Classification: TLP:CLEAR | Publication Date: 2026-11-07 | Source: ransomware.live leak-site monitoring | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 15 Unverified Listings Posted in 48 Hours — Sector Targeting Analysis & Detection Rules

Executive Summary

Security Arsenal's dark web monitoring has observed a concentrated burst of activity from the N0N ransomware operation: 15 organizations listed on the gang's .onion leak site within a 48-hour window (2026-11-05 through 2026-11-06). The listings span healthcare, technology, energy & utilities, professional services, and retail & e-commerce across seven countries (IT, US, SA, AE, CA, DK, ID).

Every word of this matters: these are claims made by a criminal organization on its own leak site. A leak-site posting is an accusation, not a confirmed breach. None of the named organizations — including Dompé Farmaceutici S.p.A., Cogent Biosciences, Inc., Chartboost LLC, Centrepoint, Resource Consultants, Max Fashion, Hallmark Cards, Inc., Scry Analytics, Delta Dental of Missouri, and The Container Store — have been confirmed as breached by this data. Five additional listings (Company #133 through Company #137) appear as placeholders without disclosed names, a common pre-leak pressure tactic.

What defenders should take from this: N0N is running a high-tempo, multi-sector, multi-geography campaign, and the sectors it is currently claiming overlap directly with the sectors where the CISA KEV-listed vulnerabilities referenced below are most densely deployed. Whether or not any individual claim is true, the gang's stated targeting priorities are actionable intelligence for detection engineering.

Sourcing & Verification

• Corroboration: 15 of 15 listings were independently observed by a second leak-site crawler; 0 appear on a single source only. Multi-source observation confirms the gang made the claim — nothing more.
• Inclusion is not confirmation. Every organization named in this briefing is included solely because N0N published a claim on its leak site. No tier in our collection pipeline confirms a breach occurred. Only the organization itself or its regulator can do that.
• Disputes and denials: A named organization may dispute the listing. A denial is likewise not proof the claim is false — disclosure obligations vary by jurisdiction and sector, and not every incident is legally reportable. Neither silence nor denial settles the question.
• Corrections: Security Arsenal will publish corrections promptly. We welcome contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

Attribution note: The following profile reflects Security Arsenal's assessment of N0N's operational pattern based on leak-site telemetry and open-source reporting. Where data is thin, we say so.

Aliases: Tracked as N0N across ransomware.live and independent crawler ecosystems. No widely corroborated alternate aliases at this time; the branding appears designed for search-resistant ambiguity (easily confused with "noon," "n0n-" prefixed strings, etc.), which is itself a low-effort OPSEC choice.

Operating model: Assessed as a closed or tightly vetted Ransomware-as-a-Service (RaaS) operation. The burst pattern — 15 listings in 48 hours spanning seven countries — is consistent with either (a) multiple affiliates posting victims from a backlog simultaneously, or (b) a single operator batch-publishing to maximize pressure optics. The presence of five anonymized "Company #NNN" placeholder entries suggests a standardized victim-intake and staged-disclosure workflow, which leans RaaS.

Ransom posture: Typical demands for operations at this tempo range from the low hundreds of thousands to low millions USD, scaled to victim revenue. N0N employs double extortion: exfiltrate first, encrypt second, then leverage the leak site with countdown-style staged disclosure. The "Company #NNN" placeholders are the pressure mechanism — the gang signals it holds data on unnamed victims to force negotiation before public naming.

Initial access methods (assessed, sector-level):

• Exploitation of internet-facing edge services: VPN concentrators, firewall management planes, and remote access gateways
• Phishing with macro- or script-based payloads leading to loader deployment
• Exposed or weakly authenticated RDP, including credential stuffing against gateways
• Abuse of remote monitoring & management (RMM) tooling for hands-on persistence

Dwell time: Operations of this class typically show 3–14 days from initial access to encryption detonation, with exfiltration occurring in the final 24–72 hours. The detection window is real but short — which is why the pre-encryption indicators in the Detection Engineering section matter more than ransomware-binary signatures.

Current Campaign Analysis

Sector Targeting

Based strictly on the 15 listings observed 2026-11-05 through 2026-11-06:

Healthcare and retail are the heaviest disclosed categories. Healthcare claims are consistent with a sector where downtime tolerance is low and regulatory exposure (patient data) maximizes extortion leverage. Retail claims coincide with the Q4 holiday revenue window — a deliberate pressure amplifier, since retail organizations face peak transaction volumes and reputational sensitivity precisely now.

Geographic Concentration

US-headquartered organizations dominate the disclosed listings (6 of 10 named), with single claims in Italy, Saudi Arabia, and the UAE, and placeholder victims in Canada, Denmark, and Indonesia. This is a broad, opportunistic geographic spread rather than a regionally focused campaign — consistent with vulnerability-driven targeting (scan-and-exploit) rather than curated victim selection.

Victim Profile

The named set skews toward mid-to-large enterprises: national retail chains, a specialty pharmaceutical manufacturer, a clinical-stage biopharma firm, and a regional dental benefits administrator. Estimated revenues across the set range roughly from the low tens of millions to multiple billions USD. This spread suggests the operation does not enforce a narrow victim-size floor — it takes what its access vector yields and prices the demand to the balance sheet.

Posting Frequency / Escalation Pattern

The 48-hour burst (5 listings on 2026-11-05, 8 on 2026-11-06, plus placeholder spillover) is the notable signal. Batch posting of this density typically indicates one of three things: a backlog dump after a quiet period, a deliberate "shock" publication to raise the operation's profile, or multiple affiliates synchronizing activity. The mix of named victims and anonymized placeholders in the same window supports the staged-disclosure interpretation — expect placeholder names to be revealed or dropped over the next 1–3 weeks depending on negotiation outcomes.

CVE Exposure Hypothesis (Sector-Level, Not Victim Attribution)

We have no evidence linking any specific CVE to any specific named listing. What we can say: N0N's assessed access methods (edge-device exploitation, management-plane compromise) overlap with several vulnerabilities currently on CISA's Known Exploited Vulnerabilities catalog with confirmed ransomware use:

• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1). Directly relevant to VPN-edge initial access. Organizations running Check Point gateways with IKEv1 enabled should treat patching as urgent.
• CVE-2026-20316 — Cisco Secure Firewall Management Center hard-coded password. Management-plane compromise of FMC gives an actor control over firewall policy across the enterprise — an ideal pre-positioning move before lateral movement.
• CVE-2026-59310 — Broadcom VMware vCenter path traversal. vCenter compromise enables hypervisor-level impact: snapshot manipulation, mass VM encryption, and destruction of recovery options in a single move. This is the single highest-value target in most virtualized environments.
• CVE-2026-63077 — JetBrains TeamCity deserialization. CI/CD server compromise provides both code-signing-adjacent access and a lateral-movement launchpad with highly privileged service accounts.
• CVE-2026-48027 — Nx Console embedded malicious code. Supply-chain exposure via a malicious package version; relevant to technology-sector victims and any org with JS/TS development estates.

Hypothesis only: organizations in the targeted sectors with unpatched exposure on these CVEs should assume elevated risk from operations like N0N and hunt accordingly.

Detection Engineering

The following content targets TTPs consistent with N0N's assessed playbook: edge/VPN initial access, hands-on lateral movement via PsExec and WMI, Cobalt Strike-style C2, and pre-encryption data staging. Tune thresholds to your environment before production deployment.

---
title: N0N Campaign - PsExec-Style Remote Service Installation for Lateral Movement
id: 8f3a1c2e-7b41-4f6a-9c2d-n0nlateral0001
status: experimental
description: Detects creation of services with PsExec-style naming patterns (PSEXESVC, random 8-char names, ADMIN$ target) consistent with hands-on ransomware operator lateral movement as assessed for N0N and peer double-extortion groups.
author: Security Arsenal Threat Intelligence
date: 2026/11/07
references:
    - https://securityarsenal.com/darkside
logsource:
    category: service_creation
    product: windows
detection:
    selection_service_name:
        ServiceName|contains:
            - 'PSEXESVC'
            - 'PAExec'
            - 'csexec'
            - 'remcom'
    selection_random_name:
        ServiceName|re: '^[A-Za-z0-9]{8}$'
    selection_imagepath:
        ImagePath|contains:
            - '\\ADMIN$\\'
            - '\\IPC$\\'
            - '%SystemRoot%\\PSEXESVC.exe'
    condition: selection_service_name or (selection_random_name and selection_imagepath)
falsepositives:
    - Legitimate administrative tooling using PsExec or PAExec for software deployment
    - EDR and IT management platforms that install remote services
level: high
tags:
    - attack.lateral_movement
    - attack.t1569.002
    - attack.t1021.002
---
title: N0N Campaign - Suspicious Authentication Bursts on VPN and RDP Edge Services
id: 8f3a1c2e-7b41-4f6a-9c2d-n0nedge0002
status: experimental
description: Detects high-volume failed authentication followed by success against Windows RDP (Event 4625/4624 logon type 10) - pattern consistent with credential stuffing or brute force preceding ransomware initial access via exposed remote access.
author: Security Arsenal Threat Intelligence
date: 2026/11/07
references:
    - https://securityarsenal.com/darkside
logsource:
    product: windows
    service: security
detection:
    selection_failed:
        EventID: 4625
        Logon_Type: 10
    selection_success:
        EventID: 4624
        Logon_Type: 10
    filter_known_bastion:
        Source_Address|contains:
            - '10.0.0.0/8'   # adjust: known internal bastion/jump hosts
    condition: (selection_failed and selection_success) and not filter_known_bastion
timeframe: 10m
falsepositives:
    - Legitimate user password mistyping from remote locations
    - Misconfigured service accounts
level: medium
tags:
    - attack.credential_access
    - attack.t1110
    - attack.t1078
    - attack.t1133
---
title: N0N Campaign - Pre-Encryption Data Staging and Archive Creation
id: 8f3a1c2e-7b41-4f6a-9c2d-n0nstage0003
status: experimental
description: Detects mass archive creation with common exfiltration tooling (7z, rar, WinRAR) targeting document and database extensions - consistent with double-extortion data staging observed in the 24-72 hours before N0N-class ransomware detonation.
author: Security Arsenal Threat Intelligence
date: 2026/11/07
references:
    - https://securityarsenal.com/darkside
logsource:
    category: process_creation
    product: windows
detection:
    selection_tools:
        Image|endswith:
            - '\\7z.exe'
            - '\\7za.exe'
            - '\\rar.exe'
            - '\\winrar.exe'
    selection_args:
        CommandLine|contains:
            - ' a '
            - ' -mx'
            - ' -p'
            - '.doc'
            - '.xls'
            - '.pdf'
            - '.sql'
            - '.bak'
            - '.pst'
    selection_paths:
        CommandLine|contains:
            - '\\Users\\Public\\'
            - '\\ProgramData\\'
            - '\\Temp\\'
            - 'C:\\Windows\\Temp\\'
    condition: selection_tools and selection_args and selection_paths
falsepositives:
    - Legitimate backup and archival jobs (whitelist service accounts and scheduled task contexts)
    - Developer build pipelines using 7zip
level: high
tags:
    - attack.collection
    - attack.t1560.001
    - attack.exfiltration

Microsoft Sentinel — Lateral Movement & Pre-Ransomware Staging Hunt

This KQL query hunts for the compound pattern most characteristic of hands-on ransomware operators in the pre-detonation window: remote service installation on a host, followed by archive-tool execution or shadow-copy manipulation on the same host within a short window. Run over the last 7 days.

// N0N-style pre-ransomware staging hunt: remote service install + archive/shadow activity correlation
// Security Arsenal Threat Intelligence | 2026-11-07
let Lookback = 7d;
let CorrelationWindow = 2h;
let ArchiveTools = dynamic(["7z.exe", "7za.exe", "rar.exe", "winrar.exe", "rclone.exe", "megacmd.exe"]);
let ServiceInstalls = SecurityEvent
    | where TimeGenerated >= ago(Lookback)
    | where EventID == 7045
    | where ServiceName has_any ("PSEXESVC", "PAExec", "remcom", "csexec")
        or ServiceName matches regex "^[A-Za-z0-9]{8}$"
    | project ServiceInstallTime=TimeGenerated, Computer, ServiceName, ServiceFileName, Account, IpAddress;
let SuspiciousProcs = SecurityEvent
    | where TimeGenerated >= ago(Lookback)
    | where EventID == 4688
    | where (NewProcessName has_any (ArchiveTools)
        and CommandLine has_any (" a ", " -mx", " -p", "copy", "sync"))
        or (NewProcessName has "vssadmin.exe" and CommandLine has_any ("delete shadows", "resize shadowstorage"))
        or (NewProcessName has "wbadmin.exe" and CommandLine has "delete")
        or (NewProcessName has "bcdedit.exe" and CommandLine has_any ("recoveryenabled", "bootstatuspolicy"))
    | project ProcTime=TimeGenerated, Computer, NewProcessName, CommandLine, Account, ParentProcessName;
ServiceInstalls
| join kind=inner SuspiciousProcs on Computer
| where ProcTime between (ServiceInstallTime .. ServiceInstallTime + CorrelationWindow)
| extend TimeDeltaMinutes = datetime_diff("minute", ProcTime, ServiceInstallTime)
| project Computer, ServiceInstallTime, ServiceName, ProcTime, NewProcessName, CommandLine, TimeDeltaMinutes, Account1=Account, IpAddress
| summarize FirstSeen=min(ServiceInstallTime), LastSeen=max(ProcTime), DistinctHosts=dcount(Computer), Commands=make_set(CommandLine, 10) by Computer, Account1
| order by FirstSeen desc;

Analysts should triage any hit where DistinctHosts climbs across runs — fan-out of this pattern across multiple servers from a single source account is a high-fidelity pre-ransomware indicator.

Rapid-Response Exposure & Persistence Audit

Run the following from an elevated prompt on critical Windows servers (domain controllers, file servers, virtualization management hosts). It checks for externally exposed RDP, scheduled tasks created in the last 7 days, and Volume Shadow Copy tampering — three of the fastest checks that surface N0N-class operator pre-positioning.

# Security Arsenal - N0N Campaign Rapid Response Audit (2026-11-07)
# Run elevated. Outputs to C:\Temp\N0N-Audit-<hostname>-<date>.txt

$out = "C:\Temp\N0N-Audit-$env:COMPUTERNAME-$(Get-Date -Format 'yyyyMMdd-HHmm').txt"
New-Item -Path C:\Temp -ItemType Directory -Force -ErrorAction SilentlyContinue | Out-Null
"=== N0N Rapid Response Audit - $env:COMPUTERNAME - $(Get-Date) ===" | Out-File $out

"`n[1] RDP Exposure Check" | Out-File $out -Append
$rdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections
$rdpPort = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp').PortNumber
"RDP Enabled (0 = enabled): $rdpEnabled | Listening Port: $rdpPort" | Out-File $out -Append
"Inbound firewall rules permitting 3389/rdpPort:" | Out-File $out -Append
Get-NetFirewallRule -Direction Inbound -Action Allow -Enabled True -ErrorAction SilentlyContinue |
    Where-Object { ($_.DisplayName -match 'Remote Desktop|RDP') } |
    Select-Object DisplayName, Profile, Enabled | Format-Table -AutoSize | Out-String | Out-File $out -Append
$nla = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp').UserAuthentication
"NLA Required (1 = yes, should be 1): $nla" | Out-File $out -Append

"`n[2] Scheduled Tasks Created/Modified in Last 7 Days" | Out-File $out -Append
$cutoff = (Get-Date).AddDays(-7)
Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt $cutoff } |
    Select-Object TaskName, TaskPath, Date, @{N='Author';E={$_.Author}}, State |
    Format-Table -AutoSize | Out-String | Out-File $out -Append
Get-ScheduledTask | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    if ($_.Actions.Execute -match 'powershell|cmd|wscript|cscript|mshta|rundll32|regsvr32|curl|certutil|bitsadmin|7z|rar') {
        [PSCustomObject]@{ TaskName=$_.TaskName; TaskPath=$_.TaskPath; Action=$_.Actions.Execute; Args=$_.Actions.Arguments }
    }
} | Format-List | Out-String | Out-File $out -Append

"`n[3] Volume Shadow Copy Status" | Out-File $out -Append
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($shadows) {
    "Shadow copies present: $($shadows.Count). Latest: $($shadows | Sort-Object InstallDate -Descending | Select-Object -First 1 -ExpandProperty InstallDate)" | Out-File $out -Append
} else {
    "WARNING: No volume shadow copies found. Verify whether deletion occurred (Event 7036/vssadmin in logs)." | Out-File $out -Append
}
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7036} -MaxEvents 50 -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'Volume Shadow Copy' } |
    Select-Object TimeCreated, Message | Format-List | Out-String | Out-File $out -Append

"`n[4] Recently Created Local Accounts (30 days)" | Out-File $out -Append
Get-LocalUser | Where-Object { $_.Created -gt (Get-Date).AddDays(-30) } |
    Select-Object Name, Enabled, Created, LastLogon | Format-Table -AutoSize | Out-String | Out-File $out -Append

"`nAudit complete. Output: $out"

Incident Response Priorities — N0N Playbook

T-Minus Detection Checklist (Before Encryption Fires)

Given an assessed dwell time of 3–14 days with exfiltration in the final 24–72 hours, hunt for these in order:

1. Edge anomalies: authentication bursts on VPN/firewall management interfaces; logins from impossible geographies or unmanaged ASNs; new admin sessions immediately following CVE-adjacent patch gaps.
2. Discovery bursts: nltest, net group "Domain Admins", AD enumeration tooling (AdFind, SharpHound) executed outside change windows.
3. Lateral movement fan-out: service installations (7045), WMI process creation, and SMB admin-share writes spreading from a single source host.
4. Staging artifacts: new archives in C:\Users\Public\, C:\ProgramData\, or C:\Windows\Temp\; rclone/megacmd/WinSCP execution; sustained high egress to unfamiliar cloud storage ASNs.
5. Recovery sabotage (the last move): vssadmin delete shadows, bcdedit recovery suppression, wbadmin delete backup, hypervisor snapshot deletion on vCenter/ESXi.

Critical Assets This Operation Class Prioritizes for Exfiltration

• File servers and NAS shares holding finance, legal, and HR data (highest extortion value per byte)
• Healthcare-sector specifics for the currently claimed targeting: patient records, clinical trial data (relevant to biopharma claims), claims/benefits data (relevant to dental-benefits claims)
• Retail-sector specifics: customer PII and payment-adjacent databases, loyalty program data
• Email archives of executive and legal mailboxes — used to craft credible leak threats
• Backup catalogs (to confirm what they need to destroy)

Containment Actions, Ordered by Urgency

1. Isolate, don't power off suspect hosts (preserve memory for forensics); VLAN-quarantine first.
2. Disable the suspected compromised accounts and force enterprise-wide credential rotation, prioritizing domain admins, service accounts, and VPN/RDP credentials — assume credential theft precedes detonation.
3. Block egress to consumer cloud storage and unknown ASNs at the proxy/firewall immediately to cut off in-flight exfiltration.
4. Snapshot and offline-verify backups now — confirm restoration works before you need it; verify vCenter/ESXi snapshot integrity.
5. Disable or restrict PsExec/WMI/WinRM via host firewall and GPO across servers to break the lateral movement pattern mid-campaign.
6. Engage IR counsel and review disclosure obligations for your jurisdiction and sector — do not let a criminal's leak post set your timeline, but do not let it pass unassessed either.

Hardening Recommendations

Immediate (24 Hours)

• Patch or mitigate the KEV set: CVE-2026-50751 (Check Point), CVE-2026-20316 (Cisco FMC), CVE-2026-59310 (VMware vCenter), CVE-2026-63077 (TeamCity), CVE-2026-48027 (Nx Console — audit installed versions and build pipelines). These carry confirmed ransomware exploitation.
• Enforce phishing-resistant MFA on all remote access (VPN, RDP gateways, firewall management planes). IKEv1-based legacy VPN configurations deserve special scrutiny given CVE-2026-50751.
• Block macro execution from internet-sourced documents via GPO and Mark-of-the-Web enforcement.
• Deploy the Sigma rules and Sentinel query above and page on the compound staging pattern (rule 3 + KQL correlation).
• Verify shadow copies and offline backup integrity on critical servers; enable tamper protection on backup infrastructure.
• Egress filtering: block rclone-friendly endpoints (Mega, etc.) and alert on bulk transfer to unsanctioned storage.

Short-Term (Two Weeks)

• Segment the virtualization management plane. vCenter and hypervisor management interfaces must be reachable only from hardened jump hosts with MFA — a vCenter compromise is a whole-estate compromise.
• Eliminate standing RDP exposure. Move all administrative access behind a PAM/jump-host architecture; deny direct 3389 inbound at the perimeter without exception.
• Deploy canary files and honey credentials on file servers; ransomware staging touches these early and provides high-fidelity, low-noise alerting.
• Harden CI/CD estates (TeamCity and peers): isolate build servers, rotate signing credentials if exposure is suspected, audit for CVE-2026-48027-affected Nx Console versions in developer environments.
• Baseline and alert on archive-tool execution — 7z/rar/rclone have no business running on most servers outside defined backup windows and service accounts.
• Tabletop the double-extortion scenario: legal, comms, and executives should rehearse the "leak-site listing with countdown" decision tree before a real claim arrives.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub