Classification: TLP:CLEAR | Publication Date: 2026-11-07 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 15+ New Leak-Site Listings in 48 Hours — Unverified Claims Targeting Healthcare, Technology & Energy Sectors

Executive Summary

Between 2026-11-05 and 2026-11-06, the ransomware group N0N published 15 named listings on its dark web leak site, out of 20 total listings observed in its most recent 100 postings. The claims span Healthcare, Technology, Energy & Utilities, Professional Services, and Retail & E-Commerce across eight countries (IT, US, SA, AE, CA, DK, ID, DE).

Critical framing: These are claims made by a criminal organization on its leak site. A leak-site posting is an accusation, not a confirmed breach. N0N claims to have compromised the named organizations; none of these claims have been independently confirmed by the organizations themselves, regulators, or incident responders at the time of publication. Security teams at named organizations — and at organizations in the same sectors and geographies — should treat this as an elevated-threat signal and prioritize the detection and hardening content in this briefing, not as confirmation that any specific incident has occurred.

Sourcing & Verification

• Corroboration status: 15 of the 20 listings covered here were independently observed by a second leak-site crawler (MULTI-SOURCE); 5 appear on a single source only. Multi-source corroboration means two independent crawlers saw the gang publish the claim. It does not mean the underlying breach is confirmed.
• Nature of inclusion: Every listing in this briefing reflects the threat actor's claim. It is NOT confirmation of a breach, compromise, or data theft against any named organization.
• Disputes and denials: A named organization may dispute a listing. A denial is likewise not proof the claim is false — disclosure obligations vary by jurisdiction and sector, and not every incident is legally reportable. Neither silence nor denial settles the question. Only the organization or its regulator can confirm an incident.
• Corrections: Security Arsenal will publish corrections to this briefing as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

Analyst note: Where specifics about N0N are not established in monitored sources, the profile above reflects patterns common to its operational tier. Treat profile elements as hypotheses to be tested against your own telemetry, not as confirmed attribution.

Current Campaign Analysis

Sector Targeting

N0N's recent listings cluster in Healthcare (Dompé Farmaceutici S.p.A., Cogent Biosciences, Inc., Delta Dental of Missouri), Technology (Chartboost LLC, Scry Analytics), Energy & Utilities (Centrepoint), Professional Services (Resource Consultants), and Retail & E-Commerce (Max Fashion, Hallmark Cards, Inc., The Container Store). Five additional listings are tagged "Not Found," indicating the leak site did not resolve a sector classification — a pattern consistent with either placeholder entries or deliberately vague pressure postings.

Healthcare and technology together represent a substantial share of named claims, consistent with a crew prioritizing sectors where downtime and data sensitivity maximize extortion leverage.

Geographic Concentration

The United States is the most represented geography among named claims, with additional listings in Italy, Saudi Arabia, the UAE, Canada, Denmark, Indonesia, and Germany. This is a broad, opportunistic geographic footprint rather than a regionally focused campaign.

Victim Profile

Named organizations range from mid-market firms to large consumer brands and pharmaceutical/biotech companies. Revenue spans an estimated tens of millions to multi-billion dollars (USD) based on sector norms — suggesting N0N is not size-gating its claimed targets, consistent with opportunistic initial-access-driven operations.

Posting Frequency & Escalation

The cadence is notable: 15 listings in a ~48-hour window (2026-11-05 through 2026-11-06). Batch posting of this kind is a recognized pressure tactic — either reflecting a burst of completed intrusions, or a strategic dump of older claims timed for maximum visibility. The presence of five "Company #NNN" placeholders on 2026-11-05 suggests the gang may be staging listings ahead of negotiation deadlines.

CVE Exposure Context (Hypothesis — Not Victim Attribution)

We have no evidence linking any specific CVE to any specific named listing. However, the following CISA KEV entries with confirmed ransomware use represent the class of edge and infrastructure exposure this operational tier is known to exploit, and organizations in targeted sectors should treat them as priority patching items:

• CVE-2026-59310 — Broadcom VMware vCenter path traversal (added to KEV 2026-08-18): vCenter compromise enables direct access to hypervisor infrastructure — the highest-value ransomware target.
• CVE-2026-63077 — JetBrains TeamCity deserialization (KEV 2026-08-05): build-server compromise enables supply-chain-style lateral access.
• CVE-2026-20316 — Cisco Secure FMC hard-coded password (KEV 2026-07-29): firewall management plane takeover.
• CVE-2026-50751 — Check Point Security Gateway improper authentication in IKEv1 (KEV 2026-06-08): VPN edge exploitation — a classic ransomware initial access vector.
• CVE-2026-48027 — Nx Console embedded malicious code (KEV 2026-05-27): developer workstation supply-chain foothold.

Defensive hypothesis: crews in this tier commonly chain an edge-device foothold (VPN/firewall) into virtualization or management planes (vCenter, build servers). If your organization runs any of the above, verify patch state today.

Detection Engineering

The following detections target TTPs typical of this operational tier: edge exploitation followed by remote service lateral movement (PsExec/WMI), staging of exfiltration archives, and pre-encryption shadow copy destruction.

---
title: RDP or VPN Brute Force Followed by Successful Authentication
title_id: 9f3a1c2e-7b41-4e5a-9c21-n0nedge001
description: Detects repeated failed logons from a single source followed by a successful interactive/remote logon — consistent with brute-forced VPN/RDP initial access used by ransomware crews.
status: experimental
logsource:
  product: windows
  service: security
detection:
  failed:
    EventID: 4625
  successful:
    EventID: 4624
    LogonType:
      - 3
      - 10
  condition: failed and successful
timeframe: 15m
level: high
tags:
  - attack.initial_access
  - attack.t1078
  - attack.t1133
falsepositives:
  - Legitimate password spray from misconfigured service accounts
fields:
  - SourceIp
  - TargetUserName
  - LogonType
date: 2026/11/07
---
title: PsExec or WMI Remote Service Creation — Lateral Movement
title_id: 8e2b0d1f-6a32-4d4b-8b10-n0nlat002
description: Detects creation of remote services or WMI process execution consistent with PsExec/WMIC lateral movement used in pre-ransomware staging.
status: experimental
logsource:
  product: windows
  service: system
detection:
  service_install:
    EventID: 7045
    ServiceName|contains:
      - PSEXESVC
      - PAExec
      - RemCom
  image_wmi:
    - EventID: 4688
    - NewProcessName|endswith: '\wmiprvse.exe'
    - ParentProcessName|endswith: '\wmiprvse.exe'
  condition: service_install or image_wmi
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002
  - attack.t1047
falsepositives:
  - Legitimate admin tooling (SCCM, PDQ); baseline service creation in your environment
date: 2026/11/07
---
title: Pre-Encryption Staging — Shadow Copy Deletion and Archive Creation
title_id: 7d1c9e0a-5b21-4c3a-7a09-n0nstage003
description: Detects Volume Shadow Copy deletion and suspicious mass archive creation — classic pre-ransomware staging behavior observed across double-extortion crews.
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  shadow_delete:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
      - '\wbadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'recoveryenabled no'
      - 'delete catalog'
  archive_stage:
    Image|endswith:
      - '\rclone.exe'
      - '\7z.exe'
      - '\winrar.exe'
      - '\rar.exe'
    CommandLine|contains:
      - 'copy'
      - 'sync'
      - ' a '
  condition: shadow_delete or archive_stage
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.exfiltration
  - attack.t1560.001
falsepositives:
  - Backup software maintenance; legitimate archiving by admins — tune by host and user
date: 2026/11/07

The following Microsoft Sentinel hunt query identifies pre-ransomware staging: remote service creation, suspicious mass file reads on a single host (exfil candidate), and shadow copy tampering within a correlated window.

let lookback = 7d;
let SuspiciousHosts = (SecurityEvent
| where TimeGenerated > ago(lookback)
| where EventID == 7045
| where ServiceName has_any ("PSEXESVC","RemCom","PAExec")
| summarize FirstSeen=min(TimeGenerated) by Computer, Account, ServiceName);
SecurityEvent
| where TimeGenerated > ago(lookback)
| where EventID == 4688
| where CommandLine has_any ("delete shadows", "shadowcopy delete", "recoveryenabled no", "delete catalog")
   or Process has_any ("rclone.exe", "winrar.exe", "7z.exe")
| summarize ShadowOrArchiveEvents=count(), Commands=make_set(CommandLine, 10) by Computer, Account, bin(TimeGenerated, 1h)
| join kind=inner (SuspiciousHosts) on Computer
| project Computer, Account, TimeGenerated, ShadowOrArchiveEvents, Commands, ServiceName, FirstSeen
| order by TimeGenerated asc;

The following PowerShell script performs rapid-response checks: exposed RDP listeners, scheduled tasks created in the last 7 days, and Volume Shadow Copy state — run on critical servers and hypervisor management hosts.

#Requires -RunAsAdministrator
# N0N-tier rapid response check: RDP exposure, new scheduled tasks, shadow copy state
$report = @()

# 1. RDP listener exposure
$rdpEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue).fDenyTSConnections
$rdpStatus = if ($rdpEnabled -eq 0) { 'RDP ENABLED - verify exposure' } else { 'RDP disabled' }
$report += [pscustomobject]@{ Check='RDP Listener'; Result=$rdpStatus }

# 2. Scheduled tasks created in last 7 days
$cutoff = (Get-Date).AddDays(-7)
Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt $cutoff } | ForEach-Object {
    $report += [pscustomobject]@{ Check='New Scheduled Task'; Result="$($_.TaskName) | $($_.Date) | $($_.TaskPath)" }
}

# 3. Shadow copy state
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) { $report += [pscustomobject]@{ Check='Shadow Copies'; Result='NONE FOUND - investigate possible deletion (T1490)' } }
else { $shadows | ForEach-Object { $report += [pscustomobject]@{ Check='Shadow Copies'; Result="Present: $($_.DeviceObject) created $($_.InstallDate)" } } }

# 4. Recent logons of type 10 (RDP) from external IPs
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=$cutoff} -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'Logon Type:\s+10' } |
  Select-Object -First 50 | ForEach-Object {
    $report += [pscustomobject]@{ Check='RDP Logon (7d)'; Result="$($_.TimeCreated) | $($_.Message -split "`n" | Select-String 'Source Network Address' )" }
}

$report | Format-Table -AutoSize | Out-String -Width 300
$report | Export-Csv -Path ".\n0n_triage_$(Get-Date -Format yyyyMMdd_HHmm).csv" -NoTypeInformation
Write-Host "Triage report written. Review any 'NONE FOUND' shadow copy result IMMEDIATELY."

Incident Response Priorities

T-minus Detection Checklist (Before Encryption Fires)

1. New remote services on servers/workstations (Event 7045: PSEXESVC, RemCom, PAExec)
2. Shadow copy deletion commands (vssadmin, wmic shadowcopy, bcdedit recoveryenabled no)
3. Bulk archive creation (7z/rar/rclone against file shares or database exports)
4. Anomalous outbound transfer volume to unfamiliar cloud storage or VPS endpoints
5. New scheduled tasks on servers, especially running as SYSTEM
6. EDR tampering: service stops, sensor uninstall attempts, safe-mode boot configuration
7. VPN/firewall log anomalies: logins at unusual hours, impossible-travel patterns, new admin accounts on edge appliances

Assets This Operational Tier Historically Prioritizes for Exfiltration

• File shares containing HR, legal, and financial records
• Database backups (SQL exports, backup repository contents — including Veeam repositories)
• Healthcare-adjacent data (patient/insured records) — highest extortion leverage in the healthcare claims cluster
• Email archives of executive and legal mailboxes
• Virtualization management planes (vCenter) — control here enables mass encryption

Containment Actions, Ordered by Urgency

1. Isolate suspected staging hosts from the network (EDR network isolation first — do not power off; preserve memory)
2. Disable suspect accounts and force credential resets for any account seen in lateral movement telemetry, starting with privileged accounts
3. Block identified exfil destinations at the egress proxy/firewall
4. Snapshot affected VMs and capture volatile data before remediation
5. Rotate edge appliance credentials (VPN, firewall management) and review for unauthorized local accounts
6. Verify backup integrity and confirm backups are offline/immutable before attackers can reach repositories

Hardening Recommendations

Immediate (24 hours)

• Patch or mitigate the five KEV CVEs above if present in your environment — especially CVE-2026-50751 (Check Point) and CVE-2026-20316 (Cisco FMC) on edge devices, and CVE-2026-59310 (vCenter) on virtualization infrastructure.
• Disable or restrict RDP at the perimeter; require VPN + MFA for any remote administration. Audit VPN accounts for MFA coverage — no exceptions for service accounts.
• Block PsExec-style service creation where not operationally required; alert on any 7045 event on servers.
• Enable tamper protection on EDR and alert on sensor stop/uninstall events.
• Deploy the Sigma rules and KQL query above to your SIEM and run the triage script on Tier-0 assets (domain controllers, vCenter, backup servers).

Short-Term (2 Weeks)

• Segment the virtualization management plane and backup infrastructure into isolated network zones with dedicated admin credentials (no shared domain admin paths).
• Implement egress filtering and DLP alerting on bulk outbound transfers to non-corporate cloud storage (the primary exfil channel for this tier of actor).
• Move backups to immutable storage with separate credentials; test restoration of at least one critical system.
• Deploy honey credentials and canary file shares in locations typical of exfil staging — early tripwire against dwell-time activity.
• Conduct a tabletop exercise built around a double-extortion scenario: encryption on virtualization infrastructure plus threatened data publication.

Bottom Line

N0N's 48-hour posting burst is a pressure play — and an unverified one. But the sectors and geographies claimed align with real, current edge-device exploitation trends reflected in the CISA KEV. Organizations in healthcare, technology, energy, professional services, and retail — in the US, Italy, Saudi Arabia, the UAE, Canada, Denmark, Indonesia, and Germany — should use this window to validate patching, deploy the detections above, and confirm backup integrity. Do not wait for confirmation of any individual claim to act on the defensive content.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub