Classification: TLP:CLEAR | Publication Date: 2026-10-16 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 17 Leak-Site Listings in 4 Days — Cross-Sector Campaign Analysis & Detection Rules

Executive Summary

Monitoring of N0N's .onion leak site, aggregated via ransomware.live, shows a sharp burst of activity between 2026-10-13 and 2026-10-16: 17 new victim listings in roughly four days, spanning healthcare, technology, professional services, retail & e-commerce, and financial services across the US, Egypt, the Netherlands, and Brazil. Named organizations in the latest postings include Evolution Spine / All Labs, Interior Technologies, Trieschmann Dumala Architectural Group, and Hunter Neurology — all of which N0N claims to have compromised. These are threat-actor claims, not confirmed breaches.

The posting cadence — multiple listings per day across three consecutive days — suggests either a batch-detonation event following a period of quiet intrusion, or an affiliate-driven surge. Healthcare appears twice among the named listings (Evolution Spine / All Labs, Hunter Neurology), a pattern consistent with double-extortion economics where regulated-data holders face maximum pressure to pay. Security teams in the targeted sectors should treat this as an active-campaign signal and run the detection content in this briefing now, not after a confirmation lands in the news cycle.

Sourcing & Verification

Of the 17 listings tracked in this reporting window:

• 7 listings were independently observed by a second leak-site crawler (MULTI-SOURCE). This confirms only that N0N published the claim — not that any intrusion occurred.
• 10 listings appear on a single monitoring source (ransomware.live) only (SINGLE-SOURCE), meaning no second crawler has confirmed the posting even exists on the gang's site.

Critical caveats for every reader and every named organization:

• Inclusion on a leak site reflects the threat actor's claim. It is not confirmation of a breach, at any corroboration tier.
• A named organization may dispute a listing, and a denial is likewise not proof the claim is false. Disclosure obligations vary by jurisdiction and sector, and not every incident is reportable — neither silence nor denial settles the question. Only the organization or its regulator can confirm an incident.
• Security Arsenal will publish corrections promptly and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

N0N is a relative newcomer to the ransomware ecosystem, and public reporting on the group remains thin. The following profile is assembled from leak-site behavior and observed campaign characteristics; treat specifics as provisional until further telemetry emerges.

• Aliases / branding: Operates publicly as "N0N." No confirmed rebrand lineage to a prior family has been established, though the leak-site infrastructure and posting template style are consistent with actors who have recycled tooling from defunct RaaS programs.
• Operating model: Current evidence points toward a closed or semi-closed group rather than an open RaaS with a large affiliate base. The clustered posting cadence (batch releases) is typical of a core team staging multiple intrusions in parallel rather than drip-feeding independent affiliate work.
• Ransom demands: No verified demand figures are public. Based on victim sector mix (mid-market healthcare, professional services, technology), demands are likely calibrated to the low-to-mid seven figures, with negotiation room typical of newer groups trying to build a payment reputation.
• Initial access methods (assessed): Sector overlap with actively exploited edge-device and management-plane CVEs suggests the group favors exploitation of internet-facing infrastructure — VPN/firewall appliances, virtualization management (vCenter), and CI/CD servers — supplemented by credential-based access (VPN/RDP) and phishing. See the CVE analysis below; this linkage is a hypothesis, not attribution for any named victim.
• Extortion model: Double extortion. Data is exfiltrated before encryption and threatened for publication on the leak site; the "Company #NN" anonymized naming convention indicates a countdown/pressure tactic where unnamed victims are given a negotiation window before identification.
• Dwell time: Unknown for this group specifically. Sector baselines for comparable double-extortion actors run 5–14 days from initial access to detonation, with exfiltration typically beginning 48–72 hours before encryption. Defenders should assume they may already be inside the dwell window if edge devices were exposed to the CVEs below.

Current Campaign Analysis

Sector Targeting

The 17 listings break down across: healthcare (2 named), technology (1 named), professional services (1 named), retail & e-commerce, and financial services, plus a large block of anonymized "Company #NN" entries whose sectors are withheld pending negotiation. The named-victim mix skews toward data-rich, regulation-burdened mid-market organizations — exactly the profile double-extortion actors prefer: enough revenue to pay, enough regulatory exposure to fear disclosure, and typically thinner security operations than Fortune 500 targets.

Geographic Concentration

The US dominates confirmed-country listings, with secondary presence in Egypt, the Netherlands, and Brazil. This spread is consistent with opportunistic exploitation of exposed edge infrastructure rather than a regionally focused campaign — the gang is likely scanning for vulnerable appliances globally and working whatever lands.

Victim Profile

Based on the named organizations and sector mix, victims appear to cluster in the SMB-to-mid-market band (estimated tens to low hundreds of millions USD annual revenue) — organizations large enough to hold valuable data but often lacking 24/7 SOC coverage. The heavy use of anonymized "Company #NN" listings (at least 11 of 17) suggests an aggressive negotiation-first posture: name-and-shame is the escalation, not the default.

Posting Frequency & Escalation

• 2026-10-13: 3 listings
• 2026-10-14: 2 listings
• 2026-10-15: 5 listings
• 2026-10-16: 3 listings (at time of collection)

This sustained daily cadence over four days is an escalation signature. Two plausible drivers: (1) a batch of intrusions from a single access wave reaching extortion stage simultaneously, or (2) an acquisition of initial access from a broker, with the gang working through a purchased victim pipeline. Either way, expect the listing rate to continue in the near term.

CVE Linkage — Hypothesis, Not Attribution

We have no evidence tying any specific CVE to any specific named victim. What follows is sector-level exposure analysis: N0N's assessed tradecraft (edge-device and management-plane exploitation) overlaps with several vulnerabilities currently on the CISA Known Exploited Vulnerabilities catalog with confirmed ransomware use. If your perimeter includes these products, assume targeting:

• CVE-2026-59310 — VMware vCenter path traversal (KEV 2026-08-18). vCenter compromise is a force multiplier: one foothold yields hypervisor-level access to entire virtual estates — the classic pre-encryption prize.
• CVE-2026-20316 — Cisco Secure FMC hard-coded password (KEV 2026-07-29). Firewall management plane access enables both persistence and traffic manipulation for covert exfiltration.
• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1) (KEV 2026-06-08). VPN gateway compromise maps directly to the credentialless-remote-access pattern seen in this campaign's geographic scatter.
• CVE-2026-63077 — JetBrains TeamCity deserialization (KEV 2026-08-05). CI/CD compromise enables supply-chain-style lateral movement and code signing theft; notable given Interior Technologies (Technology sector) appears in the victim list.
• CVE-2026-48027 — Nx Console embedded malicious code (KEV 2026-05-27). Developer-toolchain poisoning; relevant to technology-sector intrusion paths.

If any of these sit unpatched in your environment, prioritize them above routine patch cadence this week.

Detection Engineering

Sigma Rules

The following rules target the specific TTP chain assessed for this campaign: edge/VPN initial access, living-off-the-land lateral movement (PsExec/WMI), and pre-encryption staging (shadow copy tampering, mass file renames, staged archive creation).

---
title: N0N Campaign - VPN/Firewall Management Plane Anomalous Authentication
id: 7c1f2a10-n0n1-4a2b-9c3d-202610160001
status: experimental
description: Detects successful authentication to VPN/firewall management interfaces from unusual source IPs or at unusual hours, consistent with N0N's assessed edge-device initial access pattern (CVE-2026-50751, CVE-2026-20316 exposure hypothesis).
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
date: 2026/10/16
logsource:
  category: authentication
  product: firewall
  service: vpn
detection:
  selection_success:
    - event.outcome: success
    - action: allowed
  filter_mgmt_interface:
    destination.port:
      - 443
      - 8443
  selection_suspicious:
    - source.ip|cidr:
        - '10.0.0.0/8'
        - '172.16.0.0/12'
        - '192.168.0.0/16'
  condition: selection_success and not selection_suspicious and filter_mgmt_interface
falsepositives:
  - Legitimate remote administration from corporate egress IPs (tune filter to known admin ranges)
level: high
tags:
  - attack.initial_access
  - attack.t1133
  - attack.t1190
---
title: N0N Campaign - PsExec or WMI Remote Service Execution
id: 7c1f2a10-n0n1-4a2b-9c3d-202610160002
status: experimental
description: Detects remote execution via PsExec-style service installation or WMI process creation, a lateral movement technique consistent with pre-encryption staging in double-extortion campaigns.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
date: 2026/10/16
logsource:
  product: windows
  category: process_creation
detection:
  selection_psexec:
    Image|endswith:
      - '\PSEXESVC.exe'
      - '\psexec.exe'
      - '\paexec.exe'
    OriginalFileName: 'psexec.c'
  selection_wmi:
    ParentImage|endswith: '\WmiPrvSE.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\rundll32.exe'
  condition: 1 of selection_*
falsepositives:
  - Legitimate administrative tooling; baseline admin workstation IPs and service accounts
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1047
  - attack.t1569.002
---
title: N0N Campaign - Pre-Encryption Staging and Impact Indicators
id: 7c1f2a10-n0n1-4a2b-9c3d-202610160003
status: experimental
description: Detects Volume Shadow Copy deletion, backup catalog tampering, recovery disabling, and mass archive staging - the final 60 minutes of a ransomware detonation chain as assessed for N0N double-extortion operations.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
date: 2026/10/16
logsource:
  product: windows
  category: process_creation
detection:
  selection_vss:
    CommandLine|contains:
      - 'vssadmin delete shadows'
      - 'vssadmin Delete Shadows'
      - 'wmic shadowcopy delete'
      - 'diskshadow'
  selection_bcdedit:
    CommandLine|contains:
      - 'bcdedit'
      - 'recoveryenabled no'
      - 'ignoreallfailures'
  selection_wbadmin:
    CommandLine|contains:
      - 'wbadmin delete catalog'
      - 'wbadmin delete systemstatebackup'
  selection_staging:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\winrar.exe'
    CommandLine|contains:
      - ' a - '
      - '-p'
      - '-m5'
  condition: selection_vss or selection_bcdedit or selection_wbadmin or selection_staging
falsepositives:
  - Backup software maintenance windows; system administrators provisioning archives
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.t1560.001
  - attack.t1486

Microsoft Sentinel KQL — Lateral Movement & Pre-Staging Hunt

This query hunts the 72-hour pre-detonation window: unusual remote execution patterns followed by shadow copy tampering or archive staging, pivoted by device to surface hosts showing the full kill chain.

// N0N Campaign Hunt: lateral movement -> staging -> impact precursors
// Lookback: 7 days. Tune exclude lists to your admin tooling.
let lookback = 7d;
let AdminUsers = dynamic(["svc_backup", "svc_sccm"]); // tune
let ImpactCmds = dynamic(["vssadmin delete shadows", "wmic shadowcopy delete",
  "bcdedit", "wbadmin delete catalog", "recoveryenabled no"]);
let StagingTools = dynamic(["rar.exe", "7z.exe", "winrar.exe", "megacmd", "rclone"]);
let RemoteExec = DeviceProcessEvents
  | where TimeGenerated > ago(lookback)
  | where (FileName =~ "PSEXESVC.exe")
      or (InitiatingProcessFileName =~ "WmiPrvSE.exe"
          and FileName in~ ("cmd.exe", "powershell.exe", "rundll32.exe"))
      or (ProcessCommandLine has_any (StagingTools))
  | where not(AccountName has_any (AdminUsers))
  | summarize LateralEvents = count(),
              FirstSeen = min(TimeGenerated),
              Commands = make_set(ProcessCommandLine, 20)
    by DeviceName, AccountName;
let Impact = DeviceProcessEvents
  | where TimeGenerated > ago(lookback)
  | where ProcessCommandLine has_any (ImpactCmds)
  | summarize ImpactEvents = count(),
              ImpactCmdsSeen = make_set(ProcessCommandLine, 10),
              ImpactTime = min(TimeGenerated)
    by DeviceName;
RemoteExec
| join kind=inner Impact on DeviceName
| extend KillChainGapMinutes = datetime_diff('minute', ImpactTime, FirstSeen)
| project DeviceName, AccountName, FirstSeen, ImpactTime, KillChainGapMinutes,
          LateralEvents, ImpactEvents, Commands, ImpactCmdsSeen
| order by ImpactTime desc;
// Devices appearing here have BOTH lateral movement AND impact precursors.
// Treat as P1: isolate host, rotate credentials, check exfil egress.

Rapid Response PowerShell — Edge Exposure & Staging Sweep

Run on domain controllers and suspected pivot hosts. Checks for exposed RDP listeners, scheduled tasks created in the last 7 days (a common persistence mechanism), recent shadow copy manipulation, and newly created local admins.

# N0N Rapid Triage Sweep - run elevated. Output: C:\IR\N0N-Triage-<host>-<date>.txt
$out = "C:\IR\N0N-Triage-$env:COMPUTERNAME-$(Get-Date -Format 'yyyyMMdd-HHmm').txt"
New-Item -Path C:\IR -ItemType Directory -Force | Out-Null
"=== N0N Rapid Triage - $env:COMPUTERNAME - $(Get-Date) ===" | Out-File $out

# 1. RDP exposure check
"`n[+] RDP Status & Listeners" | Out-File $out -Append
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue
"RDP Enabled: $(if ($rdp.fDenyTSConnections -eq 0) {'YES - REVIEW EXPOSURE'} else {'No'})" | Out-File $out -Append
Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue |
  Format-Table LocalAddress, LocalPort, State | Out-File $out -Append

# 2. Scheduled tasks created in last 7 days (persistence)
"`n[+] Scheduled Tasks Modified/Created Last 7 Days" | Out-File $out -Append
Get-ScheduledTask | ForEach-Object {
  $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
  $taskPath = "$($_.TaskPath)$($_.TaskName)"
  try {
    $xml = Export-ScheduledTask -TaskName $_.TaskName -TaskPath $_.TaskPath -ErrorAction Stop
    $created = ([xml]$xml).Task.RegistrationInfo.Date
    if ($created -and [datetime]$created -gt (Get-Date).AddDays(-7)) {
      "CREATED $created : $taskPath" | Out-File $out -Append
    }
  } catch {}
}

# 3. Shadow copy status (anti-recovery precursor)
"`n[+] Volume Shadow Copies" | Out-File $out -Append
$shadows = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($shadows) { $shadows | Select-Object InstallDate, VolumeName, ID | Format-Table | Out-File $out -Append }
else { "WARNING: NO SHADOW COPIES FOUND - possible vssadmin deletion or never configured" | Out-File $out -Append }

# 4. New local admins in last 7 days
"`n[+] Local Administrators Group Members (review for additions)" | Out-File $out -Append
Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue |
  Select-Object Name, ObjectClass, PrincipalSource | Format-Table | Out-File $out -Append

# 5. Suspicious staging archives in common staging paths
"`n[+] Large Archives Created Last 7 Days (staging indicator)" | Out-File $out -Append
Get-ChildItem -Path C:\Users, C:\ProgramData, C:\Windows\Temp -Recurse -Include *.zip,*.rar,*.7z -ErrorAction SilentlyContinue |
  Where-Object { $_.CreationTime -gt (Get-Date).AddDays(-7) -and $_.Length -gt 100MB } |
  Select-Object FullName, Length, CreationTime | Format-Table | Out-File $out -Append

# 6. Outbound connections to known exfil tooling ports/hosts snapshot
"`n[+] Established Outbound Connections (non-ephemeral review)" | Out-File $out -Append
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
  Where-Object { $_.RemotePort -in 21,22,443,993,1415,25565 -and $_.RemoteAddress -notmatch '^(10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.)' } |
  Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess |
  Sort-Object RemoteAddress | Format-Table | Out-File $out -Append

"`n[+] Sweep complete: $out" | Out-File $out -Append
Write-Host "Triage output written to $out"

Incident Response Priorities

T-Minus Detection Checklist (Before Encryption Fires)

N0N's assessed playbook follows the standard double-extortion sequence. You can catch it in the dwell window if you know where to look:

• T-minus 5–10 days: Anomalous VPN/firewall management-plane logins, especially from IPs with no prior history against the device; new local or domain accounts; suspicious logon type 3/10 bursts against RDP.
• T-minus 72 hours: PsExec/WMI process trees on servers that never see admin tooling; WmiPrvSE.exe spawning shells; Cobalt Strike-style beaconing (regular-interval HTTPS to low-reputation domains).
• T-minus 24–48 hours: Large archive creation in C:\ProgramData or user profiles; rclone/MEGAcmd/FTP clients appearing on servers; egress spikes to cloud storage or bulletproof hosts.
• T-minus 60 minutes: vssadmin delete shadows, bcdedit recovery tampering, wbadmin delete catalog. If you see this, you are in the detonation window — isolate the network segment immediately, do not wait for change control.

Assets This Campaign Profile Prioritizes for Exfiltration

Based on the sector mix (healthcare, professional services, technology):

• EHR/PHI stores and medical imaging archives (healthcare listings) — maximum regulatory pressure value.
• File servers holding client deliverables and contracts (professional services) — third-party liability leverage.
• Source code repositories, CI/CD artifacts, and signing certificates (technology) — resale and supply-chain leverage.
• Backup infrastructure itself — both to destroy recovery options and because backup catalogs reveal where the sensitive data lives.

Containment Actions, Ordered by Urgency

1. Isolate at the network layer, not the host layer. Disable switch ports / apply VLAN quarantine for affected segments. Pulling power destroys volatile evidence; firewalling does not.
2. Disable VPN concentrators and management-plane interfaces from internet exposure until credential integrity is verified — assume edge-device credentials are compromised if you match the CVE exposure profile.
3. Force-rotate privileged credentials in this order: domain admin → service accounts → local admins → VPN/firewall device accounts. Do not rotate from a potentially compromised workstation.
4. Block exfil egress at the perimeter: deny outbound to consumer cloud storage, Tor, and non-corporate FTP/SFTP; alert on any single host moving >50GB outbound in 24h.
5. Preserve forensic evidence before remediation: memory capture on suspected pivot hosts, VPN/firewall logs off-box, authentication logs for the full dwell window (14 days minimum).
6. Verify backup integrity offline before announcing recovery — the gang's playbook assumes backups exist and targets them.

Hardening Recommendations

Immediate (24 Hours)

• Patch or isolate the KEV-listed edge devices: CVE-2026-50751 (Check Point), CVE-2026-20316 (Cisco FMC), CVE-2026-59310 (vCenter), CVE-2026-63077 (TeamCity), CVE-2026-48027 (Nx Console). If patching cannot complete in 24 hours, remove the management interface from internet reachability entirely — ACL it to a jump host.
• Enforce phishing-resistant MFA (FIDO2/passkeys) on all remote access. Credential-based VPN entry is a top assessed vector for this campaign.
• Disable RDP on the internet perimeter. Full stop. If business-required, move it behind VPN + MFA with account lockout and geo-fencing.
• Deploy the Sigma rules above to your SIEM and confirm the vssadmin/bcdedit rule pages the on-call phone, not a mailbox.
• Enable tamper protection on EDR and verify shadow copies exist on critical servers (the triage script above checks this).

Short-Term (2 Weeks)

• Segment backup infrastructure onto a separate management plane with its own credentials, no domain trust, and immutable/air-gapped copies. Recovery from a double-extortion event lives or dies here.
• Implement egress filtering with default-deny for server VLANs — servers rarely need arbitrary outbound internet. This kills both exfil and Cobalt Strike C2.
• Deploy application allowlisting on servers (WDAC/AppLocker) blocking unsigned binaries in user-writable paths — breaks the rclone-from-Temp staging pattern.
• Build a leak-site monitoring watch for your organization and key subsidiaries (Security Arsenal's AlertMonitor covers this), so you learn about a claim from your SOC before you learn it from a journalist.
• Tabletop the "named on a leak site" scenario with legal and comms: decide in advance who validates the claim, who notifies regulators, and what the public posture is if the claim is false. Organizations that improvise this under pressure make it worse.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub