Classification: TLP:CLEAR | Publication Date: 2026-11-03 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 16 Organizations Named in Two-Day Posting Surge — Targeting Analysis & Detection Rules

Executive Summary

Between 2026-11-02 and 2026-11-03, the ransomware group N0N published 16 organization listings on its dark web leak site — an unusually compressed posting cadence that suggests either a coordinated intrusion campaign hitting multiple victims in parallel, or a batch dump of intrusions completed earlier and released for maximum psychological pressure. The named organizations are concentrated in the United States (9 of 15 with country data), with additional listings tied to Saudi Arabia, the United Arab Emirates, and Malaysia. Sector attribution in the gang's own postings is sparse — the majority of listings carry no sector tag — with technology the only explicitly identified vertical.

Every listing in this dataset is an unverified accusation by a criminal actor. Inclusion on a leak site is not evidence of compromise. However, the posting volume itself — 16 claims in 48 hours — is a behavioral signal worth acting on regardless of whether any individual claim is true. Organizations in the US and Gulf region, particularly in technology and IT services, should treat this as a forcing function to validate edge-device patching (VPN, firewall, vCenter), audit scheduled tasks and shadow copy integrity, and confirm their SOC can detect pre-encryption staging behavior. Detection content is included below.

Sourcing & Verification

This briefing is built from ransomware.live monitoring of N0N's onion leak site, with the following verification posture:

• 15 of 16 listings were independently observed by a second leak-site crawler (tagged MULTI-SOURCE). This means two independent collection pipelines confirmed the gang posted the claim — it does not confirm any intrusion occurred.
• 1 listing appears on a single source only and has not been independently corroborated by a second crawler.
• Inclusion in this briefing reflects the threat actor's claim. It is not confirmation of a breach. No tier in our data — including multi-source observation — verifies that an intrusion, data theft, or encryption event actually took place.
• A named organization may dispute the listing. A denial is likewise not proof the claim is false: disclosure obligations vary by jurisdiction and sector, not every incident is reportable, and organizations under active negotiation or investigation often cannot comment. Neither silence nor denial settles the question; only the organization itself or its regulator can confirm an incident.
• Security Arsenal will publish corrections as facts change and welcomes contact from any named organization at security@securityarsenal.com.

Per our sourcing rules, we are deliberately not attaching the specific published organization identifiers in the body of this analysis. The gang's leak site listed 16 entities (internally indexed #113–#127 in our collection) with minimal self-reported metadata; none of those claims have been confirmed by the organizations involved.

Threat Actor Profile — N0N

N0N is a relatively low-signature operation in the current ransomware ecosystem compared to established brands, and its leak-site behavior is consistent with a mid-tier extortion crew rather than a mature, franchise-scale RaaS.

Attribution caveat: N0N is not currently linked with confidence to any better-documented brand. Treat the profile above as provisional and update as negotiation-site samples, ransom notes, or encryptor binaries become available.

Current Campaign Analysis

Sector targeting

The gang's own metadata is thin: the majority of listings carry no sector tag at all, with technology the only explicitly identified vertical. A high proportion of 'Not Found' sector fields is itself a signal — either the gang did minimal victim research before posting (suggesting opportunistic, access-broker-style volume rather than deliberate vertical targeting), or it is withholding sector detail as a negotiation tactic. Absent richer metadata, the honest analytical read is: technology is the one confirmed vertical of interest; everything else is unresolved.

Geographic concentration

Of the 15 listings with country data: the United States dominates (9 listings), with Saudi Arabia, the UAE, and Malaysia also represented. This US-plus-Gulf pattern is consistent with crews exploiting perimeter appliances in regions with high technology-sector density and, in the Gulf cases, organizations whose disclosure regimes make quiet payment more attractive than public incident handling. Malaysia's single appearance may be opportunistic spillover rather than deliberate regional focus.

Victim profile

With sector data largely absent, firm revenue estimation is not possible and we decline to invent it. The general pattern for crews at N0N's apparent maturity tier is small-to-midsize enterprises — organizations large enough to pay a meaningful ransom but small enough to lack 24/7 detection. Nothing in this dataset contradicts that baseline.

Posting frequency and escalation pattern

The 48-hour, 16-listing surge is the most analytically significant feature of this dataset. Two plausible explanations:

1. Campaign-style batch compromise — a single exploit chain (e.g., a perimeter CVE) run at scale against many targets, with victims posted as access is validated.
2. Pressure-driven batch release — intrusions from prior weeks posted simultaneously to manufacture momentum, inflate the gang's apparent operational tempo, and pressure negotiating victims.

Both hypotheses have the same defensive implication: whatever initial access vector N0N is using, it appears to work repeatedly, so assume it is still working.

CVE exposure hypothesis (NOT victim-confirmed)

We have no evidence linking any specific named listing to any specific CVE. The following is sector-level exposure analysis only — vulnerabilities on the CISA KEV with confirmed ransomware use that fit the opportunistic, perimeter-first profile a crew like N0N would favor:

• CVE-2026-50751 (Check Point Security Gateway — improper authentication in IKEv1 key exchange): Gateway-level auth bypass is a classic ransomware initial access primitive. Any organization with unpatched Check Point gateways should treat this as urgent independent of N0N.
• CVE-2026-20316 (Cisco Secure FMC — hard-coded password): Hard-coded credentials in firewall management infrastructure give operators both access and a management-plane position for disabling logging before lateral movement.
• CVE-2026-59310 (VMware vCenter — path traversal): vCenter compromise is the single highest-value pre-encryption target in enterprise ransomware — control of the hypervisor layer enables mass VM detonation and wholesale datastore theft.
• CVE-2026-63077 (JetBrains TeamCity — deserialization, unauthenticated RCE): CI/CD compromise yields code-signing material, secrets, and downstream supply-chain reach — highly attractive for technology-sector targets, which is N0N's one confirmed vertical.
• CVE-2026-48027 (Nx Console — embedded malicious code): A supply-chain vector; less typical for a crew of this profile but relevant to developer-heavy technology organizations.

If your perimeter stack includes any of the above and you are unpatched, you are inside the risk envelope for this campaign regardless of whether N0N specifically is the actor who finds you.

Detection Engineering

The rules below target the TTP cluster most consistent with this group's assessed playbook: perimeter exploitation, credential-based lateral movement, pre-encryption staging (shadow copy deletion, mass file access), and data exfiltration staging. Deploy, tune against your baseline, and alert on correlations across rules rather than single-rule hits.

---
title: Volume Shadow Copy Deletion via WMI or VSSAdmin — Pre-Ransomware Staging
id: a11b2c3d-0001-4a11-9a01-n0n0staging001
status: experimental
description: Detects deletion or resize of Volume Shadow Copies via vssadmin, wmic, or PowerShell WMI methods — a near-universal pre-encryption step in ransomware intrusions including mid-tier crew playbooks consistent with N0N.
author: Security Arsenal Threat Intelligence
date: 2026/11/03
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'resize shadowstorage'
  selection_wmic:
    Image|endswith: '\wmic.exe'
    CommandLine|contains: 'shadowcopy'
  selection_ps_wmi:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'Win32_ShadowCopy'
      - '.Delete()'
  condition: 1 of selection_*
falsepositives:
  - Legitimate storage administration (rare; investigate any hit)
level: high
tags:
  - attack.impact
  - attack.t1490
---
title: Lateral Tool Transfer and Remote Execution via ADMIN$ / PsExec-Style Service Creation
id: a11b2c3d-0002-4a11-9a02-n0n0latmov002
status: experimental
description: Detects service creation on remote hosts with binaries staged to ADMIN$ — the PsExec pattern used by ransomware operators for mass encryptor deployment after initial access via VPN or edge-device exploitation.
author: Security Arsenal Threat Intelligence
date: 2026/11/03
logsource:
  product: windows
  service: system
  definition: 'Event ID 7045 (service installed)'
detection:
  selection:
    EventID: 7045
  filter_legit:
    ServiceName|contains:
      - 'SCCM'
      - 'BigFix'
      - 'Tanium'
  selection_suspicious_path:
    ImagePath|contains:
      - 'ADMIN$'
      - '\\C$\\Windows\\Temp'
      - '\AppData\Local\Temp'
  condition: selection and selection_suspicious_path and not filter_legit
falsepositives:
  - Enterprise software deployment tools (tune filter to your EDR/RMM stack)
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002
---
title: Excessive Failed Logons Followed by Success — RDP/VPN Credential Brute Force Precursor
id: a11b2c3d-0003-4a11-9a03-n0n0brute003
status: experimental
description: Detects brute-force patterns against RDP or remote access infrastructure (many 4625 failures from one source followed by a 4624 success) — a common initial access method for crews without exploit capability.
author: Security Arsenal Threat Intelligence
date: 2026/11/03
logsource:
  product: windows
  service: security
detection:
  selection_fail:
    EventID: 4625
    LogonType:
      - 3
      - 10
  timeframe: 10m
  condition: selection_fail | count() by Source_Network_Address > 20
falsepositives:
  - Misconfigured service accounts, legacy scanners (whitelist known internal IPs)
level: medium
tags:
  - attack.credential_access
  - attack.t1110
  - attack.t1078

// Hunt: Pre-ransomware staging behavior correlated within a 24h window on a single host
// Targets the N0N-consistent kill chain: shadow copy tampering + mass file rename + suspicious scheduled task creation
// Deploy in Microsoft Sentinel; alert when 2+ behaviors co-occur on one device
let TimeWindow = 24h;
let ShadowCopyTamper =
    DeviceProcessEvents
    | where TimeGenerated > ago(TimeWindow)
    | where ProcessCommandLine has_any ("delete shadows", "shadowcopy", "Win32_ShadowCopy", "resize shadowstorage")
    | summarize ShadowEvents = count() by DeviceName, bin(TimeGenerated, 1h);
let SuspiciousTasks =
    DeviceEvents
    | where TimeGenerated > ago(TimeWindow)
    | where ActionType == "ScheduledTaskCreated"
    | extend TaskName = tostring(parse_json(AdditionalFields).TaskName)
    | where TaskName !has_any ("Microsoft", "Google", "Mozilla", "Adobe", "OneDrive")
    | summarize TaskEvents = count(), TaskNames = make_set(TaskName) by DeviceName, bin(TimeGenerated, 1h);
let MassFileOps =
    DeviceFileEvents
    | where TimeGenerated > ago(TimeWindow)
    | where ActionType in ("FileRenamed", "FileModified")
    | summarize FileOps = count(), DistinctExtensions = dcount(tostring(split(FileName, ".")[-1])) by DeviceName, bin(TimeGenerated, 1h)
    | where FileOps > 500 and DistinctExtensions > 10;
ShadowCopyTamper
| join kind=inner SuspiciousTasks on DeviceName
| project DeviceName, ShadowEvents, TaskEvents, TaskNames, TimeGenerated
| join kind=inner MassFileOps on DeviceName
| project DeviceName, ShadowEvents, TaskEvents, TaskNames, FileOps, DistinctExtensions
| order by FileOps desc

# Rapid-response audit: exposed RDP, shadow copy integrity, and scheduled tasks added in last 7 days
# Run elevated on suspect hosts or via your EDR's live-response shell
# Output: consolidated JSON for triage

$report = [ordered]@{}
$report.Hostname = $env:COMPUTERNAME
$report.Timestamp = (Get-Date).ToUniversalTime().ToString('o')

# 1. Is RDP enabled and is NLA enforced?
$rdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$nla = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -ErrorAction SilentlyContinue).UserAuthentication
$report.RDP = @{ Enabled = $rdpEnabled; NLAEnforced = ($nla -eq 1) }

# 2. Shadow copy inventory — ransomware staging typically deletes these
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
$report.ShadowCopies = @{ Count = ($shadows | Measure-Object).Count }
if ($report.ShadowCopies.Count -eq 0) { $report.ShadowCopies.Warning = 'NO SHADOW COPIES PRESENT — possible pre-encryption staging or prior cleanup' }

# 3. Scheduled tasks created in the last 7 days (persistence / detonation staging)
$cutoff = (Get-Date).AddDays(-7)
$recentTasks = Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date -gt $cutoff) } |
    Select-Object TaskName, TaskPath, Date, @{n='Action';a={ $_.Actions.Execute }}
$report.RecentScheduledTasks = @($recentTasks)

# 4. New local admin accounts in the last 7 days
$recentAdmins = Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue | ForEach-Object {
    try {
        $u = Get-LocalUser -Name ($_.Name -split '\\')[-1] -ErrorAction Stop
        if ($u.PasswordLastSet -and $u.PasswordLastSet -gt $cutoff) { $_.Name }
    } catch {}
}
$report.RecentlyModifiedAdmins = @($recentAdmins)

$report | ConvertTo-Json -Depth 5
# Triage: any host with RDP enabled + NLA off + zero shadow copies + new tasks = escalate immediately

Incident Response Priorities

T-minus detection checklist — before encryption fires

If you are investigating a potential N0N-consistent intrusion, check these in order — they map to the pre-detonation phase where you still have time to act:

1. Volume Shadow Copies deleted or resized (vssadmin/wmic/PowerShell) — highest-fidelity pre-encryption indicator.
2. Mass file rename/modify bursts on file servers or VM datastores, especially with changing extensions.
3. New scheduled tasks on multiple hosts within hours of each other — detonation staging.
4. Unexpected service installations (Event 7045) pointing to ADMIN$ or temp paths — encryptor deployment via PsExec-style tooling.
5. Backup infrastructure access anomalies — logins to Veeam/Commvault/console outside change windows, backup job deletions, retention changes.
6. vCenter anomalies — unexplained VM power-offs, snapshot deletions, or new admin sessions (see CVE-2026-59310 exposure).
7. Large outbound transfers to uncommon cloud storage or unfamiliar IPs from servers, not workstations.

Assets historically prioritized for exfiltration

Based on the double-extortion playbook N0N's behavior matches, assume operators will prioritize: finance and HR datastores (payroll, banking details), customer databases and contract repositories, legal and M&A documents, executive mailboxes, and — for technology-sector victims — source code, signing keys, and CI/CD secrets. If you know where your crown-jewel data lives, verify exfiltration controls (DLP egress alerts, unusual-volume detection) on those specific stores first.

Containment actions, ordered by urgency

1. Isolate the affected network segments at the switch/firewall level — do not power off hosts (preserves memory artifacts; detonation may be triggered by shutdown scripts anyway).
2. Disable compromised and suspected-compromised accounts globally, including service accounts — force credential resets from a known-clean admin host.
3. Block edge access paths: disable or restrict VPN concentrators and RDP gateways pending credential audit; rotate Check Point/Cisco FMC credentials if those platforms are in your stack.
4. Protect backups: take backup consoles offline from the production network, verify offline/immutable copies exist and are restorable, snapshot current backup state.
5. Isolate vCenter and hypervisor management behind emergency ACLs; enable MFA on all management-plane access immediately.
6. Engage IR retainer / legal counsel before any communication with the actor; do not access the gang's leak site from corporate infrastructure.

Hardening Recommendations

Immediate (24 hours)

• Patch or mitigate the perimeter CVEs in your stack — CVE-2026-50751 (Check Point), CVE-2026-20316 (Cisco FMC), CVE-2026-59310 (vCenter), CVE-2026-63077 (TeamCity). All are CISA KEV with confirmed ransomware use. If patching is blocked, apply vendor mitigations and restrict management interfaces to jump hosts.
• Enforce MFA on all remote access (VPN, RDP gateways, VDI) with no legacy-protocol exceptions. Crews at N0N's tier overwhelmingly exploit credential-only access paths.
• Audit and re-create Volume Shadow Copies; alert on any deletion (deploy the Sigma rule above today).
• Disable RDP from the internet entirely — verify with external scanning, not internal assumptions.
• Run the PowerShell audit script on critical servers (domain controllers, file servers, backup hosts, vCenter) and triage any host flagged.
• Verify backup immutability and test one restore — an untested backup is a hypothesis.

Short-term (two weeks)

• Segment the network so workstation-to-server and server-to-server lateral movement requires authentication at internal chokepoints; PsExec-style deployment should fail by design between segments.
• Deploy EDR in blocking mode on servers, not just workstations — encryptor detonation almost always lands on servers first.
• Move backup infrastructure to a separate administrative tier with dedicated credentials, no domain trust shortcuts, and immutable storage (object lock or air-gapped).
• Establish egress monitoring with volume baselines — exfiltration before encryption is the extortion lever; detecting the transfer kills the leverage even if encryption succeeds.
• Deploy the Sigma and KQL content above into your SIEM/Sentinel and run a purple-team validation that the detections fire.
• Harden CI/CD infrastructure (TeamCity and peers): isolate build agents, rotate signing keys if any builder was internet-exposed, and inventory secrets reachable from build pipelines.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub