Classification: TLP:CLEAR | Publication Date: 2026-10-26 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 15 New Leak-Site Postings in 4 Days — Sector Targeting Analysis, Detection Rules & IR Playbook

Executive Summary

Between 2026-10-23 and 2026-10-25, the ransomware operation tracked as N0N published 15 new victim listings on its dark web leak site — a compressed posting cadence that suggests either a burst of successful intrusions detonating in the same window or a deliberate batch-release strategy designed to maximize pressure and media pickup. The claimed victims span Energy & Utilities, Technology, Manufacturing, Professional Services, and Healthcare across eight countries (BG, US, PT, AR, ES, ET, TN, CH).

Critical caveat up front: every entry in this briefing is a claim made by a criminal group on its own leak site. Twelve of the fifteen listings were independently observed by a second leak-site crawler (confirming the gang made the claim); three appear on a single source only. No tier of this data confirms a breach occurred. Organizations in the affected sectors — particularly US manufacturing, US healthcare, and European energy — should treat this as a hunt trigger, not a casualty report.

Key observations:

• Posting velocity: 15 listings in ~96 hours, with a clear escalation curve (3 on 10-23, 5 on 10-24, 6 on 10-25 plus additional listings).
• Sector skew: Manufacturing (6) and Professional Services (2) dominate, with Healthcare (2) and Energy & Utilities (2) adding critical-infrastructure flavor. N0N appears to be pursuing mid-market organizations where ransom pressure converts quickly.
• Geographic spread is opportunistic, not focused: US, Bulgaria, Portugal, Argentina, Spain, Ethiopia, Tunisia, Switzerland — consistent with a group exploiting whatever edge-device or credential access it can acquire rather than running a geo-targeted campaign.
• Healthcare exposure is notable: Asisken Asistencia Médica S.A. (AR) and Arthritis Center of Riverside (US) are listed. If the claims are accurate, both carry regulatory disclosure implications (HIPAA for the US entity).

Sourcing & Verification

This briefing is built from leak-site monitoring data and requires explicit framing before any organization acts on it:

• Corroboration status: Of the 15 listings analyzed, 12 were independently observed by a second leak-site crawler (tagged MULTI-SOURCE), meaning two independent collectors confirmed the gang published the claim. 3 listings — Horn of Africa Regional Environment Centre and Network (ET), PROTEX Confection (TN), and SunTechnics Fabrisolar AG (CH) — appear on a single source only and have not been second-crawler confirmed.
• What corroboration does NOT mean: Multi-source confirmation establishes that the threat actor made the claim. It does not confirm a breach, data theft, or encryption event occurred. No tier of this data supports that conclusion.
• A named organization may dispute the listing, and a denial is likewise not proof the claim is false. Disclosure obligations vary by jurisdiction and sector, and not every incident is legally reportable — neither silence nor denial settles the question. Only the organization itself, or its regulator, can confirm or refute what happened inside its network.
• Corrections: Security Arsenal will publish corrections to this briefing as facts change. We welcome contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

Note: Attribution details below reflect Security Arsenal's current assessment from underground monitoring. Some elements are assessed with moderate confidence and will be updated as telemetry matures.

Aliases / branding: N0N (stylized with a zero). No widely adopted industry aliases at this time; the operation maintains its own dedicated leak site (DLS) on Tor.

Operating model: Assessed as a closed/semi-closed operation with a small affiliate ring rather than an open RaaS program. We have not observed public affiliate recruitment posts tied to N0N branding on the major Russian-language forums we monitor, which is consistent with a tight crew or invitation-only affiliate model. The batch posting pattern in this window supports the closed-crew hypothesis — open RaaS programs tend to produce staggered postings as independent affiliates execute.

Ransom economics: Demands observed in N0N-linked negotiations (per underground chatter and prior leak-site patterns) fall in the low-to-mid six-figure USD range — consistent with the mid-market victim profile seen here. Nothing in the current campaign suggests seven-figure demands typical of big-game hunters like LockBit or Akira at their peak.

Initial access methods (assessed, in rough priority order):

1. Edge-device exploitation — VPN concentrators, firewalls, and remote access gateways with known CVEs. This is the dominant pattern among mid-tier crews in 2026 and matches the opportunistic geographic spread.
2. Credential-based access — purchased or phished VPN/RDP credentials, often via infostealer logs resold on underground markets.
3. Phishing with macro/loader payloads — secondary vector; occasionally used against professional services targets.
4. Exposed RDP brute force — still observed against manufacturing targets with legacy OT-adjacent Windows estates.

Extortion model: Double extortion — data theft followed by encryption, with leak-site publication as the pressure mechanism. The 15-listing batch is the extortion phase becoming visible; intrusions almost certainly began weeks earlier.

Dwell time: Assessed at 7–21 days from initial access to detonation based on sector norms for crews of this profile, with data staging typically occurring in the final 48–96 hours. The compressed posting cadence suggests multiple intrusions were run in parallel and staged toward a common release window.

Current Campaign Analysis

Claimed victim list (2026-10-23 → 2026-10-25)

Reminder: these are claims by the N0N group. None of the above is confirmed to have suffered a breach.

Sector targeting

Manufacturing is the anchor sector (6 of 15, plus at least one "Not Found" entry that may resolve to industrial). This is characteristic of crews exploiting legacy Windows environments, weak network segmentation between IT and OT-adjacent systems, and organizations with low tolerance for downtime — a combination that converts to payment pressure efficiently. The healthcare listings (Asisken Asistencia Médica S.A., Arthritis Center of Riverside) raise the stakes: if accurate, both involve regulated personal/medical data and likely mandatory disclosure regimes. The energy listings (TOPLIVO AD, SunTechnics Fabrisolar AG) follow the well-worn pattern of targeting utilities suppliers and renewables firms whose operational continuity is safety-relevant.

Geographic concentration

There is none — and that is itself the signal. Eight countries across four continents in one batch indicates access-driven opportunism: the gang (or its access broker) is working through a list of exploitable edge devices and purchased credentials wherever they surface, not running a country-focused operation. The US remains the single largest represented country (5 of 15 with known geography), consistent with ransom-payment propensity.

Victim profile

The named organizations skew small-to-mid-market: regional law practices (Mach Law APC), specialty distributors (Keidel Supply Company Incorporated), boutique advisory firms (Andrews Advisory Group LLC), single-facility medical practices (Arthritis Center of Riverside), and mid-sized manufacturers. Estimated revenue range for this cohort: roughly $5M–$150M. This is the classic mid-tier crew sweet spot — organizations large enough to pay $100K–$500K, too small to have 24/7 SOC coverage or mature backup isolation.

Posting frequency / escalation pattern

3 listings on 10-23 → 5 on 10-24 → 6+ on 10-25. Accelerating daily cadence is a deliberate pressure tactic: it builds perceived momentum, complicates victims' quiet negotiation windows (their names appear alongside others in news coverage), and signals capability to future victims. Watch for a data-sample release phase in the coming days — crews at this stage typically begin publishing file-tree screenshots or small data dumps against non-responsive listings.

Initial access hypothesis — CVE exposure

We have no evidence linking any specific named organization above to any specific CVE. The following is a sector-level exposure hypothesis based on N0N's assessed edge-device-first tradecraft and the current CISA KEV entries with confirmed ransomware use:

• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1): If N0N is running edge-device exploitation at the scale this campaign suggests, improperly authenticated IKEv1 on Check Point gateways is a plausible entry hypothesis for the geographically dispersed, mid-market victims. Any org with Check Point gateways should treat KEV status as an emergency patch trigger.
• CVE-2026-20316 — Cisco Secure FMC hard-coded password: Management-plane compromise of the firewall itself hands an actor policy visibility and lateral paths. Plausible for professional-services and healthcare victims that lean on Cisco perimeter stacks.
• CVE-2026-59310 — VMware vCenter path traversal: Post-exploitation escalator rather than initial access — a path from network access into the virtualization layer, enabling mass encryption of hosted VMs. Highly relevant to manufacturing/tech victims running consolidated vSphere estates.
• CVE-2026-63077 — JetBrains TeamCity deserialization: Relevant where the victim is a technology firm with exposed CI/CD infrastructure (see Adirondack Networks, Inc. and Technoleads Services Inc. listings — hypothesis only). TeamCity compromise also enables supply-chain-flavored payloads into build artifacts.
• CVE-2026-48027 — Nx Console embedded malicious code: A supply-chain vector into developer workstations — relevant only to the technology-sector hypothesis.

Actionable framing: don't ask "did N0N use CVE-2026-50751?" — ask "am I exposed to CVE-2026-50751 right now?" The KEV entries above are confirmed ransomware-used regardless of which crew is exploiting them.

Detection Engineering

The following detections target the assessed N0N playbook: edge-device/VPN initial access, credential use, living-off-the-land lateral movement, and pre-encryption staging/exfiltration. Tune thresholds to your environment.

---
title: N0N Ransomware - Suspicious VPN/Edge Device Authentication Anomalies
description: Detects authentication patterns consistent with edge-device exploitation and credential-based VPN access used by mid-tier ransomware crews (N0N-assessed initial access TTPs)
status: experimental
date: 2026/10/26
author: Security Arsenal Threat Intelligence
logsource:
    category: authentication
    product: vpn
detection:
    selection_geo:
        auth_result: 'success'
        source_country|contains:
            - 'TOR_EXIT'
            - 'UNKNOWN'
    selection_burst:
        auth_result: 'failure'
    condition: selection_geo or (selection_burst and threshold)
threshold:
    count: 10
    timeframe: 5m
fields:
    - source_ip
    - user_account
    - source_country
    - auth_method
falsepositives:
    - Legitimate remote workers traveling
    - VPN gateway misconfiguration
level: high
tags:
    - attack.initial_access
    - attack.t1133
    - attack.t1078
---
title: N0N Ransomware - PsExec and WMI Lateral Movement Chain
description: Detects service creation via PsExec-style named pipes and WMI remote process execution consistent with N0N-assessed lateral movement tooling
date: 2026/10/26
status: experimental
author: Security Arsenal Threat Intelligence
logsource:
    product: windows
    category: process_creation
detection:
    selection_psexec:
        EventID: 7045
        ServiceFileName|contains:
            - '\\ADMIN$\\'
            - 'PSEXESVC'
    selection_wmi:
        Image|endswith: '\\wmiprvse.exe'
        CommandLine|contains:
            - 'cmd.exe'
            - 'powershell.exe'
            - 'rundll32.exe'
    selection_pipe:
        PipeName|contains:
            - '\\PSEXESVC'
            - '\\paexec'
            - '\\remcom'
    condition: 1 of selection_*
falsepositives:
    - Legitimate administrative tooling (SCCM, PDQ)
    - IT remote management software
level: high
tags:
    - attack.lateral_movement
    - attack.t1021.002
    - attack.t1047
    - attack.t1569.002
---
title: N0N Ransomware - Pre-Encryption Staging and Shadow Copy Destruction
description: Detects data staging to compressed archives via LOLBins plus Volume Shadow Copy deletion and backup tampering observed in the final hours before ransomware detonation
date: 2026/10/26
status: experimental
author: Security Arsenal Threat Intelligence
logsource:
    product: windows
    category: process_creation
detection:
    selection_vss:
        CommandLine|contains:
            - 'vssadmin delete shadows'
            - 'vssadmin Delete Shadows'
            - 'wmic shadowcopy delete'
            - 'bcdedit'
    selection_vss_boot:
        CommandLine|contains:
            - 'recoveryenabled no'
            - 'ignoreallfailures'
    selection_staging:
        Image|endswith:
            - '\\rclone.exe'
            - '\\7z.exe'
            - '\\winrar.exe'
            - '\\rar.exe'
        CommandLine|contains:
            - 'copy'
            - 'sync'
            - ' a '
            - '.zip'
            - '.7z'
    condition: selection_vss or (selection_vss and selection_vss_boot) or selection_staging
falsepositives:
    - Legitimate backup maintenance windows
    - Admin archival tasks
level: critical
tags:
    - attack.impact
    - attack.t1490
    - attack.t1560.001
    - attack.exfiltration
    - attack.t1048

The following Microsoft Sentinel KQL query hunts for the lateral-movement-plus-staging sequence — an admin workstation spawning remote execution tooling followed by archive creation and anomalous outbound transfer, within a 24-hour window.

// N0N-assessed hunt: lateral movement -> staging -> exfil chain within 24h
// Look for the sequence: remote exec tooling -> archive creation -> bulk outbound
let Lookback = 7d;
let ChainWindow = 24h;
let RemoteExec =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where ProcessCommandLine has_any ("psexec", "paexec", "wmic /node", "Invoke-WMIMethod", "winrs -r")
       or (FileName =~ "wmiprvse.exe" and InitiatingProcessFileName !in~ ("svchost.exe", "WmiPrvSE.exe"))
    | project ExecTime=TimeGenerated, DeviceName, AccountName=InitiatingProcessAccountName, ExecCmd=ProcessCommandLine;
let Staging =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName in~ ("rclone.exe","7z.exe","rar.exe","winrar.exe","megacmd.exe","filezilla.exe")
       or ProcessCommandLine has_any ("vssadmin delete shadows","shadowcopy delete","recoveryenabled no")
    | project StageTime=TimeGenerated, DeviceName, StageCmd=ProcessCommandLine, StageAccount=InitiatingProcessAccountName;
let BulkOutbound =
    DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where RemotePort in (443, 22, 21, 990)
    | where RemoteIPType == "Public"
    | summarize BytesSent=sum(tolong(SentBytes)), Destinations=dcount(RemoteIP) by DeviceName, bin(TimeGenerated, 1h)
    | where BytesSent > 500000000  // >500MB/hour to public IPs — tune per baseline
    | project NetTime=TimeGenerated, DeviceName, BytesSent, Destinations;
RemoteExec
| join kind=inner Staging on DeviceName
| where StageTime between (ExecTime .. (ExecTime + ChainWindow))
| join kind=inner BulkOutbound on DeviceName
| where NetTime between (StageTime .. (StageTime + ChainWindow))
| project DeviceName, AccountName, ExecTime, ExecCmd, StageTime, StageCmd, NetTime, BytesSent, Destinations
| sort by ExecTime desc

The following PowerShell rapid-response script checks a host (or list of hosts) for the highest-signal pre-detonation indicators: exposed RDP configuration, scheduled tasks created in the last 7 days, shadow copy status, and recently created suspicious services.

<#
.SYNOPSIS
    Security Arsenal — N0N Rapid Triage Script
.DESCRIPTION
    Checks for exposed RDP, recent scheduled tasks, shadow copy integrity,
    and suspicious services created in the last 7 days. Run via PS remoting
    or your EDR's live-response shell. TLP:CLEAR.
.EXAMPLE
    Invoke-N0NRapidTriage -ComputerName "WS-0142","FS-CORP-01"
#>
function Invoke-N0NRapidTriage {
    param(
        [string[]]$ComputerName = $env:COMPUTERNAME,
        [int]$DaysBack = 7
    )
    $cutoff = (Get-Date).AddDays(-$DaysBack)
    $report = [ordered]@{}

    foreach ($c in $ComputerName) {
        Write-Host "[*] Triaging $c ..." -ForegroundColor Cyan
        $findings = Invoke-Command -ComputerName $c -ScriptBlock {
            param($cutoff)
            $out = [ordered]@{}

            # 1. RDP exposure check
            $rdpEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
            $nla = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -ErrorAction SilentlyContinue).UserAuthentication
            $out.RDPExposed = $rdpEnabled
            $out.RDPNetworkLevelAuth = ($nla -eq 1)

            # 2. Scheduled tasks created/modified recently (exclude Microsoft noise)
            $out.RecentTasks = Get-ScheduledTask | Where-Object {
                $_.Date -gt $cutoff -and $_.TaskPath -notlike '\Microsoft\*'
            } | Select-Object TaskName, TaskPath, Date, @{n='Action';e={($_.Actions.Execute + ' ' + $_.Actions.Arguments)}} | Format-List | Out-String

            # 3. Volume Shadow Copy status
            $out.ShadowCopies = (Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue | Measure-Object).Count
            $out.VSSServiceState = (Get-Service VSS -ErrorAction SilentlyContinue).Status.ToString()
            $out.BcdRecoveryDisabled = (bcdedit /enum {current} 2>$null | Select-String 'recoveryenabled\s+No') -ne $null

            # 4. Services with binaries in suspicious paths created recently
            $out.SuspiciousServices = Get-CimInstance Win32_Service | Where-Object {
                $_.PathName -match 'Temp|AppData|ProgramData|Users\\Public' -and
                (Get-Item ($_.PathName -replace '^"([^"]+)".*','$1' -replace '^([^ ]+\.exe).*','$1') -ErrorAction SilentlyContinue).CreationTime -gt $cutoff
            } | Select-Object Name, PathName, State | Format-List | Out-String

            # 5. Recent high-frequency failed logons (brute-force signature)
            $out.FailedLogons7d = (Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=$cutoff} -ErrorAction SilentlyContinue | Measure-Object).Count

            return $out
        } -ArgumentList $cutoff -ErrorAction SilentlyContinue

        $report[$c] = $findings
        $findings.GetEnumerator() | ForEach-Object {
            $color = if ($_.Key -in @('RDPExposed','BcdRecoveryDisabled') -and $_.Value -eq $true) {'Red'}
                     elseif ($_.Key -eq 'ShadowCopies' -and $_.Value -eq 0) {'Red'}
                     elseif ($_.Key -eq 'FailedLogons7d' -and $_.Value -gt 500) {'Yellow'}
                     else {'Gray'}
            Write-Host ("    {0}: {1}" -f $_.Key, ($_.Value -replace "`n"," | ")) -ForegroundColor $color
        }
    }
    $report | ConvertTo-Json -Depth 4 | Out-File ".\N0N-Triage-$(Get-Date -Format 'yyyyMMdd-HHmm').json"
    Write-Host "[+] Report saved." -ForegroundColor Green
}

Incident Response Priorities

N0N's assessed playbook is a standard double-extortion sequence: quiet access → credential harvesting → lateral spread → staging/exfil → encryption + leak listing. If you are in a targeted sector, the following assumes you are hunting before detonation, because after the leak-site listing the encryption phase has usually already completed or failed.

T-minus detection checklist (before encryption fires)

• New or unexpected VPN/RDP authentications from unusual geographies or at unusual hours, especially service/admin accounts (T1133, T1078)
• Impossible-travel or first-time-country logons against edge devices — correlate with infostealer-credential exposure of your domains
• PsExec-style service installs (Event 7045 with PSEXESVC, ADMIN$ paths) on servers that never see legitimate remote admin tooling
• Archive utility execution on servers — 7z/rar/rclone on file servers, domain controllers, or backup infrastructure is a five-alarm staging indicator (T1560)
• Outbound transfer anomalies — sustained >100MB/hr to cloud storage (MEGA, Dropbox, anonymous VPS) from server VLANs
• VSS deletion attempts, bcdedit tampering, backup-agent service stops — the 60-minute warning (T1490)
• EDR/AV tamper events — attempted uninstalls, exclusion additions, or safe-mode boot preparations
• Mass file renames/reads beginning on file shares — encryption has started; shift to containment immediately

Critical assets this profile of gang prioritizes for exfiltration

Based on mid-tier double-extortion norms and the sector mix here:

1. File servers / NAS shares — the bulk exfil target; contracts, financials, HR records
2. Email (executive mailboxes, legal/finance distribution archives) — for professional-services victims like the listed law and advisory firms, privileged client communications are the leverage
3. EHR/practice-management databases — for healthcare listings, PHI is the extortion payload (Arthritis Center of Riverside, Asisken Asistencia Médica S.A. — if the claims are accurate)
4. ERP/accounting exports and payroll data — W-2/SSN-equivalents pressure executives personally
5. Backup catalogs — not for exfil, but for targeted destruction to kill recovery options

Containment actions — ordered by urgency

1. Isolate, don't power off — network-quarantine suspected hosts via EDR/NAC while preserving memory for forensics
2. Kill the egress path — block outbound to identified exfil destinations at the proxy/firewall; suspend the compromised edge device or VPN profile
3. Force enterprise-wide credential reset — privileged accounts first, then all accounts that authenticated from the suspected access vector; revoke sessions/tokens
4. Disable the attacker's persistence — remove rogue scheduled tasks, services, and any newly created admin accounts; audit GPO changes
5. Protect the backups — take backup infrastructure offline from the production network; verify immutability/air-gap before reconnecting anything
6. Segment blast radius — temporarily deny server-to-server SMB/RDP where feasible; manufacturing sites: hard-isolate OT-adjacent segments
7. Preserve evidence — firewall/VPN logs, EDR telemetry, memory captures of patient zero before any rebuild
8. Engage IR counsel and evaluate disclosure obligations early — especially for healthcare (HIPAA 60-day clock starts at discovery, not confirmation of actor claims) and any EU-resident data (GDPR 72-hour regulator notification)

Hardening Recommendations

Immediate (24 hours)

• Patch or mitigate every KEV entry listed above on exposed infrastructure: CVE-2026-50751 (Check Point IKEv1), CVE-2026-20316 (Cisco FMC), CVE-2026-59310 (vCenter), CVE-2026-63077 (TeamCity), CVE-2026-48027 (Nx Console). These are confirmed ransomware-used — treat as emergency change, not next-window work.
• Enforce phishing-resistant MFA on all remote access — VPN, RDP gateways, VDI portals. Credential replay is the cheapest access vector for crews like N0N.
• Disable IKEv1 aggressive mode on Check Point and equivalent legacy VPN configurations where IKEv2 is available.
• Block PsExec-class lateral tooling you don't use — AppLocker/WDAC rules against psexec, paexec, remcom; alert on any 7045 service install referencing ADMIN$.
• Alert on vssadmin delete shadows, bcdedit, and wbadmin delete — these have near-zero legitimate use on end-user and server estates outside change windows.
• Restrict outbound from server VLANs — deny direct internet egress from file servers and DCs except through inspected proxies; alert on cloud-storage destinations (MEGA, rclone remotes) you don't sanction.
• Check infostealer exposure — query your domains against stealer-log intelligence feeds; force-reset any credentials found.
• Verify backups are actually restorable and offline copies exist — today, not this quarter. Test one restore.

Short-term (2 weeks)

• Segment the network by trust zone — separate user, server, backup, and (for manufacturers) OT-adjacent segments with default-deny east-west rules. N0N-class crews die at segmentation boundaries.
• Deploy decoy credentials and canary file shares — cheap, high-fidelity tripwires for the enumeration phase that precedes staging.
• Implement tiered administration with PAWs — eliminate domain-admin logons to general-purpose servers; this is the single highest-leverage lateral-movement killer.
• Move backup infrastructure to an isolated management plane with immutable storage and separate credentials — assume production AD is compromisable and design recovery accordingly.
• Baseline outbound data volumes per host so the KQL hunt above runs against real baselines rather than static thresholds.
• For healthcare and professional-services orgs: pre-stage a regulatory notification playbook (HIPAA, GDPR, state breach statutes) with counsel — the 72-hour/60-day clocks are unforgiving and start at discovery of the incident, not at leak-site publication.
• Tabletop the leak-site scenario — rehearse decision-making for "a criminal claims our data and posts samples" before it happens, including comms, legal, and cyber-insurance notification paths.

This briefing reflects unverified claims made by a criminal threat actor. Security Arsenal publishes corrections as facts develop. Named organizations may contact us at security@securityarsenal.com.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub