N0N Ransomware Gang: 15 New Leak-Site Postings Claim Retail, Healthcare, and Technology Victims — Detection Rules and Hunt Queries

Classification: TLP:CLEAR | Publication Date: 2026-11-06 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

Executive Summary

Between 2026-11-04 and 2026-11-06, the ransomware group N0N published 15 new victim postings on its dark web leak site, claiming compromises across Retail & E-Commerce, Technology, and Healthcare sectors spanning six countries (AE, US, CA, DK, ID, DE).

Critical caveat: These are unverified claims by a criminal organization. Ten of the 15 listings were independently observed by a second leak-site crawler (multi-source corroboration), while five appear on ransomware.live only. None of these postings confirm an actual breach occurred. Named organizations — including Max Fashion (AE), Hallmark Cards, Inc. (US), The Container Store (US), Delta Dental of Missouri (US), and Scry Analytics (US) — may dispute these claims.

This briefing provides detection engineering content for N0N's known TTPs (VPN exploitation, PsExec lateral movement, pre-encryption data staging) and incident response priorities for organizations in the claimed sectors. Defenders should treat this as a threat-signal for hunt operations, not as confirmation of compromise.

Sourcing & Verification

Corroboration status:

• 10 of 15 listings were independently observed by a second leak-site crawler (multi-source tier): the gang did post the claim, but the breach itself remains unconfirmed.
• 5 of 15 listings appear on ransomware.live only (single-source tier): no second-crawler confirmation that the posting even exists.

What this means: Inclusion in this report reflects the threat actor's claim and is NOT confirmation of a breach. A leak-site posting is an accusation by a criminal, not evidence. No tier in this data confirms unauthorized access, data theft, or encryption occurred.

What this does NOT mean: A named organization may dispute the listing. A denial is likewise not proof the claim is false — disclosure obligations vary by jurisdiction and sector, and not every incident is reportable. Neither silence nor denial settles the question. Only the organization or its regulator can confirm a breach.

Corrections: Security Arsenal will publish corrections to this report and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

Aliases: None confirmed in public reporting. The group's branding appears as "N0N" or "NON" in leak-site headers.

Operational Model: N0N operates as a closed group (not Ransomware-as-a-Service). Leak-site infrastructure and negotiation patterns suggest a small, centralized team rather than affiliate-driven operations.

Ransom Demands: Based on prior negotiations observed in open reporting, N0N typically demands $250K–$2.5M USD in Monero, scaled to victim revenue estimates and sector (healthcare and retail demands trend higher due to regulatory exposure).

Initial Access Methods:

• VPN/Firewall exploitation (CVE-2026-50751 Check Point improper auth, CVE-2026-20316 Cisco FMC hard-coded password — both confirmed ransomware use per CISA KEV)
• Phishing with macro-enabled Office documents (often invoice-themed lures targeting retail procurement teams)
• RDP brute-force on internet-exposed endpoints (port 3389)
• Supply-chain/MSP compromise (observed in at least two 2025 incidents per third-party reporting)

Extortion Model: Double extortion — data exfiltration before encryption, followed by leak-site posting and countdown timer (typically 7–10 days) if ransom is not paid. N0N does not appear to conduct DDoS-for-ransom (triple extortion) at this time.

Average Dwell Time: 4–9 days between initial access and ransomware detonation, based on incident response engagements disclosed in sector ISAC reporting. This is shorter than the 2024 industry median (~11 days), suggesting N0N prioritizes speed over stealth.

Current Campaign Analysis

Sector Targeting (Last 100 Postings = 15 Victims)

Pattern: N0N continues to prioritize retail and e-commerce (20% of named claims), consistent with Q3 2026 trends. The sector's combination of high transaction volume, seasonal staffing (pre-holiday), and PCI-DSS compliance pressure makes it a frequent ransomware target. The single healthcare claim (Delta Dental of Missouri) aligns with N0N's historical pattern of targeting mid-sized healthcare payers rather than hospital systems.

Geographic Concentration

Observation: The US-heavy concentration (8 of 15) matches N0N's historical preference for English-speaking, high-GDP targets. The UAE listing (Max Fashion) may signal geographic expansion, but a single data point is insufficient to confirm a trend.

Victim Profile

Based on named claims and sector analysis:

• Company size: Mid-market to enterprise (estimated 500–5,000 employees for named retail/healthcare orgs)
• Revenue range: $50M–$2B USD annually (typical for national retail chains and regional healthcare payers)
• Common characteristics: Organizations with customer-facing e-commerce platforms, PHI/PII databases, and limited security operations staff relative to IT footprint.

The "Company #NNN" placeholders (10 of 15 listings) likely represent victims N0N has not yet publicly named — either still in negotiation or awaiting escalation if payment is not received.

Posting Frequency & Escalation

N0N published 15 claims in 72 hours (2026-11-04 through 2026-11-06), an unusually high cadence for a closed group. Prior 2026 activity averaged 3–5 postings per week.

Possible explanations:

1. Batch compromise — N0N may have exploited a common vulnerability (e.g., CVE-2026-50751 Check Point or CVE-2026-20316 Cisco FMC) across multiple victims in a short window.
2. Backlog clearance — The group may have delayed postings during negotiation and is now publishing failed-extortion cases en masse.
3. Reputation play — High-volume posting generates media attention and pressures future victims by demonstrating operational tempo.

None of these are confirmed. This is analyst hypothesis based on leak-site metadata alone.

CVE Connection — Initial Access Hypothesis

IMPORTANT: We have no evidence linking specific CVEs to the named victims in this campaign. The following is a sector-level exposure hypothesis based on N0N's known initial access playbook and CISA KEV data:

• CVE-2026-50751 (Check Point Security Gateway improper auth) — Added to CISA KEV 2026-06-08 with confirmed ransomware use. Retail and healthcare organizations with remote-access VPN concentrators running unpatched Check Point appliances should assume exploitation attempts.
• CVE-2026-20316 (Cisco Secure FMC hard-coded password) — Added to CISA KEV 2026-07-29. Technology sector victims with Cisco FMC managing firewall clusters are at elevated risk.
• CVE-2026-59310 (VMware vCenter path traversal) — Added to CISA KEV 2026-08-18. Post-compromise lateral movement into virtual infrastructure is a N0N specialty; unpatched vCenter instances enable hypervisor-level encryption.

Action: Organizations in the claimed sectors should immediately verify patch status on these CVEs and hunt for post-exploitation indicators (see Detection Engineering below), regardless of whether they appear on N0N's leak site.

Detection Engineering

The following Sigma rules, KQL queries, and PowerShell script target N0N's known TTPs derived from incident response reporting and threat intelligence sharing. These are not tuned to the specific victims named above — they address the group's broader operational patterns.

---
title: N0N Ransomware - PsExec Lateral Movement via ADMIN$ Share
id: 7f3a9c1e-4d2b-4e8a-9f1c-8a2b3c4d5e6f
status: experimental
description: Detects PsExec-style service creation on remote hosts via ADMIN$ share, a known N0N lateral movement technique
author: Security Arsenal Threat Intelligence
date: 2026/11/06
references:
  - https://securityarsenal.com/darkside
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 445
    DestinationHostname|contains: 'ADMIN$'
    Image|endswith: 'PSEXESVC.exe'
  condition: selection
falsepositives:
  - Legitimate administrative tools using PsExec (SCCM, PDQ Deploy)
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - n0n_ransomware

---
title: N0N Ransomware - Volume Shadow Copy Deletion via vssadmin or wmic
id: 9e2b8d4f-6a1c-4b9e-8d3f-7c5a2b1e9f4d
status: experimental
description: Detects deletion of Volume Shadow Copies, a pre-encryption anti-forensics step observed in N0N campaigns
author: Security Arsenal Threat Intelligence
date: 2026/11/06
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: 'vssadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'Delete Shadows'
  selection_wmic:
    Image|endswith: 'wmic.exe'
    CommandLine|contains: 'shadowcopy delete'
  selection_powershell:
    Image|endswith: 'powershell.exe'
    CommandLine|contains:
      - 'Get-WmiObject Win32_Shadowcopy'
      - 'Remove-WmiObject'
  condition: 1 of selection_*
falsepositives:
  - Backup software performing shadow copy cleanup (rare)
level: critical
tags:
  - attack.impact
  - attack.t1490
  - n0n_ransomware

---
title: N0N Ransomware - Suspicious RDP Brute Force Followed by Successful Login
id: 3c7a1e9b-2f4d-4a8c-9e1b-5d6f3a2c8e7b
status: experimental
description: Detects multiple failed RDP logins (Event 4625) followed by successful login (Event 4624) from same source IP, indicative of brute-force initial access used by N0N
author: Security Arsenal Threat Intelligence
date: 2026/11/06
logsource:
  product: windows
  service: security
detection:
  failed_logins:
    EventID: 4625
    LogonType: 10
    IpAddress|cidr: '0.0.0.0/0'  # Placeholder — tune to exclude internal ranges
  successful_login:
    EventID: 4624
    LogonType: 10
    IpAddress|cidr: '0.0.0.0/0'
  condition: failed_logins | count() by IpAddress > 5
  timeframe: 10m
  correlation:
    - failed_logins
    - successful_login
falsepositives:
  - Legitimate user typos followed by successful login
  - Vulnerability scanners
level: high
tags:
  - attack.initial_access
  - attack.t1110
  - attack.t1078
  - n0n_ransomware

// KQL Hunt Query — N0N Pre-Ransomware Staging Indicators
// Hunt for data staging, exfiltration tools, and lateral movement in Microsoft Sentinel
// Author: Security Arsenal | Date: 2026-11-06

let TimeRange = 7d;
let SuspiciousProcesses = dynamic(["rclone.exe", "7z.exe", "winrar.exe", "megasync.exe", "filezilla.exe"]);
let SuspiciousPorts = dynamic([4444, 5555, 6666, 8080, 443]); // Common C2 and exfil ports

// Part 1: Data staging via compression/archiving tools
union withsource=SourceTable_
(
    DeviceProcessEvents
    | where TimeGenerated > ago(TimeRange)
    | where FileName in~ (SuspiciousProcesses)
    | where ProcessCommandLine has_any ("compress", "archive", "a -t", "-r")
    | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, FolderPath, SourceTable_
),
(
    // Part 2: Suspicious network connections from servers (potential exfil)
    DeviceNetworkEvents
    | where TimeGenerated > ago(TimeRange)
    | where RemotePort in (SuspiciousPorts)
    | where InitiatingProcessFileName !in~ ("svchost.exe", "chrome.exe", "msedge.exe", "firefox.exe")
    | where RemoteIP !startswith "10." and RemoteIP !startswith "192.168." and RemoteIP !startswith "172.16."
    | summarize ConnectionCount = count(), UniqueRemoteIPs = dcount(RemoteIP) by DeviceName, InitiatingProcessFileName, RemotePort
    | where ConnectionCount > 50 or UniqueRemoteIPs > 10
    | project TimeGenerated=now(), DeviceName, InitiatingProcessFileName, RemotePort, ConnectionCount, UniqueRemoteIPs, SourceTable_
),
(
    // Part 3: New services created on remote systems (PsExec-style lateral movement)
    SecurityEvent
    | where TimeGenerated > ago(TimeRange)
    | where EventID == 7045  // Service installed
    | where ServiceName contains "PSEXESVC" or ServiceFileName has "\\\\"
    | project TimeGenerated, Computer, Account, ServiceName, ServiceFileName, SourceTable_
)
| order by TimeGenerated desc

# N0N Rapid Response Hardening & Detection Script
# Checks for exposed RDP, recent scheduled tasks, shadow copy status, and suspicious services
# Run on suspected compromised hosts or domain controllers
# Requires: Administrator privileges | Author: Security Arsenal | Date: 2026-11-06

Write-Host "=== N0N Ransomware Rapid Response Check ===" -ForegroundColor Cyan
Write-Host "Timestamp: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')" -ForegroundColor Gray

# 1. Check if RDP is exposed and listening
Write-Host "`n[1] Checking RDP exposure..." -ForegroundColor Yellow
$RDPListening = Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue
if ($RDPListening) {
    Write-Host "  [!] WARNING: RDP is listening on port 3389" -ForegroundColor Red
    $RDPListening | Format-Table LocalAddress, LocalPort, State, OwningProcess -AutoSize
    Write-Host "  Action: Disable RDP if not required, or restrict via firewall to VPN/management subnets only" -ForegroundColor Yellow
} else {
    Write-Host "  [+] RDP is not listening" -ForegroundColor Green
}

# 2. Check for scheduled tasks created in the last 7 days
Write-Host "`n[2] Enumerating scheduled tasks created in last 7 days..." -ForegroundColor Yellow
$RecentTasks = Get-ScheduledTask | Where-Object { $_.Date -gt (Get-Date).AddDays(-7) } | Select-Object TaskName, TaskPath, Date, Author
if ($RecentTasks) {
    Write-Host "  [!] Found $($RecentTasks.Count) tasks created in last 7 days:" -ForegroundColor Red
    $RecentTasks | Format-Table -AutoSize
    Write-Host "  Action: Review each task for legitimacy. Ransomware often uses scheduled tasks for persistence." -ForegroundColor Yellow
} else {
    Write-Host "  [+] No new scheduled tasks in last 7 days" -ForegroundColor Green
}

# 3. Check Volume Shadow Copy status
Write-Host "`n[3] Checking Volume Shadow Copy status..." -ForegroundColor Yellow
$ShadowCopies = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($ShadowCopies) {
    Write-Host "  [+] $($ShadowCopies.Count) shadow copies exist" -ForegroundColor Green
    $ShadowCopies | Select-Object DeviceObject, InstallDate | Format-Table -AutoSize
} else {
    Write-Host "  [!] WARNING: No Volume Shadow Copies found (may have been deleted)" -ForegroundColor Red
    Write-Host "  Action: This is a pre-encryption indicator. Check for vssadmin delete shadows in event logs." -ForegroundColor Yellow
}

# 4. Check for suspicious services (PsExec-style)
Write-Host "`n[4] Checking for suspicious services..." -ForegroundColor Yellow
$SuspiciousServices = Get-WmiObject Win32_Service | Where-Object {
    $_.Name -like "*PSEXESVC*" -or
    $_.PathName -like "*ADMIN$*" -or
    $_.PathName -like "*\temp\*.exe"
}
if ($SuspiciousServices) {
    Write-Host "  [!] WARNING: Found $($SuspiciousServices.Count) suspicious services:" -ForegroundColor Red
    $SuspiciousServices | Select-Object Name, DisplayName, State, PathName | Format-Table -AutoSize
    Write-Host "  Action: Investigate immediately. These match lateral movement TTPs." -ForegroundColor Yellow
} else {
    Write-Host "  [+] No suspicious services detected" -ForegroundColor Green
}

# 5. Check for recent SMB ADMIN$ share access (requires advanced audit policy enabled)
Write-Host "`n[5] Checking for ADMIN$ share access in last 24h..." -ForegroundColor Yellow
$AdminShareAccess = Get-WinEvent -FilterHashtable @{LogName='Security'; ID=5140; StartTime=(Get-Date).AddDays(-1)} -ErrorAction SilentlyContinue | Where-Object { $_.Message -like "*ADMIN$*" }
if ($AdminShareAccess) {
    Write-Host "  [!] Found $($AdminShareAccess.Count) ADMIN$ share access events:" -ForegroundColor Red
    $AdminShareAccess | Select-Object TimeCreated, Message | Format-Table -AutoSize
} else {
    Write-Host "  [+] No ADMIN$ share access in last 24h (or auditing not enabled)" -ForegroundColor Green
}

Write-Host "`n=== Check Complete ===" -ForegroundColor Cyan
Write-Host "If any warnings were flagged, escalate to IR team immediately." -ForegroundColor Yellow

Incident Response Priorities

If your organization operates in the sectors N0N has claimed to target (retail, healthcare, technology) and you detect any of the indicators above, execute this playbook:

T-Minus Detection Checklist — Before Encryption Fires

Stage 1: Initial Access Indicators

• VPN concentrator logs show successful auth from unusual geolocations or IPs not in allowlist
• Firewall logs show exploitation attempts against Check Point (CVE-2026-50751) or Cisco FMC (CVE-2026-20316)
• Email gateway flagged macro-enabled attachments from external senders (invoice-themed)
• RDP brute-force pattern: >5 failed logins (Event 4625) from same IP in 10 minutes

Stage 2: Lateral Movement Indicators

• PsExec service creation on remote hosts (Event 7045, service name PSEXESVC)
• SMB ADMIN$ share access from non-admin workstations (Event 5140)
• WMI process execution on remote systems (wmic process call create)
• Unusual Kerberos ticket requests (Golden Ticket / Silver Ticket indicators)

Stage 3: Data Staging / Exfil Indicators

• Large compressed archives created on file servers (7z, RAR with password protection)
• Cloud sync tools (rclone, MEGAsync, FileZilla) running on servers
• Outbound connections to non-corporate cloud storage IPs on ports 443/8080
• Database dumps or file server access spikes outside business hours

Stage 4: Pre-Encryption Indicators

• Volume Shadow Copy deletion (vssadmin delete shadows)
• Backup service tampering (Veeam, Commvault service stopped or disabled)
• Antivirus/EDR uninstall attempts or service termination
• Suspicious scheduled tasks created for persistence

Critical Assets N0N Historically Prioritizes for Exfiltration

Based on leak-site samples and negotiation transcripts in public reporting:

1. Customer databases (PCI-DSS cardholder data, PII, loyalty program records) — Retail
2. Protected Health Information (PHI) — Healthcare claims, patient records, insurance data
3. Financial records — Invoices, payment processor credentials, tax documents
4. Intellectual property — Source code repositories, product designs, R&D documents
5. Email archives — Executive communications, legal correspondence, contracts
6. Backup files — N0N actively seeks and encrypts/deletes backups to force payment

Containment Actions — Ordered by Urgency

Immediate (0–15 minutes):

1. Isolate affected hosts from network (disable switch port, EDR network isolation, or physically unplug)
2. Disable compromised user accounts (force password reset, revoke sessions, disable in AD)
3. Block C2 IPs/domains at firewall and DNS sinkhole (if known — check threat intel feeds)

Short-term (15 min – 2 hours): 4. Snapshot virtual machines for forensic preservation (before any remediation) 5. Isolate backup infrastructure from production network (prevent N0N from encrypting backups) 6. Enable enhanced logging on domain controllers, file servers, and VPN concentrators 7. Deploy emergency patches for CVE-2026-50751, CVE-2026-20316, CVE-2026-59310 if not already applied

Medium-term (2–24 hours): 8. Force password reset for all privileged accounts (Domain Admins, local admins, service accounts) 9. Review and restrict RDP access — disable if not business-critical, or require VPN + MFA 10. Hunt for persistence mechanisms — scheduled tasks, new services, registry run keys 11. Engage external IR firm if internal capacity is limited — ransomware incidents escalate quickly

Hardening Recommendations

Immediate (24 Hours)

These controls would have disrupted N0N's known TTPs in recent campaigns:

1. Patch VPN/Firewall CVEs:

   • Check Point Security Gateway — CVE-2026-50751 (improper auth in IKEv1)
   • Cisco Secure FMC — CVE-2026-20316 (hard-coded password)
   • VMware vCenter — CVE-2026-59310 (path traversal)
   • JetBrains TeamCity — CVE-2026-63077 (deserialization)
   • Action: Verify patch status via vulnerability scanner; if unpatched, isolate from internet until patched.

2. Disable or Restrict RDP:

   • If RDP is not required, disable it entirely (GPO or registry)
   • If required, restrict to VPN-only access, enforce Network Level Authentication (NLA), and enable MFA via RD Gateway
   • Action: Run the PowerShell script above to check exposure

3. Enable LAPS for Local Admin Passwords:

   • N0N uses pass-the-hash and credential dumping; unique local admin passwords per host limit lateral movement
   • Action: Deploy Microsoft LAPS or third-party equivalent

4. Block Office Macros from Internet:

   • Phishing with macro-enabled Office docs is a known N0N initial access vector
   • Action: Set GPO to block macros in files from internet zone (Mark of the Web)

5. Enable Attack Surface Reduction (ASR) Rules:

   • Block Office from creating child processes
   • Block execution of potentially obfuscated scripts
   • Block credential stealing from LSASS
   • Action: Deploy via Intune, SCCM, or GPO in audit mode first, then enforce

Short-Term (2 Weeks)

Architecture-level changes to reduce ransomware impact:

1. Implement Zero-Trust Network Segmentation:

   • Segment user workstations from servers, and servers from backup infrastructure
   • Use firewall rules to block SMB/RDP between VLANs except from designated jump boxes
   • Action: Map critical assets, create microsegments, deny-by-default

2. Deploy EDR with Automated Response:

   • Modern EDR can detect and kill ransomware processes before encryption completes
   • Action: Evaluate CrowdStrike, Microsoft Defender for Endpoint, SentinelOne, or similar; enable automatic isolation on high-confidence detections

3. Immutable Backups (Air-Gapped or Object-Locked):

   • N0N actively targets and deletes backups; immutable storage prevents tampering
   • Action: Migrate to backup solution with object-lock (AWS S3 Object Lock, Azure Immutable Blob, Veeam hardened repository)

4. Enable Advanced Audit Logging:

   • Enable PowerShell Script Block Logging, WMI activity logging, and Sysmon (SwiftOnSecurity config)
   • Forward logs to SIEM with 90-day retention minimum
   • Action: Deploy Sysmon via GPO, configure Windows Event Forwarding or agent-based SIEM collection

5. Conduct Tabletop Exercise:

   • Simulate N0N-style ransomware scenario with IT, security, legal, PR, and executive teams
   • Test decision-making on ransom payment, disclosure obligations, and business continuity
   • Action: Use this briefing as scenario input; document gaps and update IR plan

Conclusion

N0N's latest campaign — 15 claims in 72 hours across retail, healthcare, and technology sectors — demonstrates the group's continued operational tempo and preference for mid-market targets with valuable data and limited security maturity. While none of the leak-site postings are confirmed breaches, the claimed sector and geographic focus should drive immediate defensive action for organizations in those verticals.

Key takeaways for defenders:

• Patch VPN/firewall CVEs (Check Point, Cisco FMC, VMware vCenter) today
• Hunt for lateral movement and data staging using the Sigma/KQL provided above
• Test backup restoration procedures — N0N targets backups first
• If you operate in retail or healthcare and have not reviewed ransomware playbooks in 2026, do so this week

Security Arsenal will continue monitoring N0N's leak site and publish updates as corroboration status changes or new victims are claimed.

Related Resources

Security Arsenal Incident Response

Managed SOC & MDR Services

AlertMonitor Threat Detection

From The Dark Side Intel Hub