N0N Ransomware Gang: 15 New Victims Claimed on Dark Web — Sector Analysis, Detection Rules & Response Playbook

---
title: N0N Ransomware - PsExec Service Installation for Lateral Movement
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: production
description: Detects PsExec-style service creation events associated with N0N ransomware lateral movement. Monitors for service installation events with PsExec default naming conventions, ADMIN$ share writes, and remote service execution patterns observed in N0N campaigns.
author: Security Arsenal Threat Intelligence
references:
  - https://attack.mitre.org/techniques/T1021/002/
  - https://attack.mitre.org/techniques/T1569/002/
date: 2026/10/26
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002
  - attack.execution
logsource:
  category: service_creation
  product: windows
  service: system
detection:
  selection_psexec_name:
    ServiceName|contains:
      - 'PSEXESVC'
      - 'PsExec'
  selection_psexec_binary:
    ImagePath|contains:
      - '\\ADMIN$\\'
      - '\\IPC$\\'
      - '\PSEXESVC.exe'
  selection_suspicious_svc:
    ImagePath|contains:
      - 'cmd.exe /c'
      - 'powershell.exe -enc'
      - 'powershell.exe -e '
      - '\\Users\\Public\\'
      - '\\Windows\\Temp\\'
      - '\\ProgramData\\'
  selection_suspicious_svc_name:
    ServiceName|contains:
      - 'update'
      - 'svc'
      - 'win'
      - 'sys'
  condition: selection_psexec_name or selection_psexec_binary or (selection_suspicious_svc and selection_suspicious_svc_name)
falsepositives:
  - Legitimate administrative use of PsExec by IT teams
  - SCCM or other management tools that install remote services
  - Vulnerability scanners using PsExec-style deployment
level: high
---
title: N0N Ransomware - Volume Shadow Copy Deletion via Multiple Methods
id: b2c3d4e5-f6a7-8901-bcde-f12345678901
status: production
description: Detects deletion or manipulation of Volume Shadow Copies using vssadmin, wmic, diskshadow, or PowerShell — a hallmark pre-encryption action by N0N and virtually all ransomware operations to inhibit recovery. Correlates multiple deletion methods and flags execution within suspicious parent process contexts.
author: Security Arsenal Threat Intelligence
references:
  - https://attack.mitre.org/techniques/T1490/
  - https://attack.mitre.org/techniques/T1059/001/
date: 2026/10/26
tags:
  - attack.impact
  - attack.t1490
  - attack.defense_evasion
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'Delete Shadows'
      - 'resize shadowstorage'
  selection_wmic:
    Image|endswith: '\wmic.exe'
    CommandLine|contains:
      - 'shadowcopy'
      - 'ShadowCopy'
  selection_diskshadow:
    Image|endswith: '\diskshadow.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'Delete Shadows'
  selection_powershell_vss:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'Get-WmiObject Win32_Shadowcopy'
      - 'Get-CimInstance Win32_ShadowCopy'
      - 'Remove-WmiObject'
      - 'Remove-CimInstance'
      - 'Delete()'
  selection_bcdedit:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled'
      - 'bootstatuspolicy'
      - 'ignoreallfailures'
  filter_known_admin:
    ParentImage|endswith:
      - '\Veeam.Backup.Service.exe'
      - '\BackupExec.exe'
      - '\wbadmin.exe'
  condition: 1 of selection_* and not filter_known_admin
falsepositives:
  - Backup software performing shadow copy lifecycle management
  - IT administrators manually clearing shadow copies for disk space
  - System maintenance scripts using bcdedit for boot configuration
level: critical
---
title: N0N Ransomware - Data Staging and Exfiltration via Archive Tools and Cloud Sync
id: c3d4e5f6-a7b8-9012-cdef-123456789012
status: production
description: Detects data staging behavior consistent with N0N ransomware pre-exfiltration activity. Identifies bulk file archiving with 7-Zip, WinRAR, or tar in non-standard directories, execution of cloud sync tools (rclone, MEGAcmd) from unusual paths, and high-volume file copy operations to staging directories before encryption.
author: Security Arsenal Threat Intelligence
references:
  - https://attack.mitre.org/techniques/T1560/001/
  - https://attack.mitre.org/techniques/T1567/002/
  - https://attack.mitre.org/techniques/T1074/001/
date: 2026/10/26
tags:
  - attack.collection
  - attack.t1560.001
  - attack.t1074.001
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_archive_tools:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\7zg.exe'
      - '\rar.exe'
      - '\winrar.exe'
  selection_archive_args:
    CommandLine|contains:
      - ' a '
      - ' -r'
      - ' -mx'
      - ' -p'
      - '*.7z'
      - '*.rar'
      - '*.zip'
  selection_staging_dirs:
    CommandLine|contains:
      - '\\Users\\Public\\'
      - '\\Windows\\Temp\\'
      - '\\ProgramData\\'
      - 'C:\\Temp\\'
      - 'C:\\staging'
      - 'C:\\backup'
      - 'C:\\exfil'
  selection_cloud_sync:
    Image|endswith:
      - '\rclone.exe'
      - '\megacmd.exe'
      - '\MEGAcmd.exe'
      - '\rclone-v*.exe'
  selection_cloud_args:
    CommandLine|contains:
      - 'copy'
      - 'sync'
      - 'move'
      - '--config'
      - 'mega.nz'
      - 'drive.google.com'
      - 'dropbox.com'
  condition: (selection_archive_tools and selection_archive_args and selection_staging_dirs) or (selection_cloud_sync and selection_cloud_args)
falsepositives:
  - Legitimate backup operations using 7-Zip or WinRAR
  - IT administrators staging files for deployment
  - Legitimate use of rclone for cloud backup by power users
level: high

// N0N Ransomware - Pre-Encryption Staging & Lateral Movement Composite Hunt
// Lookback: 7 days | Author: Security Arsenal TI | 2026-10-26
// MITRE: T1021.002, T1490, T1560.001, T1567.002, T1074.001

let Lookback = 7d;

// Signal 1: Suspicious service installations (PsExec-style)
let SuspiciousServices =
    SecurityEvent
    | where TimeGenerated >= ago(Lookback)
    | where EventID == 7045
    | where ServiceName has_any ("PSEXESVC", "PsExec", "update", "svc", "winsvc", "syssvc")
       or ServiceFileName has_any ("ADMIN$", "IPC$", "PSEXESVC", "\\Users\\Public\\", "\\Windows\\Temp\\", "\\ProgramData\\")
    | project ServiceAlert_Time=TimeGenerated, Computer, ServiceName, ServiceFileName, ServiceAccount=Account, ServiceAlert_SourceIP=IpAddress
    | extend SignalType = "SuspiciousServiceInstall";

// Signal 2: Shadow copy deletion attempts
let ShadowCopyDeletion =
    SecurityEvent
    | where TimeGenerated >= ago(Lookback)
    | where EventID == 4688
    | where (Process has "vssadmin" and CommandLine has "delete shadows")
       or (Process has "wmic" and CommandLine has "shadowcopy")
       or (Process has "diskshadow" and CommandLine has "delete")
       or (Process has "bcdedit" and CommandLine has_any ("recoveryenabled", "ignoreallfailures"))
    | project ShadowAlert_Time=TimeGenerated, Computer, ShadowCmd=CommandLine, ShadowParent=ParentProcessName, ShadowAccount=Account
    | extend SignalType = "ShadowCopyDeletion";

// Signal 3: Archive/staging tool execution from suspicious paths
let StagingActivity =
    SecurityEvent
    | where TimeGenerated >= ago(Lookback)
    | where EventID == 4688
    | where (Process has_any ("7z.exe", "7za.exe", "rar.exe", "winrar.exe")
            and CommandLine has_any ("\\Users\\Public\\", "\\Windows\\Temp\\", "\\ProgramData\\", "C:\\Temp"))
       or (Process has_any ("rclone.exe", "megacmd.exe"))
    | project StagingAlert_Time=TimeGenerated, Computer, StagingProcess=Process, StagingCmd=CommandLine, StagingAccount=Account
    | extend SignalType = "DataStaging";

// Signal 4: High outbound data transfer (potential exfiltration)
let HighOutbound =
    AzureNetworkAnalytics_CL
    | where TimeGenerated >= ago(Lookback)
    | where FlowDirection_s == "O"  // Outbound flows
    | summarize TotalBytesOut=sum(tolong(BytesSent_s)), FlowCount=count()
        by SrcIP_s, DestIP_s, DestPort_d
    | where TotalBytesOut > 1073741824  // > 1 GB outbound to a single destination
    | extend SignalType = "HighOutboundTransfer"
    | project OutboundAlert_Time=TimeGenerated, SrcIP_s, DestIP_s, DestPort_d, TotalBytesOut, FlowCount, SignalType;

// Correlate: machines with 2+ distinct signals within 24 hours
let CorrelatedMachines =
    union
        (SuspiciousServices | project Computer, SignalType, AlertTime=ServiceAlert_Time),
        (ShadowCopyDeletion | project Computer, SignalType, AlertTime=ShadowAlert_Time),
        (StagingActivity | project Computer, SignalType, AlertTime=StagingAlert_Time)
    | summarize DistinctSignals=dcount(SignalType), SignalTypes=make_set(SignalType), FirstSeen=min(AlertTime), LastSeen=max(AlertTime)
        by Computer
    | where DistinctSignals >= 2
    | extend RiskScore = case(
        DistinctSignals >= 3, "CRITICAL — Multi-signal ransomware staging detected",
        DistinctSignals == 2 and SignalTypes has "ShadowCopyDeletion", "HIGH — Shadow copy tampering with additional staging signal",
        "MEDIUM — Multiple suspicious signals detected"
    )
    | sort by DistinctSignals desc, FirstSeen asc;

CorrelatedMachines

#Requires -RunAsAdministrator
<#
.SYNOPSIS
    N0N Ransomware Rapid Triage Script
    Security Arsenal Threat Intelligence | 2026-10-26
.DESCRIPTION
    Performs rapid endpoint triage for indicators consistent with N0N ransomware
    pre-encryption staging. Checks: scheduled tasks, VSS integrity, new services,
    RDP exposure, suspicious processes, and recent archive tool artifacts.
.NOTES
    Run as Administrator. Output is written to console and a local report file.
    This script is READ-ONLY. It makes no system modifications.
#>

$ReportPath = "$env:TEMP\N0N_Triage_$(Get-Date -Format 'yyyyMMdd_HHmmss').txt"
$LookbackDays = 7
$LookbackDate = (Get-Date).AddDays(-$LookbackDays)
$Findings = @()

function Write-Finding {
    param([string]$Severity, [string]$Category, [string]$Detail)
    $entry = "[$Severity] [$Category] $Detail"
    $script:Findings += $entry
    Write-Host $entry -ForegroundColor $(switch($Severity){"CRITICAL"{"Red"}"HIGH"{"DarkYellow"}"MEDIUM"{"Yellow"}default{"Cyan"}})
}

Write-Host "============================================" -ForegroundColor Cyan
Write-Host " N0N Ransomware Rapid Triage — $(Get-Date)" -ForegroundColor Cyan
Write-Host " Hostname: $env:COMPUTERNAME" -ForegroundColor Cyan
Write-Host "============================================" -ForegroundColor Cyan

# === CHECK 1: Recently Created Scheduled Tasks (Persistence) ===
Write-Host "`n[CHECK 1] Scheduled Tasks Created in Last $LookbackDays Days" -ForegroundColor White
try {
    $recentTasks = Get-ScheduledTask | Where-Object { $_.Date -ge $LookbackDate -and $_.TaskPath -notlike "\Microsoft\*" }
    if ($recentTasks) {
        foreach ($task in $recentTasks) {
            $taskActions = ($task.Actions | ForEach-Object { "$($_.Execute) $($_.Arguments)" }) -join "; "
            Write-Finding "HIGH" "Persistence" "Task: $($task.TaskName) | Path: $($task.TaskPath) | Action: $taskActions | Created: $($task.Date)"
        }
    } else {
        Write-Host "  [OK] No non-Microsoft scheduled tasks created in the last $LookbackDays days." -ForegroundColor Green
    }
} catch {
    Write-Host "  [ERROR] Could not enumerate scheduled tasks: $_" -ForegroundColor Red
}

# === CHECK 2: Volume Shadow Copy Status ===
Write-Host "`n[CHECK 2] Volume Shadow Copy Integrity" -ForegroundColor White
try {
    $shadows = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue
    if ($shadows) {
        Write-Host "  [OK] $($shadows.Count) shadow copies exist." -ForegroundColor Green
        foreach ($shadow in $shadows) {
            Write-Host "    - ID: $($shadow.ID) | Volume: $($shadow.VolumeName) | Created: $($shadow.InstallDate)" -ForegroundColor Green
        }
    } else {
        Write-Finding "CRITICAL" "Anti-Recovery" "No Volume Shadow Copies found. This may indicate pre-encryption cleanup by ransomware operators."
    }

    # Check VSS service state
    $vssService = Get-Service -Name VSS -ErrorAction SilentlyContinue
    if ($vssService -and $vssService.Status -ne "Running") {
        Write-Finding "HIGH" "Anti-Recovery" "VSS service is $($vssService.Status) (expected: Running or Manual-triggered). Service may have been disabled."
    }

    # Check boot recovery settings (bcdedit)
    $bcdOutput = bcdedit 2>&1 | Out-String
    if ($bcdOutput -match "recoveryenabled\s+No") {
        Write-Finding "CRITICAL" "Anti-Recovery" "Boot recovery is DISABLED via bcdedit. Ransomware frequently disables recovery to prevent rollback."
    }
    if ($bcdOutput -match "ignoreallfailures\s+Yes") {
        Write-Finding "CRITICAL" "Anti-Recovery" "Boot status policy set to ignoreallfailures. This is a common ransomware anti-recovery technique."
    }
} catch {
    Write-Host "  [ERROR] Could not check shadow copies: $_" -ForegroundColor Red
}

# === CHECK 3: Recently Created Services ===
Write-Host "`n[CHECK 3] Services Created in Last $LookbackDays Days" -ForegroundColor White
try {
    $recentServices = Get-CimInstance Win32_Service | Where-Object {
        $_.InstallDate -and ([Management.ManagementDateTimeConverter]::ToDateTime($_.InstallDate)) -ge $LookbackDate
    }
    # Fallback: check via event log
    if (-not $recentServices) {
        $serviceEvents = Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=$LookbackDate} -MaxEvents 50 -ErrorAction SilentlyContinue
        if ($serviceEvents) {
            foreach ($evt in $serviceEvents) {
                $xml = [xml]$evt.ToXml()
                $svcName = ($xml.Event.EventData.Data | Where-Object {$_.Name -eq 'ServiceName'}).'#text'
                $svcPath = ($xml.Event.EventData.Data | Where-Object {$_.Name -eq 'ImagePath'}).'#text'
                Write-Finding "HIGH" "LateralMovement" "New service: $svcName | Binary: $svcPath | Time: $($evt.TimeCreated)"
            }
        } else {
            Write-Host "  [OK] No new services detected in the last $LookbackDays days." -ForegroundColor Green
        }
    } else {
        foreach ($svc in $recentServices) {
            Write-Finding "HIGH" "LateralMovement" "Service: $($svc.Name) | Path: $($svc.PathName) | State: $($svc.State)"
        }
    }
} catch {
    Write-Host "  [ERROR] Could not enumerate services: $_" -ForegroundColor Red
}

# === CHECK 4: RDP Exposure Assessment ===
Write-Host "`n[CHECK 4] RDP Exposure" -ForegroundColor White
try {
    $rdpEnabled = (Get-ItemProperty "HKLM:\System\CurrentControlSet\Control\Terminal Server" -Name fDenyTSConnections -ErrorAction SilentlyContinue).fDenyTSConnections
    if ($rdpEnabled -eq 0) {
        Write-Finding "MEDIUM" "InitialAccess" "RDP is ENABLED on this host."
        $rdpPort = (Get-ItemProperty "HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name PortNumber -ErrorAction SilentlyContinue).PortNumber
        Write-Host "    RDP Port: $rdpPort" -ForegroundColor Yellow
        if ($rdpPort -eq 3389) {
            Write-Finding "HIGH" "InitialAccess" "RDP is running on the DEFAULT port (3389). This is a primary target for brute-force attacks."
        }

        # Check NLA
        $nlaEnabled = (Get-ItemProperty "HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name UserAuthentication -ErrorAction SilentlyContinue).UserAuthentication
        if ($nlaEnabled -ne 1) {
            Write-Finding "HIGH" "InitialAccess" "Network Level Authentication (NLA) is DISABLED. RDP is exposed to pre-authentication attacks."
        }

        # Check for external RDP in firewall rules
        $rdpFirewall = Get-NetFirewallRule -DisplayGroup "Remote Desktop" -ErrorAction SilentlyContinue | Where-Object { $_.Enabled -eq "True" -and $_.Direction -eq "Inbound" }
        if ($rdpFirewall) {
            Write-Finding "MEDIUM" "InitialAccess" "$($rdpFirewall.Count) inbound RDP firewall rules are ENABLED. Verify RDP is not exposed to the internet."
        }
    } else {
        Write-Host "  [OK] RDP is disabled on this host." -ForegroundColor Green
    }
} catch {
    Write-Host "  [ERROR] Could not assess RDP configuration: $_" -ForegroundColor Red
}

# === CHECK 5: Suspicious Running Processes ===
Write-Host "`n[CHECK 5] Suspicious Running Processes" -ForegroundColor White
$suspiciousProcesses = @("vssadmin", "wmic", "diskshadow", "7z", "7za", "rar", "winrar", "rclone", "megacmd", "psexec", "psexesvc", "cobaltstrike", "beacon", "mimikatz", "procdump", "comsvcs")
try {
    $running = Get-Process | Where-Object { $proc = $_.ProcessName.ToLower(); $suspiciousProcesses | Where-Object { $proc -like "*$_*" } }
    if ($running) {
        foreach ($proc in $running) {
            Write-Finding "CRITICAL" "ActiveThreat" "Suspicious process running: $($proc.ProcessName) (PID: $($proc.Id)) | Path: $($proc.Path)"
        }
    } else {
        Write-Host "  [OK] No known ransomware-associated tools found in running processes." -ForegroundColor Green
    }
} catch {
    Write-Host "  [ERROR] Could not enumerate processes: $_" -ForegroundColor Red
}

# === CHECK 6: Recent Archive Files in Staging Directories ===
Write-Host "`n[CHECK 6] Archive Files in Common Staging Locations" -ForegroundColor White
$stagingDirs = @("C:\Users\Public", "C:\Windows\Temp", "C:\ProgramData", "C:\Temp", "C:\staging", "C:\exfil")
foreach ($dir in $stagingDirs) {
    if (Test-Path $dir) {
        $archives = Get-ChildItem -Path $dir -Recurse -Include "*.7z","*.rar","*.zip","*.tar","*.gz" -ErrorAction SilentlyContinue |
            Where-Object { $_.LastWriteTime -ge $LookbackDate -and $_.Length -gt 10MB }
        if ($archives) {
            foreach ($file in $archives) {
                Write-Finding "HIGH" "DataStaging" "Archive found: $($file.FullName) | Size: $([math]::Round($file.Length/1MB,2)) MB | Modified: $($file.LastWriteTime)"
            }
        }
    }
}
if (-not ($Findings | Where-Object { $_ -match "DataStaging" })) {
    Write-Host "  [OK] No large recently-modified archives found in staging directories." -ForegroundColor Green
}

# === CHECK 7: Recent Failed Logons (Brute Force Indicator) ===
Write-Host "`n[CHECK 7] Failed Logon Events (Last 24 Hours)" -ForegroundColor White
try {
    $failedLogons = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)} -MaxEvents 100 -ErrorAction SilentlyContinue
    if ($failedLogons) {
        $groupedFailures = $failedLogons | Group-Object { $_.Properties[19].Value } | Sort-Object Count -Descending
        foreach ($group in $groupedFailures) {
            if ($group.Count -gt 10) {
                Write-Finding "HIGH" "InitialAccess" "Account '$($group.Name)': $($group.Count) failed logon attempts in 24h — possible brute force."
            }
        }
        if ($failedLogons.Count -gt 50) {
            Write-Finding "HIGH" "InitialAccess" "Total: $($failedLogons.Count) failed logon events in 24h. Elevated failure volume detected."
        }
    } else {
        Write-Host "  [OK] No significant failed logon volume detected." -ForegroundColor Green
    }
} catch {
    Write-Host "  [ERROR] Could not query security log: $_" -ForegroundColor Red
}

# === SUMMARY ===
Write-Host "`n============================================" -ForegroundColor Cyan
Write-Host " TRIAGE SUMMARY" -ForegroundColor Cyan
Write-Host "============================================" -ForegroundColor Cyan
$criticalCount = ($Findings | Where-Object { $_ -match "\[CRITICAL\]" }).Count
$highCount = ($Findings | Where-Object { $_ -match "\[HIGH\]" }).Count
$mediumCount = ($Findings | Where-Object { $_ -match "\[MEDIUM\]" }).Count
Write-Host "  CRITICAL findings: $criticalCount" -ForegroundColor $(if($criticalCount -gt 0){"Red"}else{"Green"})
Write-Host "  HIGH findings:     $highCount" -ForegroundColor $(if($highCount -gt 0){"DarkYellow"}else{"Green"})
Write-Host "  MEDIUM findings:   $mediumCount" -ForegroundColor $(if($mediumCount -gt 0){"Yellow"}else{"Green"})
Write-Host ""
if ($criticalCount -gt 0) {
    Write-Host "  *** IMMEDIATE ACTION REQUIRED — Critical indicators of ransomware staging detected. ***" -ForegroundColor Red
    Write-Host "  *** Isolate this host from the network and initiate incident response procedures. ***" -ForegroundColor Red
} elseif ($highCount -gt 0) {
    Write-Host "  ** ELEVATED RISK — Investigate HIGH findings immediately. Consider enhanced monitoring. **" -ForegroundColor DarkYellow
} else {
    Write-Host "  No critical or high-severity findings. Continue standard monitoring." -ForegroundColor Green
}

# Write report to file
$Findings | Out-File -FilePath $ReportPath -Encoding UTF8
Write-Host "`nReport saved to: $ReportPath" -ForegroundColor Cyan