Classification: TLP:CLEAR | Publication Date: 2026-11-04 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 15 Leak-Site Claims in 48 Hours — Victimology Analysis, Detection Rules & Pre-Encryption Hunt Content

Executive Summary

Security Arsenal's dark web monitoring of the N0N ransomware operation's .onion leak site shows a compressed burst of activity over 2026-11-03 and 2026-11-04: 15 new organizations listed in roughly 48 hours, part of 20 postings across the last 100 records on the site. The geographic footprint is concentrated in the United States, Germany, Saudi Arabia, and the United Arab Emirates, with two listings lacking country attribution. The gang did not disclose victim sectors in these postings — every entry carries sector 'Not Found' — which itself is an escalation signature consistent with maximum-pressure extortion staging (withholding detail until negotiation leverage is established).

Every listing below is an accusation by a criminal group, not a confirmed breach. Inclusion in this briefing reflects what N0N claims on its leak site. Enterprises in the affected geographies should treat this as a demand to hunt, not as confirmation that any specific named party has been compromised.

Sourcing & Verification

Of the 20 most recent N0N listings on record, 14 were independently observed by a second leak-site crawler (multi-source), meaning two separate collection pipelines saw the gang publish the claim. 6 listings appear on a single source only (ransomware.live), so for those entries we cannot yet confirm the posting itself even exists on the gang's site, let alone that the underlying claim is true. Among the 15 listings detailed below, 14 are multi-source and 1 (Company #118) is single-source.

Critically: multi-source corroboration confirms only that the threat actor made the claim. No tier in our data confirms a breach occurred. Only the named organization or its regulator can confirm that. A named organization may dispute a listing, and a denial is likewise not proof the claim is false — disclosure obligations vary by jurisdiction and sector, and not every incident is reportable, so neither silence nor denial settles the question. Security Arsenal will publish corrections as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

• Aliases: None confirmed in current telemetry. The 'N0N' handle (leetspeak zero-substitution) complicates attribution pivoting; no established overlap with prior crews has been corroborated.
• Operating model: Assessed as a closed or semi-closed group rather than open RaaS. The serialized, anonymized victim numbering scheme (Company #118 through #132) and lack of sector disclosure suggest a tight operator cell running a disciplined, template-driven extortion pipeline rather than a sprawling affiliate marketplace.
• Ransom demands: Not publicly disclosed in this dataset. Groups with this playbook pattern typically scale demands to estimated victim revenue, but we have no N0N-specific figures and will not invent them.
• Initial access methods (sector-level, hypothesis only): N0N's tradecraft profile aligns with the dominant 2026 intrusion chain: exploitation of perimeter remote-access infrastructure (VPN concentrators, firewall management planes), followed by identity compromise and internal pivot. The actively exploited CVEs listed below — Check Point improper authentication (CVE-2026-50751), Cisco FMC hard-coded credentials (CVE-2026-20316), and VMware vCenter path traversal (CVE-2026-59310) — are exactly the exposure classes this profile of actor favors. We have no evidence linking any specific CVE to any specific named listing below.
• Extortion model: Double extortion — data theft threatened via leak-site publication ahead of, or independent of, encryption. The 15-postings-in-48-hours burst pattern is characteristic of a crew detonating a backlog of staged intrusions simultaneously.
• Dwell time: A simultaneous batch of 15 posts strongly implies multi-week staging. Industry-wide median dwell for double-extortion crews runs days to weeks; N0N's burst cadence is consistent with patient pre-positioning across many victims at once.

Current Campaign Analysis

Victim postings observed (2026-11-03 to 2026-11-04)

All entries below are claims by N0N on its leak site. No breach is confirmed for any organization. Sectors were not disclosed by the gang for any listing.

Sector targeting

Not determinable. N0N disclosed no sector for any of these listings ('Not Found' across the board). We will not speculate sector attribution onto anonymized victims. Defensive guidance below is therefore sector-agnostic and geography-driven.

Geographic concentration

• United States: 10 of 15 listings (67%) — the clear center of gravity.
• Germany: 1 (Company #131).
• Saudi Arabia: 1 (Company #127).
• UAE: 1 (Company #118) — single-source only; treat the posting's existence itself as provisional.
• Unknown: 2 (Company #119, Company #126).

The US-heavy spread with Gulf-state outliers mirrors crews harvesting opportunistic perimeter exposure at global scale rather than nation-state-targeted campaigns.

Victim profile

With names anonymized and sectors withheld, revenue and size estimation is not possible from this dataset. The serialized numbering (#118–#132) implies N0N's total claimed victim count is at least in the low hundreds historically, indicating a sustained operation rather than a one-week flash.

Posting frequency / escalation pattern

Fifteen posts in ~48 hours is a burst, not a drip. Operationally this means one of two things: (1) the gang completed staging across a batch of intrusions and is mass-publishing to maximize news-cycle pressure, or (2) negotiation deadlines expired in parallel and the crew is executing its leak-threat playbook at scale. Either way, the window between 'staging complete' and 'public claim' appears short — defenders in affected geographies should assume other intrusions from this same batch are still silent.

CVE exposure linkage (hypothesis only)

We have no evidence that any specific CVE was the access vector for any specific listing. That said, the following CISA KEV entries — all confirmed exploited by ransomware actors — represent the exposure classes that make burst campaigns like this possible. If you run any of this gear unpatched, you are in the target pool regardless of whether N0N specifically scans for it:

• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1). Unauthenticated edge compromise; highest-priority patch.
• CVE-2026-20316 — Cisco Secure FMC hard-coded password. Management-plane takeover of the firewall fleet itself.
• CVE-2026-59310 — VMware vCenter path traversal. Hypervisor control plane — the single highest-value ransomware target in any virtualized estate.
• CVE-2026-63077 — JetBrains TeamCity deserialization. CI/CD compromise; supply-chain staging.
• CVE-2026-48027 — Nx Console embedded malicious code. Developer workstation initial access.

Detection Engineering

Sigma rules

Three rules targeting the intrusion chain consistent with this campaign profile: (1) edge/VPN authentication anomaly at initial access, (2) PsExec/WMI lateral movement plus shadow-copy destruction, and (3) pre-encryption data staging with common exfil tooling. Tune false-positive sources (backup agents, admin workstations) to your environment.

---
title: Suspicious VPN Edge Authentication Burst - Potential Perimeter Exploitation
id: 9f2a1c4e-7b3d-4e5a-a1f0-n0nedge001
status: experimental
description: Detects authentication anomaly patterns on VPN/firewall edge devices consistent with post-exploitation access following improper-auth or hard-coded credential exploitation (e.g., Check Point IKEv1, Cisco FMC exposure classes). Hunt rule, not victim-specific attribution.
author: Security Arsenal Threat Intelligence
date: 2026/11/04
logsource:
    category: firewall
    product: checkpoint
detection:
    selection_auth:
        - action: 'accept'
          log: 'login'
    selection_suspicious:
        src_ip|contains:
            - '10.'
            - '172.16.'
            - '192.168.'
    filter_internal:
        user|contains: 'svc_backup'
    condition: selection_auth and not selection_suspicious and not filter_internal
    timeframe: 10m
fields:
    - src_ip
    - user
    - action
falsepositives:
    - Legitimate remote admin logins from new locations
    - VPN gateway cluster failover events
level: medium
tags:
    - attack.initial_access
    - attack.t1133
    - attack.t1190
---
title: PsExec or WMI Remote Service Creation Followed By Shadow Copy Deletion
id: 8e1b2d5f-6c4e-3f6b-b2e1-n0nlatmv002
status: experimental
description: Detects remote service installation (PsExec-style, Event 7045) or WMI process creation followed within a short window by Volume Shadow Copy deletion - the classic pre-encryption sequence used by double-extortion ransomware crews.
author: Security Arsenal Threat Intelligence
date: 2026/11/04
logsource:
    category: process_creation
    product: windows
detection:
    selection_psexec:
        Image|endswith:
            - '\PSEXESVC.exe'
            - '\psexec.exe'
    selection_wmi:
        ParentImage|endswith: '\WmiPrvSE.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_vss:
        Image|endswith:
            - '\vssadmin.exe'
            - '\wmic.exe'
            - '\bcdedit.exe'
        CommandLine|contains:
            - 'delete shadows'
            - 'shadowcopy delete'
            - 'recoveryenabled no'
            - 'resize shadowstorage'
    condition: (selection_psexec or selection_wmi) and selection_vss
    timeframe: 15m
fields:
    - Computer
    - User
    - CommandLine
    - ParentImage
falsepositives:
    - Legitimate VSS maintenance by backup software (filter by known backup service accounts)
    - IT automation frameworks using PsExec for software deployment
level: high
tags:
    - attack.lateral_movement
    - attack.t1021.002
    - attack.t1047
    - attack.impact
    - attack.t1490
---
title: Data Staging and Exfiltration Tool Execution Before Encryption
id: 7d0c3e6a-5d5f-2a7c-c3f2-n0nexfil003
status: experimental
description: Detects execution of tools commonly used to stage and exfiltrate data in the final pre-encryption phase - Rclone, 7zip/WinRAR bulk compression of sensitive paths, and curl-based uploads to external endpoints.
author: Security Arsenal Threat Intelligence
date: 2026/11/04
logsource:
    category: process_creation
    product: windows
detection:
    selection_rclone:
        Image|endswith: '\rclone.exe'
        CommandLine|contains:
            - 'copy'
            - 'sync'
            - 'move'
    selection_archive:
        Image|endswith:
            - '\7z.exe'
            - '\7za.exe'
            - '\rar.exe'
            - '\winrar.exe'
        CommandLine|contains:
            - ' a '
            - ' -v'
            - '.7z'
            - '.rar'
    selection_curl_upload:
        Image|endswith: '\curl.exe'
        CommandLine|contains:
            - '--upload-file'
            - '-T '
            - '-F file=@'
    condition: 1 of selection_*
fields:
    - Computer
    - User
    - CommandLine
    - Image
falsepositives:
    - Developer use of Rclone/curl for legitimate cloud sync
    - Enterprise archive utilities in build pipelines
level: high
tags:
    - attack.collection
    - attack.t1560.001
    - attack.exfiltration
    - attack.t1567.002

Microsoft Sentinel KQL — pre-encryption staging hunt

Hunts the 72-hour window preceding a potential detonation: rare LOLBin staging activity (compression tools, archive utilities, mass file access) correlated with new scheduled tasks or services — the persistence layer N0N-profile crews install before encryption fires. Run against endpoints flagged by any Sigma rule above first, then widen.

let Lookback = 7d;
let SuspiciousStaging =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName in~ ("7z.exe","7za.exe","rar.exe","rclone.exe","curl.exe","WinSCP.exe","megacmd.exe")
       or ProcessCommandLine has_any ("delete shadows","resize shadowstorage","recoveryenabled no")
    | project StagingTime=TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, DeviceId;
let NewPersistence =
    DeviceEvents
    | where TimeGenerated > ago(Lookback)
    | where ActionType has_any ("ScheduledTaskCreated","ServiceInstalled")
       or (FileName =~ "svchost.exe" and AdditionalFields has "Schedule")
    | project PersistTime=TimeGenerated, DeviceName, ActionType, FileName, InitiatingProcessAccountName, DeviceId;
SuspiciousStaging
| join kind=inner NewPersistence on DeviceId
| where abs(datetime_diff('minute', StagingTime, PersistTime)) <= 4320
| extend HoursBetween = datetime_diff('hour', StagingTime, PersistTime)
| summarize StagingEvents=count(), PersistenceActions=make_set(ActionType), DistinctTools=make_set(FileName), FirstSeen=min(StagingTime), LastSeen=max(PersistTime) by DeviceName, AccountName
| where StagingEvents >= 3
| sort by StagingEvents desc;

Interpretation: any device with 3+ staging-tool executions that also gained a scheduled task or new service inside the lookback window is a priority-1 triage candidate. In a pre-encryption scenario you typically have hours, not days, between this signal and detonation.

Rapid-response PowerShell — 48-hour posture check

Run on any endpoint suspected of being in a staging window. Checks the four highest-signal artifacts: exposed RDP, recent scheduled tasks, shadow copy integrity, and suspicious staging binaries.

# Security Arsenal - N0N-profile rapid triage script (2026-11-04)
# Run elevated. Read-only; makes no system changes.
$report = @{}; $cutoff = (Get-Date).AddDays(-7)

# 1. RDP exposure check
$rdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue).fDenyTSConnections
$rdpListening = (Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue) | Measure-Object | Select-Object -ExpandProperty Count
$report.RDPEnabled = ($rdpEnabled -eq 0)
$report.RDPListeners = $rdpListening

# 2. Scheduled tasks created in last 7 days
$report.RecentTasks = Get-ScheduledTask | Where-Object {
    $_.Date -and ([datetime]$_.Date) -gt $cutoff -and $_.TaskPath -notlike '\Microsoft*'
} | Select-Object TaskName, TaskPath, Date, @{N='Action';E={($_.Actions | ForEach-Object {$_.Execute}) -join '; '}}

# 3. Volume Shadow Copy status (deletion is a pre-encryption red flag)
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
$report.ShadowCopyCount = ($shadows | Measure-Object).Count
$report.VSSServiceState = (Get-Service VSS -ErrorAction SilentlyContinue).Status

# 4. Staging/exfil binaries outside expected paths
$tools = 'rclone.exe','7z.exe','rar.exe','megacmd.exe','WinSCP.exe'
$report.SuspiciousBinaries = foreach ($t in $tools) {
    Get-ChildItem -Path 'C:\Users','C:\ProgramData','C:\Windows\Temp' -Filter $t -Recurse -ErrorAction SilentlyContinue |
        Select-Object FullName, LastWriteTime
}

# 5. New local admins in last 7 days (identity escalation check)
$report.NewAdminGroupEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4732; StartTime=$cutoff} -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'Administrators' } | Select-Object TimeCreated, Message -First 20

$report | ConvertTo-Json -Depth 4 | Out-File "$env:TEMP\n0n_triage_$(Get-Date -Format 'yyyyMMdd_HHmm').json"
Write-Host "Triage complete. Shadow copies present: $($report.ShadowCopyCount). Recent non-Microsoft tasks: $(@($report.RecentTasks).Count)." -ForegroundColor Cyan

A ShadowCopyCount of 0 on a server that should have restore points, combined with any hit in sections 2 or 4, warrants immediate isolation and IR engagement.

Incident Response Priorities

T-minus detection checklist (before encryption fires)

1. Shadow copy manipulation — any vssadmin delete shadows, bcdedit recoveryenabled no, or unexpected VSS service stops on servers.
2. New scheduled tasks or services created outside change windows, especially under non-admin service accounts.
3. Staging tools (Rclone, 7z, WinSCP, MEGAcmd) executing on file servers or database hosts.
4. Bulk read access — a single account touching thousands of files across shares within hours (watch SACLs on high-value shares).
5. EDR tampering — sensor service stops, exclusion additions, or driver unloads.
6. Unusual VPN/firewall management-plane logins — new admin sessions on edge devices, especially from IPs with no prior history (see CVE-2026-50751 / CVE-2026-20316 exposure classes).

Assets this profile of gang prioritizes for exfiltration

Based on the double-extortion playbook consistent with N0N's leak-site behavior, assume targeting of: finance and legal document repositories, HR/PII databases, customer contracts, email archives of executive and legal mailboxes, and anything on the virtualization management plane (vCenter) that would let them encrypt an entire host fleet in one move.

Containment actions, ordered by urgency

1. Isolate, don't power off — network-quarantine suspect endpoints/hosts to preserve volatile memory and staging evidence.
2. Disable compromised identities — force-disable any account seen in staging events; reset all service accounts with interactive logons.
3. Block edge management access — restrict VPN/firewall/vCenter management interfaces to a hardened jump host immediately.
4. Snapshot and protect backups — verify backup immutability; take offline copies of critical restore points before touching anything else.
5. Sinkhole exfil paths — block outbound to consumer file-transfer and cloud storage services at the proxy; rate-limit large egress.
6. Engage IR counsel and assess disclosure obligations — if your organization is named in any N0N listing, treat it as a claim requiring investigation, not confirmation. Contact Security Arsenal IR if support is needed.

Hardening Recommendations

Immediate (24 hours)

• Patch or mitigate the KEV exposure classes this campaign profile exploits: Check Point Security Gateway (CVE-2026-50751), Cisco Secure FMC (CVE-2026-20316), VMware vCenter (CVE-2026-59310), JetBrains TeamCity (CVE-2026-63077). If patching is not possible today, pull management interfaces off routable networks now.
• Enforce phishing-resistant MFA on all remote access — VPN, RDP gateways, and firewall/hypervisor management planes.
• Deploy the Sigma and KQL content above; alert on shadow-copy deletion as a page-the-oncall event.
• Audit scheduled tasks and services created in the last 14 days across servers.
• Block Rclone/MEGA/WinSCP and unauthorized archive tools via AppLocker/WDAC where they have no business justification.

Short-term (2 weeks)

• Segment the virtualization layer — vCenter and hypervisor management on an isolated VLAN with jump-host-only access and its own identity boundary.
• Immutable, offline backup tier with a tested restore path; ransomware crews explicitly hunt backup infrastructure.
• Egress filtering by default — deny outbound to unsanctioned cloud storage and file-transfer services; alert on large sustained uploads from servers.
• Deception layer — canary file shares and honey credentials on high-value servers to convert silent staging into an early alarm.
• CI/CD hardening — given the TeamCity and Nx exposure classes, isolate build infrastructure, pin developer tooling, and verify package integrity.
• Tabletop the double-extortion scenario — decision-makers should rehearse the leak-threat playbook (legal, comms, regulator timelines) before a listing ever appears with their name on it.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub