N0N Ransomware Gang: 16 New Claims Posted on Dark Web Leak Site — Targeting Analysis & Detection Guidance

Classification: TLP:CLEAR | Publication Date: 2026-11-04 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

Executive Summary

The N0N ransomware group has recently posted 16 new claims on its dark web leak site, primarily listing organizations in the Technology sector and other undisclosed sectors. The alleged victims are located across Saudi Arabia (SA), United States (US), United Arab Emirates (AE), and Malaysia (MY). This briefing provides an analysis of the gang's current campaign, detection engineering content, and defensive recommendations based on observed TTPs and known exposure points.

Sourcing & Verification

Of the 16 listings analyzed, 15 were independently observed by a second crawler, while 1 appears on a single source only. Inclusion reflects the threat actor's claim and is NOT confirmation of a breach. A named organization may dispute the listing, and a denial is likewise not proof the claim is false — disclosure obligations vary and not every incident is reportable, so neither silence nor denial settles the question. Security Arsenal will publish corrections and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

• Known aliases: Limited public information; operates under "N0N" branding
• Operational model: Appears to operate as a Ransomware-as-a-Service (RaaS) platform, recruiting affiliates to conduct intrusions
• Typical ransom demands: Unknown specific figures, but generally aligned with mid-market and enterprise targets
• Known initial access methods: Phishing emails with malicious attachments, exploitation of exposed VPN and RDP services, and potential supply-chain compromises
• Double extortion approach: Yes — threatens to leak stolen data if ransom is not paid
• Average dwell time before detonation: Estimated 3-7 days based on observed patterns in similar campaigns

Current Campaign Analysis

Sectors Targeted

• Technology (1 listing)
• Not Found / Undisclosed (15 listings)

Geographic Concentration

• Saudi Arabia (SA): 1 claim
• United States (US): 10 claims
• United Arab Emirates (AE): 1 claim
• Malaysia (MY): 1 claim
• Unknown (?): 2 claims

Victim Profile

• Company size range: Mid-market to enterprise-level organizations based on geographic spread and sector
• Revenue estimates: Not available; however, targeting suggests organizations with sufficient resources to meet ransom demands

Observed Posting Frequency / Escalation Patterns

• 16 claims posted between 2026-11-02 and 2026-11-03
• High volume over a short period suggests an aggressive campaign push or successful affiliate onboarding

Connection to CVEs as Initial Access Vectors

While no specific CVE is confirmed as the initial access vector for any listed organization, the following actively exploited vulnerabilities represent sector-level exposure that N0N or its affiliates may leverage:

• CVE-2026-59310: Broadcom VMware vCenter Path Traversal Vulnerability
• CVE-2026-63077: JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
• CVE-2026-20316: Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
• CVE-2026-50751: Check Point Security Gateway Improper Authentication Vulnerability
• CVE-2026-48027: Nx Console Embedded Malicious Code Vulnerability

These vulnerabilities could serve as entry points if left unpatched, particularly in environments with exposed management interfaces or development infrastructure.

Detection Engineering

SIGMA Rules

---
title: N0N Ransomware - Phishing Macro Execution
id: n0n-001
description: Detects execution of Office macros followed by suspicious child processes, consistent with N0N initial access via phishing
author: Security Arsenal
date: 2026/11/04
logsource:
  product: windows
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith:
      - 'winword.exe'
      - 'excel.exe'
      - 'powerpnt.exe'
      - 'outlook.exe'
  selection_child:
    Image|endswith:
      - 'powershell.exe'
      - 'wscript.exe'
      - 'cscript.exe'
      - 'mshta.exe'
      - 'rundll32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate administrative scripts
level: high
tags:
  - attack.initial_access
  - attack.t1566.001
---
title: N0N Ransomware - VPN Exploitation Followed by Suspicious Logon
id: n0n-002
description: Detects successful VPN logon from unusual source followed by remote service execution, consistent with N0N VPN exploitation
author: Security Arsenal
date: 2026/11/04
logsource:
  product: windows
  service: security
detection:
  selection_logon:
    EventID: 4624
    LogonType: 10
    IpAddress|startswith:
      - '10.'
      - '172.16.'
      - '192.168.'
  selection_service:
    EventID: 7045
    ServiceFileName|contains:
      - 'psexec'
      - 'wmi'
      - 'cobalt'
  condition: selection_logon and selection_service
falsepositives:
  - Legitimate administrative activity
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
---
title: N0N Ransomware - Data Staging and Exfiltration
id: n0n-003
description: Detects compression of sensitive directories followed by network transfer, consistent with N0N data staging before encryption
author: Security Arsenal
date: 2026/11/04
logsource:
  product: windows
  category: process_creation
detection:
  selection_compress:
    CommandLine|contains:
      - '7z.exe a'
      - 'rar.exe a'
      - 'zip.exe'
      - 'tar.exe -czf'
  selection_paths:
    CommandLine|contains:
      - 'C:\Users'
      - 'C:\Documents'
      - 'C:\Data'
      - 'C:\Backup'
  condition: selection_compress and selection_paths
falsepositives:
  - Legitimate backup operations
level: medium
tags:
  - attack.collection
  - attack.exfiltration
  - attack.t1560.001

KQL (Microsoft Sentinel)

// Hunt for lateral movement and pre-ransomware staging indicators
let timeRange = 7d;
let suspiciousProcesses = dynamic(["psexec.exe", "wmic.exe", "powershell.exe", "rundll32.exe"]);
SecurityEvent
| where TimeGenerated > ago(timeRange)
| where EventID == 4624 and LogonType == 10 // Remote interactive logon
| extend IpAddress = tostring(IpAddress)
| where IpAddress !startswith "10." and IpAddress !startswith "172.16." and IpAddress !startswith "192.168."
| join kind=inner (
    SecurityEvent
    | where TimeGenerated > ago(timeRange)
    | where EventID == 4688
    | where Process has_any (suspiciousProcesses)
    | extend CommandLine = tostring(CommandLine)
) on Account, Computer
| project TimeGenerated, Account, Computer, IpAddress, Process, CommandLine
| order by TimeGenerated desc

PowerShell/Bash Script

# Rapid-response hardening and detection script
# Check for exposed RDP, recent scheduled tasks, and Volume Shadow Copies

Write-Host "=== Checking for exposed RDP ==="
$rdp = Get-NetFirewallRule -DisplayGroup "Remote Desktop" | Where-Object {$_.Enabled -eq "True"}
if ($rdp) {
    Write-Host "WARNING: RDP rules are enabled. Review and restrict access." -ForegroundColor Red
    $rdp | Format-Table DisplayName, Enabled, Profile, Action
} else {
    Write-Host "No enabled RDP firewall rules found." -ForegroundColor Green
}

Write-Host "`n=== Checking for scheduled tasks added in last 7 days ==="
$tasks = Get-ScheduledTask | Where-Object {$_.Date -gt (Get-Date).AddDays(-7)}
if ($tasks) {
    Write-Host "Recent scheduled tasks detected. Review for legitimacy." -ForegroundColor Yellow
    $tasks | Select-Object TaskName, Date, Author, State
} else {
    Write-Host "No scheduled tasks added in last 7 days." -ForegroundColor Green
}

Write-Host "`n=== Checking Volume Shadow Copies ==="
$shadows = vssadmin list shadows
if ($shadows -match "No items found") {
    Write-Host "WARNING: Volume Shadow Copies may have been deleted." -ForegroundColor Red
} else {
    Write-Host "Volume Shadow Copies present." -ForegroundColor Green
    $shadows
}

Write-Host "`n=== Checking for suspicious network connections ==="
$connections = Get-NetTCPConnection | Where-Object {$_.State -eq "Established" -and $_.RemotePort -in 445, 3389, 5985, 5986}
if ($connections) {
    Write-Host "Active connections on common lateral movement ports detected." -ForegroundColor Yellow
    $connections | Format-Table LocalAddress, LocalPort, RemoteAddress, RemotePort, State
} else {
    Write-Host "No suspicious established connections found." -ForegroundColor Green
}

Incident Response Priorities

T-minus Detection Checklist

• Monitor for unusual logon activity, especially via VPN or RDP from unexpected geographies
• Alert on execution of Office macros spawning command interpreters
• Watch for compression of sensitive directories or databases
• Detect deletion or modification of Volume Shadow Copies
• Identify new scheduled tasks or services created shortly after initial access
• Look for use of PsExec, WMI, or Cobalt Strike-style beacons

Critical Assets Historically Prioritized for Exfiltration

• Financial records and payment information
• Intellectual property and source code
• Customer databases and PII
• Backup repositories
• Active Directory databases (NTDS.dit)

Containment Actions Ordered by Urgency

1. Isolate affected systems from the network immediately
2. Disable VPN and RDP access if compromise is suspected
3. Reset credentials for all privileged and service accounts
4. Block known malicious IPs and domains associated with N0N
5. Preserve forensic evidence before remediation
6. Engage incident response team and legal counsel

Hardening Recommendations

Immediate (24h)

• Disable or restrict RDP and VPN access; enforce MFA on all remote access
• Block execution of Office macros from internet-facing email
• Patch known exploited vulnerabilities: CVE-2026-59310, CVE-2026-63077, CVE-2026-20316, CVE-2026-50751, CVE-2026-48027
• Deploy detection rules provided above
• Review and restrict administrative shares and lateral movement pathways

Short-term (2 weeks)

• Implement network segmentation to limit lateral movement
• Deploy EDR solutions with behavioral detection for ransomware TTPs
• Conduct phishing awareness training and simulate attacks
• Review and harden backup infrastructure; ensure immutable backups
• Establish dark web monitoring for organizational mentions

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub