Classification: TLP:CLEAR | Publication Date: 2026-11-04 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 16 Organizations Listed in 48-Hour Posting Surge

Executive Summary

Between 2026-11-02 and 2026-11-03, the ransomware operation tracked as N0N listed 16 organizations on its dark web leak site — a compressed posting cadence that signals either a coordinated intrusion wave, a bulk purchase of access from initial access brokers (IABs), or a deliberate information-operations push designed to inflate the group's perceived tempo.

Every listing in this window carries the same caveat: these are claims made by a criminal enterprise. Fifteen of the sixteen postings were independently observed by a second leak-site crawler, which confirms the gang published the claims — it does not confirm any breach occurred. No organization named in this briefing should be treated as a confirmed victim on the basis of this data.

Geographic concentration skews heavily toward the United States (10 listings), with additional claims in Saudi Arabia, the United Arab Emirates, and Malaysia. Sector tagging on the leak site is sparse — most victims are uncategorized, with at least one listing tagged to the Technology sector. Enterprise defenders in these geographies should treat this briefing as a cue to run the detection content in Section 5, not as confirmation of compromise.

Sourcing & Verification

This briefing is built on monitoring of N0N's .onion leak site via ransomware.live. Readers must understand the evidentiary limits:

• 15 of 16 listings were independently observed by a second leak-site crawler (tagged MULTI-SOURCE). This confirms the gang published the claim — nothing more. 1 listing appears on a single source only.
• Inclusion in this briefing reflects the threat actor's claim. It is not confirmation that any breach, intrusion, or data theft occurred. No corroboration tier in this dataset — including MULTI-SOURCE — confirms a breach. Only the named organization or its regulator can do that.
• A named organization may dispute its listing. Equally, a denial is not proof the claim is false: disclosure obligations vary by jurisdiction and sector, not every incident is reportable, and neither silence nor denial settles the question either way.
• Victim names in this dataset are pseudonymized ("Company #NNN"). Security Arsenal reports them exactly as observed and will not speculate on identity.
• Security Arsenal will publish corrections to this briefing if warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

N0N is an emerging-to-mid-tier ransomware operation that first appeared on leak-site tracking radars with a pattern consistent with the current generation of post-LockBit-ecosystem crews. Key assessed characteristics:

Analyst note: With limited public incident reporting tied to N0N specifically, profile elements beyond the leak-site data should be treated as assessments based on behavioral similarity to comparable mid-tier operations, not as confirmed group-specific TTPs.

Current Campaign Analysis

Posting cadence and escalation pattern

The defining feature of this window is burst posting: 16 listings in approximately 48 hours (7 on 2026-11-02, 9 on 2026-11-03). This pattern has three plausible explanations, none mutually exclusive:

1. Batch monetization — access obtained weeks earlier is being published on a schedule as negotiations fail or deadlines expire.
2. IAB-driven campaign — the gang purchased a bundle of accesses and is working through them.
3. Reputation farming — newer crews sometimes post inflated or recycled claims to build negotiating credibility. The heavy reliance on unclassified ("Not Found") sector tagging and pseudonymized victims is consistent with a crew still building its brand.

Sector targeting

Sector data from the leak site is thin: the majority of listings are tagged "Not Found," with Technology the only identified sector. This limits sector-level conclusions. Defenders should not assume tech-only targeting — unsophisticated or lazy leak-site tagging is common among lower-tier crews.

Geographic concentration

The US + Gulf (SA/AE) concentration mirrors a broader 2025–2026 pattern of mid-tier crews pairing high-value Western targets with Gulf organizations perceived as likely to pay quietly to avoid regulatory and reputational exposure.

Victim profile

With pseudonymized names and sparse sector tags, revenue estimates are not defensible at the individual-victim level. At the portfolio level: crews in N0N's tier typically target SMB-to-mid-market organizations (roughly $10M–$500M revenue) — large enough to pay, small enough to lack mature detection and response. The absence of marquee enterprise names in this batch is consistent with that profile.

CVE exposure context (hypothesis — not attribution)

We have no evidence linking any specific CVE to any specific N0N listing. However, the following CISA KEV entries — all confirmed as exploited by ransomware actors — represent the class of edge and infrastructure exposure a crew like N0N would be expected to leverage, and all are relevant to organizations matching this campaign's geographic and sector profile:

• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1). Perimeter/VPN-class exposure; a classic ransomware initial access vector.
• CVE-2026-20316 — Cisco Secure Firewall Management Center hard-coded password. Management-plane compromise of network security infrastructure.
• CVE-2026-59310 — Broadcom VMware vCenter path traversal. Virtualization management-plane access — direct path to mass encryption of VM estates, the highest-impact ransomware outcome.
• CVE-2026-63077 — JetBrains TeamCity deserialization. CI/CD compromise enabling supply-chain-style downstream access; particularly relevant to the Technology-sector listing.
• CVE-2026-48027 — Nx Console embedded malicious code. Developer-workstation supply chain exposure; again relevant where technology companies are in the target set.

Treat these as prioritized patch-and-hunt hypotheses, not as confirmed N0N tradecraft.

Detection Engineering

The following content targets the TTP cluster typical of this actor tier: edge/VPN initial access, RDP brute force, macro execution, PsExec/WMI lateral movement, Cobalt Strike-style C2, and pre-encryption staging (shadow copy deletion, mass file access, data staging).

---
title: RDP Brute Force Followed by Successful Logon — Pre-Ransomware Initial Access
id: 9f1a2b3c-7d4e-4a5f-8b6c-1a2b3c4d5e01
status: experimental
description: Detects a burst of failed RDP logons (Event 4625, logon type 10) followed by a successful network/RDP logon (4624 type 3 or 10) from the same source IP within a short window — consistent with brute-force-driven initial access used by mid-tier ransomware crews.
author: Security Arsenal Threat Intelligence
date: 2026/11/04
references:
  - https://securityarsenal.com/darkside
logsource:
  product: windows
  service: security
  category: authentication
detection:
  selection_failed:
    EventID: 4625
    LogonType: 10
  selection_success:
    EventID: 4624
    LogonType:
      - 3
      - 10
  condition: selection_failed | count() by SourceIp > 10
  timeframe: 10m
  # Pair with: alert when selection_success fires from a SourceIp that tripped selection_failed within the same window
level: high
tags:
  - attack.initial_access
  - attack.t1110
  - attack.t1021.001
---
title: PsExec or Remote Service Creation for Lateral Movement
id: 9f1a2b3c-7d4e-4a5f-8b6c-1a2b3c4d5e02
status: experimental
description: Detects remote service creation (Event 7045) with service names or binary paths consistent with PsExec-style tooling and renamed copies — a lateral movement staple in ransomware pre-detonation phases.
author: Security Arsenal Threat Intelligence
date: 2026/11/04
logsource:
  product: windows
  service: system
detection:
  selection_event:
    EventID: 7045
  selection_psexec:
    ServiceName|contains:
      - 'PSEXESVC'
      - 'psexec'
  selection_suspicious_path:
    ImagePath|contains:
      - '\ADMIN$\'
      - '\\127.0.0.1\'
      - '\Temp\'
      - '\Users\Public\'
  selection_random_name:
    ServiceName|re: '^[A-Za-z0-9]{8,16}$'
  condition: selection_event and (selection_psexec or selection_suspicious_path or selection_random_name)
falsepositives:
  - Legitimate software deployment tools (SCCM, PDQ, Intune)
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002
---
title: Volume Shadow Copy Deletion via vssadmin, wmic, or PowerShell — Pre-Encryption Behavior
id: 9f1a2b3c-7d4e-4a5f-8b6c-1a2b3c4d5e03
status: experimental
description: Detects command-line invocation of shadow copy deletion or resize — a near-universal pre-encryption step across ransomware families and a high-fidelity T-minus indicator.
author: Security Arsenal Threat Intelligence
date: 2026/11/04
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\bcdedit.exe'
  selection_cmd:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'shadowcopy where'
      - 'resize shadowstorage'
      - 'recoveryenabled no'
      - 'ignoreallfailures'
      - 'Get-WmiObject Win32_Shadowcopy'
      - 'Remove-WmiObject'
  condition: selection_img and selection_cmd
falsepositives:
  - Rare; legitimate backup maintenance windows
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.defense_evasion

// KQL — Microsoft Sentinel hunt: pre-ransomware staging chain
// Looks for hosts exhibiting a sequence of: shadow copy tampering + mass file rename/encrypt-like
// behavior + suspicious service installation within a 60-minute window.
// Tuned for the lateral-movement/staging TTPs common to burst-posting ransomware crews.

let Lookback = 7d;
let SuspiciousCmds = dynamic([
  "delete shadows", "shadowcopy delete", "resize shadowstorage",
  "recoveryenabled no", "ignoreallfailures",
  "net stop", "taskkill /f", "wevtutil cl"
]);
let StagingHosts =
  DeviceProcessEvents
  | where TimeGenerated > ago(Lookback)
  | where ProcessCommandLine has_any (SuspiciousCmds)
  | summarize
      FirstSeen=min(TimeGenerated),
      LastSeen=max(TimeGenerated),
      CmdHits=make_set(ProcessCommandLine, 20)
      by DeviceName, InitiatingProcessAccountName;
let ServiceInstalls =
  DeviceEvents
  | where TimeGenerated > ago(Lookback)
  | where ActionType == "ServiceInstalled"
  | extend ServiceName = tostring(parse_json(AdditionalFields).ServiceName)
  | where ServiceName matches regex "^[A-Za-z0-9]{8,16}$" or ServiceName has_any ("psexesvc", "psexec")
  | project ServiceInstallTime=TimeGenerated, DeviceName, ServiceName;
StagingHosts
| join kind=inner ServiceInstalls on DeviceName
| where ServiceInstallTime between (FirstSeen .. LastSeen)
| summarize
    arg_max(LastSeen, *),
    SuspiciousServices=make_set(ServiceName, 10)
    by DeviceName, InitiatingProcessAccountName
| extend RiskScore = 90
| project LastSeen, DeviceName, InitiatingProcessAccountName, SuspiciousServices, CmdHits, RiskScore
| order by LastSeen desc;

# rapid-triage.ps1 — Security Arsenal pre-ransomware rapid assessment
# Run as Administrator on suspect hosts or via your RMM/EDR remote shell.
# Checks: exposed RDP, scheduled tasks (7d), shadow copy state, suspicious services.

$Report = @{}

Write-Host "=== [1/4] RDP Exposure ===" -ForegroundColor Cyan
$rdpEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$nla = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -ErrorAction SilentlyContinue).UserAuthentication
$Report.RdpEnabled = $rdpEnabled
$Report.NlaEnabled = ($nla -eq 1)
if ($rdpEnabled -and $nla -ne 1) {
    Write-Warning "RDP is ENABLED without NLA — high-risk exposure. Restrict or disable immediately."
}
$rdpListeners = Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue
$Report.RdpListening = [bool]$rdpListeners

Write-Host "=== [2/4] Scheduled Tasks Created in Last 7 Days ===" -ForegroundColor Cyan
$cutoff = (Get-Date).AddDays(-7)
$recentTasks = Get-ScheduledTask | Where-Object {
    $_.Date -and ([datetime]$_.Date) -gt $cutoff -and
    $_.TaskPath -notlike '\Microsoft\*'
} | Select-Object TaskName, TaskPath, Date, @{N='Action';E={($_.Actions | ForEach-Object Execute) -join '; '}}
$Report.RecentTasks = $recentTasks
if ($recentTasks) {
    Write-Warning "Non-Microsoft scheduled tasks created in last 7 days:"
    $recentTasks | Format-Table -AutoSize
}

Write-Host "=== [3/4] Volume Shadow Copy State ===" -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
$Report.ShadowCopyCount = @($shadows).Count
if (@($shadows).Count -eq 0) {
    Write-Warning "ZERO shadow copies present. On a server this may indicate pre-encryption tampering (T1490). Check process telemetry for vssadmin/wmic delete shadows."
}
# Hunt recent shadow-deletion artifacts in the Security event log if present
try {
    $vssEvents = Get-WinEvent -FilterHashtable @{LogName='System'; Id=7036; StartTime=$cutoff} -ErrorAction SilentlyContinue |
        Where-Object { $_.Message -match 'Volume Shadow Copy' }
    $Report.VssServiceEvents7d = @($vssEvents).Count
} catch {}

Write-Host "=== [4/4] Suspicious Services (random-name / temp-path) ===" -ForegroundColor Cyan
$susServices = Get-CimInstance Win32_Service | Where-Object {
    $_.PathName -match '\\(Temp|Users\\Public|AppData\\Local\\Temp)\\' -or
    $_.Name -match '^[A-Za-z0-9]{8,16}$'
} | Select-Object Name, DisplayName, State, PathName, StartMode
$Report.SuspiciousServices = $susServices
if ($susServices) {
    Write-Warning "Potentially suspicious services found:"
    $susServices | Format-Table -AutoSize
}

$out = "$env:TEMP\n0n-rapid-triage-$(Get-Date -Format yyyyMMdd-HHmmss).json"
$Report | ConvertTo-Json -Depth 4 | Out-File $out
Write-Host "`nTriage report written to $out" -ForegroundColor Green

Incident Response Priorities

T-minus detection checklist (before encryption fires)

Ransomware crews rarely detonate immediately after access. Watch for this pre-encryption sequence, ordered roughly by phase:

1. Persistence & access consolidation — new local/domain accounts, new scheduled tasks (see script above), new services with random names, AnyDesk/Splashtop/ScreenConnect installations outside your software baseline.
2. Discovery — net group "Domain Admins", nltest /dclist, quser, SharpHound/BloodHound collection artifacts (*.zip in user temp, LDAP query spikes).
3. Staging for exfiltration — large archive creation (7z, rar on servers), Rclone/FileZilla/WinSCP processes on hosts that never run them, sustained outbound transfers to unfamiliar cloud storage or VPS IPs.
4. Defense impairment (highest-urgency signal) — vssadmin delete shadows, bcdedit ... recoveryenabled no, mass net stop of backup/AV/EDR services, event log clearing (wevtutil cl). If you see step 4, assume detonation is imminent — hours, not days.
5. Deployment — PsExec/Group Policy pushes of an unknown binary, WMI remote process creation fanning out from one host to many.

Assets this actor tier prioritizes for exfiltration

Based on double-extortion economics across comparable crews: file servers and NAS shares, finance/HR document repositories (payroll, PII, tax data), executive and legal mailboxes, source code repositories and CI/CD artifacts (particularly relevant given the Technology-sector listing), backup catalogues, and customer databases. Prioritize DLP and egress monitoring on these stores.

Containment actions — ordered by urgency

1. Isolate, don't power off suspected hosts (preserve memory for forensics) — EDR network isolation first.
2. Disable the suspected intruder's identity plane: force-reset credentials for any account observed in lateral movement; revoke sessions/tokens; disable stale VPN accounts.
3. Block egress to known exfil infrastructure and temporarily restrict outbound traffic from server VLANs to approved destinations only.
4. Protect backups: take backup infrastructure off the network path of the suspected blast radius; verify offline/immutable copies exist before announcing a window to attackers by mass-changing credentials.
5. Kill remote access tooling not in your baseline (unauthorized RMM is the most common persistence channel in this tier).
6. Engage IR and legal counsel early — leak-site pressure timelines are short, and notification obligations in the US, Saudi Arabia (PDPL), UAE, and Malaysia may attach if a claim proves real.

Hardening Recommendations

Immediate (24 hours)

• Patch or mitigate the KEV cluster if present in your environment: Check Point Security Gateway (CVE-2026-50751), Cisco Secure FMC (CVE-2026-20316), VMware vCenter (CVE-2026-59310), JetBrains TeamCity (CVE-2026-63077). These are confirmed ransomware-exploited; exposure is your risk regardless of which crew knocks.
• Enforce MFA on all remote access (VPN, RDP gateways, OWA) and disable NLA-less RDP; restrict 3389 to known admin subnets or VPN-only.
• Block macro execution from internet-sourced Office files (Mark-of-the-Web policy) and disable winword.exe/excel.exe child process creation where feasible.
• Alert on shadow copy deletion (deploy the Sigma rule above) — it is the highest-signal pre-encryption tripwire.
• Audit unauthorized RMM tools (AnyDesk, ScreenConnect, Splashtop) and block their execution where not sanctioned.
• Verify backup immutability and confirm at least one offline or logically air-gapped copy per critical system.

Short-term (2 weeks)

• Segment the virtualization plane: vCenter and hypervisor management interfaces on a dedicated, jump-host-only management network — a vCenter compromise is a whole-estate encryption event.
• Deploy tiered administration: no domain admin logons to workstations or member servers; LAPS for local admin; gMSA for service accounts.
• Egress filtering by default on server segments, with alerting on large outbound transfers to unsanctioned storage/VPS destinations (the exfil channel double extortion depends on).
• EDR in block mode on all servers, not just endpoints, with tamper protection enforced.
• Hunt retroactively using the KQL query above across 30 days of telemetry — crews in this tier often sit quiet before posting.
• Tabletop the leak-site scenario: decide now who monitors for your organization's name on gang sites, who owns external communications, and how you will respond to a false or unverifiable claim — because claims and breaches are not the same thing, and your response to each differs.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub