & Detection Rules

Executive Summary

Between 2026-10-23 and 2026-10-27, the ransomware group tracked as N0N published 14 organizations on its dark web leak site, alleging compromise of each. The postings span six countries (AE, ES, BG, US, PT, AR) and five identified sectors — Energy & Utilities, Manufacturing, Technology, Professional Services, and Healthcare — plus two listings with no identified sector.

Key observations:

• Pacing: 14 postings in five days, including a burst of at least five listings on 2026-10-25, suggests either a batch-exfiltration cycle concluding or deliberate staggered disclosure to maximize pressure.
• Critical infrastructure exposure: Two of the 14 listings are Energy & Utilities entities (Ingelectus Innovative Electrical Solutions S.L. in Spain; TOPLIVO AD in Bulgaria).
• Healthcare data exposure risk: Two healthcare organizations are named (Asisken Asistencia Médica S.A. in Argentina; Arthritis Center of Riverside in the US).
• Corroboration is thin: Only 2 of the 14 listings were independently observed by a second leak-site crawler. The remainder are single-source.

Every claim in this briefing is an allegation by a criminal actor. None of it is confirmation of a breach. Organizations in the named sectors — particularly energy, healthcare, and manufacturing SMEs — should treat this as a trigger for the detection and hardening content below, not as confirmation that any specific company has been compromised.

Sourcing & Verification

This briefing is built from monitoring of N0N's .onion leak site via ransomware.live, with corroboration tiering applied per listing:

• 2 of 14 listings (Company #111 and Ingelectus Innovative Electrical Solutions S.L.) were independently observed by a second leak-site crawler. This confirms the gang made the posting — it does not confirm any breach occurred.
• 12 of 14 listings appear on a single source (ransomware.live) only, with no second-crawler confirmation that the posting even exists.

Inclusion of any organization in this briefing reflects the threat actor's claim only. It is not confirmation of a breach, and no tier in our data confirms a breach — only the organization itself or its regulator can do that. A named organization may dispute the listing; equally, a denial is not proof the claim is false. Disclosure obligations vary by jurisdiction and sector, and not every incident is reportable — so neither silence nor denial settles the question.

Security Arsenal will publish corrections promptly and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

Public reporting on N0N is limited. The group is a relatively low-visibility operator in the current ransomware ecosystem, and the following profile combines what is observable from leak-site behavior with patterns consistent with mid-tier ransomware operations. Where a point is inference rather than established fact, it is flagged as such.

• Aliases: No widely adopted aliases are currently tracked for N0N. The group's branding appears consistent across its leak infrastructure.
• Operating model: Based on victim volume cadence and leak-site structure, N0N exhibits characteristics of a small closed group or a young RaaS program with a limited affiliate pool (assessment, not established fact). The burst-then-pause posting rhythm is typical of operations that batch intrusions and publish victims in waves during extortion negotiation windows.
• Ransom demands: No verified demand figures are available for this group. Mid-tier groups targeting SME manufacturing and professional services typically demand in the low-to-mid six figures USD (sector-context estimate only — not N0N-specific data).
• Initial access methods (typical for this class of actor): Exploitation of internet-facing remote access (VPN concentrators, firewall management planes, exposed RDP), phishing with macro- or script-based payloads, and abuse of edge-device vulnerabilities. See the CVE discussion below for currently exploited edge-device weaknesses relevant to N0N's targeted sectors.
• Double extortion: N0N operates a name-and-shame leak site, which by definition indicates a double-extortion model — data theft threatened in addition to, or instead of, encryption.
• Dwell time: No confirmed dwell-time data exists for N0N. Comparable groups average days-to-weeks between initial access and detonation/leak posting; the five-day posting burst observed here is consistent with multiple intrusions reaching the extortion stage concurrently.

Current Campaign Analysis

Organizations named on N0N's leak site

All of the above are claims by the threat actor. None are confirmed breaches.

Sector targeting

Manufacturing leads with 4 named organizations, followed by Professional Services (2), Technology (2), Energy & Utilities (2), and Healthcare (2). This is a classic SME-focused opportunistic spread: manufacturing and professional services firms frequently run flat networks, legacy remote access, and thin security staffing — high-yield targets for mid-tier extortion operations. The two energy-sector listings are notable because electrical engineering and fuel distribution firms (as the named Spanish and Bulgarian entities' public profiles suggest) sit adjacent to OT environments, raising the stakes of any genuine compromise.

Geographic concentration

The United States accounts for 5 of 12 listings with determinable countries, with the remainder distributed across Southern Europe (ES, PT, BG), the Gulf (AE), and Latin America (AR). This spread is consistent with opportunistic scanning of exposed edge services rather than deliberate geographic targeting — the common denominator is likely a shared exposed technology, not a shared geography.

Victim profile

The named organizations are predominantly small-to-midsize enterprises: regional law practices, wholesale suppliers, specialty manufacturers, a family medical practice, and a regional managed IT provider (Adirondack Networks — a listing that, if the claim were accurate, would carry downstream supply-chain concern for its MSP/MSSP customers). Revenue estimates for this profile range from low single-digit millions to ~$100M USD annually — the classic ransomware sweet spot where firms hold insurance and can pay, but lack mature SOCs.

Posting frequency and escalation

The cadence — one posting on 10-23, five on 10-24/25 cluster, then single daily postings through 10-27 — matches a negotiation-failure disclosure pattern: victims who decline to pay are published in batches, with stragglers following as deadlines expire. Defenders should expect this pace to continue or accelerate through early November if the batch represents a single intrusion wave.

CVE relevance (hypothesis — not attribution)

We have no evidence linking any specific CVE to any named listing. However, several vulnerabilities on CISA's Known Exploited Vulnerabilities list with confirmed ransomware use map to the technologies commonly exposed by organizations in these sectors, and represent plausible initial-access hypotheses to prioritize in threat hunts:

• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1): Edge VPN gateways are the most common initial access point for SME-targeting ransomware. Any organization running Check Point gateways with IKEv1 enabled should treat patching as urgent.
• CVE-2026-20316 — Cisco Secure Firewall Management Center hard-coded password: Firewall management plane compromise grants immediate network-wide visibility and pivot capability.
• CVE-2026-59310 — VMware vCenter path traversal: vCenter compromise is a force multiplier — ransomware operators use it to detonate encryption across the entire virtual estate simultaneously, and to access backup infrastructure hosted as VMs.
• CVE-2026-63077 — JetBrains TeamCity deserialization: Relevant to the technology-sector listings; build-server compromise enables both code theft (extortion leverage) and supply-chain pivoting.
• CVE-2026-48027 — Nx Console embedded malicious code: A supply-chain vector against developer workstations, again relevant to technology-sector targets.

Treat these as sector-level exposure to hunt against, not confirmed intrusion vectors for any named organization.

Detection Engineering

The following detections target the TTP cluster typical of this class of operation: edge-device/VPN initial access, script-based phishing execution, RDP brute forcing, PsExec/WMI lateral movement, Cobalt Strike-style beaconing, and pre-encryption data staging.

---
title: Suspicious Authentication Burst on VPN or RDP — Possible Brute Force / Valid Account Stuffing
id: 8f2c1a10-9a3e-4c1b-b2d4-n0nvpnbrut01
status: experimental
description: Detects bursts of failed logons followed by a success on VPN or RDP-facing systems, consistent with credential attacks preceding ransomware initial access. Tuned for edge authentication sources.
author: Security Arsenal Threat Intelligence
date: 2026/10/27
references:
  - https://securityarsenal.com/darkside
logsource:
  product: windows
  service: security
detection:
  selection_failed:
    EventID: 4625
  selection_success:
    EventID: 4624
    LogonType:
      - 3
      - 10
  condition: selection_failed or selection_success
  timeframe: 10m
level: medium
falsepositives:
  - Service accounts with misconfigured passwords
  - Legitimate VPN reconnect storms
fields:
  - TargetUserName
  - IpAddress
  - WorkstationName
---
title: PsExec-Style Remote Service Creation or WMI Process Spawn — Lateral Movement
id: 7b3d9f22-4e5a-4d6c-a1b3-n0nlatmov002
status: experimental
description: Detects remote service installation (PsExec pattern, Event 7045 with suspicious binary paths) and WMI-spawned process execution, hallmarks of ransomware operator lateral movement prior to staging and encryption.
author: Security Arsenal Threat Intelligence
date: 2026/10/27
references:
  - https://attack.mitre.org/techniques/T1021/002/
  - https://attack.mitre.org/techniques/T1047/
logsource:
  product: windows
detection:
  selection_service:
    EventID: 7045
    ServiceFileName|contains:
      - '\ADMIN$\'
      - '\IPC$\'
      - 'PSEXESVC'
      - '\Temp\'
      - 'AppData\Local\Temp'
  selection_wmi:
    EventID: 4688
    ParentImage|endswith: '\WmiPrvSE.exe'
    NewProcessName|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\rundll32.exe'
      - '\wscript.exe'
  condition: selection_service or selection_wmi
level: high
falsepositives:
  - Legitimate administrative tooling (SCCM, PDQ) — allowlist known deployment accounts and service names
fields:
  - ServiceName
  - ServiceFileName
  - ParentImage
  - NewProcessName
---
title: Pre-Encryption Staging — Shadow Copy Deletion, Archive Creation, or Mass File Rename
id: 3a1e8c44-7f2b-4c9d-b5a6-n0nprestage03
status: experimental
description: Detects Volume Shadow Copy deletion (vssadmin/wmic), bulk archive creation consistent with exfiltration staging (rar/7z invoked against data directories), and high-rate file rename activity indicative of encryption kickoff.
author: Security Arsenal Threat Intelligence
date: 2026/10/27
references:
  - https://attack.mitre.org/techniques/T1490/
  - https://attack.mitre.org/techniques/T1560/001/
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    CommandLine|contains:
      - 'vssadmin delete shadows'
      - 'vssadmin Delete Shadows'
      - 'shadowcopy delete'
      - 'wmic shadowcopy'
      - 'bcdedit'
      - 'recoveryenabled no'
  selection_archive:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\7za.exe'
      - '\winrar.exe'
    CommandLine|contains:
      - ' a '
      - ' -p'
      - '.rar'
      - '.7z'
  condition: selection_vss or selection_archive
level: critical
falsepositives:
  - Backup software performing shadow copy management — allowlist known backup processes by Image and signer
fields:
  - Image
  - CommandLine
  - ParentImage
  - User

The following Microsoft Sentinel hunt query surfaces the pre-ransomware staging sequence: archive tool execution or shadow-copy tampering on a host, correlated with recent remote-logon anomalies on the same device within a 24-hour window.

// N0N-pattern hunt: pre-encryption staging correlated with suspicious remote logons
let lookback = 7d;
let window = 24h;
let staging =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where ProcessCommandLine has_any (
        "vssadmin delete shadows", "shadowcopy delete", "bcdedit",
        "recoveryenabled no", "wbadmin delete")
       or (FileName in~ ("rar.exe","7z.exe","7za.exe","winrar.exe")
           and ProcessCommandLine has_any (" a ", " -p", ".rar", ".7z"))
    | project StageTime=TimeGenerated, DeviceName, FileName, ProcessCommandLine, AccountName;
let remoteLogons =
    DeviceLogonEvents
    | where TimeGenerated > ago(lookback)
    | where LogonType in ("RemoteInteractive", "Network")
    | where IsLocalAdmin == 1 or AccountName has "admin"
    | summarize LogonCount=count(), FirstLogon=min(TimeGenerated), LastLogon=max(TimeGenerated)
        by DeviceName, AccountName, RemoteIP;
staging
| join kind=inner remoteLogons on DeviceName, AccountName
| where FirstLogon between (StageTime - window .. StageTime)
| project DeviceName, AccountName, RemoteIP, FirstLogon, StageTime, FileName, ProcessCommandLine
| sort by StageTime desc;

The following rapid-response script enumerates three of the highest-signal pre-detonation indicators on a Windows host: recently created scheduled tasks (persistence), shadow copy status (anti-recovery prep), and RDP exposure (initial access surface).

# Security Arsenal — Rapid pre-ransomware triage script (run elevated)
# Checks: scheduled tasks (7d), Volume Shadow Copy state, RDP exposure
$report = @()

Write-Host "=== [1/3] Scheduled tasks created or modified in last 7 days ===" -ForegroundColor Cyan
$cutoff = (Get-Date).AddDays(-7)
Get-ScheduledTask | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    try { $xml = Export-ScheduledTask -TaskName $_.TaskName -TaskPath $_.TaskPath -ErrorAction Stop
          $created = ([xml]$xml).Task.RegistrationInfo.Date } catch { $created = $null }
    if ($created -and ([datetime]$created) -gt $cutoff) {
        $line = "NEW TASK: $($_.TaskPath)$($_.TaskName) | Created: $created | Author: $(([xml]$xml).Task.RegistrationInfo.Author)"
        Write-Host $line -ForegroundColor Yellow; $report += $line
    }
}

Write-Host "`n=== [2/3] Volume Shadow Copies (ransomware deletes these pre-encryption) ===" -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) {
    Write-Host "WARNING: No shadow copies present — investigate vssadmin/bcdedit execution immediately." -ForegroundColor Red
    $report += "NO SHADOW COPIES PRESENT"
} else {
    $shadows | ForEach-Object { Write-Host "Shadow copy OK: $($_.ID) created $($_.InstallDate)" }
}

Write-Host "`n=== [3/3] RDP exposure check ===" -ForegroundColor Cyan
$rdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$rdpPort = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp').PortNumber
if ($rdpEnabled) {
    Write-Host "RDP ENABLED on port $rdpPort" -ForegroundColor Yellow
    $report += "RDP ENABLED port $rdpPort"
    $listeners = Get-NetTCPConnection -LocalPort $rdpPort -State Listen -ErrorAction SilentlyContinue
    $fw = Get-NetFirewallRule -DisplayGroup 'Remote Desktop' -ErrorAction SilentlyContinue | Where-Object Enabled -eq 'True'
    Write-Host "Listening sockets: $(($listeners | Measure-Object).Count) | Enabled RDP firewall rules: $(($fw | Measure-Object).Count)"
    Write-Host "ACTION: Disable RDP or restrict to VPN + jump host; enforce NLA and MFA at the gateway." -ForegroundColor Red
} else {
    Write-Host "RDP disabled." -ForegroundColor Green
}

$report | Out-File "$env:TEMP\n0n_triage_$(Get-Date -Format yyyyMMdd_HHmm).txt"
Write-Host "`nReport written to $env:TEMP" -ForegroundColor Cyan

Incident Response Priorities

T-minus detection checklist (before encryption fires)

Watch for this sequence — it is the standard pre-detonation playbook for double-extortion groups in this class:

1. New local/domain admin accounts or unexpected additions to privileged groups (Event 4728/4732).
2. Archive tool execution (rar.exe, 7z.exe, winrar.exe) by non-standard users, especially against file servers or document shares — this is the exfiltration staging step that precedes leak-site posting.
3. Large outbound transfers to cloud storage (MEGA, pCloud, file.io) or unknown IPs from servers that historically transfer little egress data.
4. vssadmin / bcdedit / wbadmin execution — anti-recovery actions that fire minutes-to-hours before encryption.
5. Mass GPO or PsExec deployment activity pushing an unknown binary to many hosts simultaneously.
6. EDR/AV tampering: service stops, driver unloads, or defender exclusions added via PowerShell (Add-MpPreference -ExclusionPath).

Assets this class of actor prioritizes for exfiltration

• Legal and financial records — particularly acute for the professional-services listings (law firms hold privileged client data with maximum extortion leverage).
• Patient data (PHI) — the two healthcare listings imply HIPAA/regulatory exposure if the claims were accurate; PHI commands the highest extortion premiums.
• Engineering drawings, schematics, and project files — relevant to the energy and manufacturing listings.
• MSP/RMM tooling and client lists — if any technology-sector claim were accurate, downstream customers become extortion and intrusion targets.
• Backup catalogs and credentials — operators harvest these to disable recovery before detonation.

Containment actions, ordered by urgency

1. Isolate affected segments at the switch/firewall level — do not wait for forensic certainty; network isolation is reversible, encryption is not.
2. Disable and rotate all domain admin and service account credentials, then krbtgt twice.
3. Block egress to known exfil destinations and inspect TLS-proxied outbound flows from servers.
4. Verify backup integrity and offline/immutable copies before touching anything else — operators frequently poison backups days in advance.
5. Kill suspicious sessions on edge devices (VPN concentrators, firewalls) and force re-authentication with MFA.
6. Preserve volatile evidence (memory, authentication logs from edge devices, EDR telemetry) before remediation wipes it.
7. Engage legal counsel early on disclosure obligations — for any organization finding evidence consistent with a leak-site claim, regulatory clocks (HIPAA, GDPR, state breach laws, NIS2 for EU entities) may already be relevant.

Hardening Recommendations

Immediate (24 hours)

• Patch or mitigate the KEV edge vulnerabilities: CVE-2026-50751 (Check Point IKEv1 — disable IKEv1 if unpatched), CVE-2026-20316 (Cisco FMC), CVE-2026-59310 (vCenter — restrict vCenter to management networks only), CVE-2026-63077 (TeamCity), and audit developer tooling for CVE-2026-48027 exposure.
• Disable RDP from the internet entirely; where RDP is required, place it behind VPN + MFA with NLA enforced.
• Deploy the Sigma rules above and alert at high/critical severity on shadow-copy deletion — that single rule catches nearly every ransomware family at T-minus minutes.
• Verify backups restore (not just that jobs complete) and confirm at least one offline or immutable copy exists.
• Hunt for archive-tool execution and abnormal egress across file servers and executive/finance workstations from the past 14 days.

Short-term (2 weeks)

• Segment the network so that user VLANs cannot reach server management interfaces, hypervisor management planes, or backup infrastructure. vCenter and backup consoles must sit in a dedicated, jump-host-gated management zone.
• Deploy MFA on every remote access path, including VPN, webmail, and any MSP/RMM remote tooling — credential-based initial access fails against enforced phishing-resistant MFA.
• Implement application control (WDAC/AppLocker) blocking unauthorized archive utilities and script interpreters for standard users.
• Stand up egress filtering with allowlisting for servers; there is rarely a legitimate reason for a file server to initiate connections to consumer cloud-storage APIs.
• Tiered administration with credential hygiene: eliminate standing domain admin logons to servers and workstations; use PAWs or just-in-time elevation.
• Contractual review of MSP/MSSP access if you consume managed IT services — the technology-sector listings in this campaign underscore the supply-chain blast radius of provider compromise.

Assessment Outlook

N0N's current burst fits the profile of an opportunistic mid-tier extortion operation riding unpatched edge infrastructure into SME environments. The low multi-source corroboration rate (2 of 14) means several of these listings may be exaggerated, recycled, or fabricated entirely — a known tactic for inflating leak-site credibility. Defenders should not chase the claims; they should close the exposure. The controls above address the access paths this class of actor depends on regardless of which specific claim is true.

Security Arsenal will continue monitoring N0N's leak infrastructure and will update this briefing as corroboration changes.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub