N0N Ransomware Gang: 17 New Leak-Site Claims in 4 Days — Sector Targeting Analysis, Detection Rules & IR Playbook

Classification: TLP:CLEAR | Publication Date: 2026-10-25 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

Executive Summary

Between 2026-10-22 and 2026-10-24, the N0N ransomware operation listed 17 organizations on its dark web leak site — the group's highest sustained posting cadence we have recorded in a rolling 100-posting window. The claims span manufacturing, healthcare, technology, energy & utilities, and retail/e-commerce across eight countries (PT, AR, US, ES, ET, TN, CH, BG), including five listings where the gang withheld the victim name entirely ("Company #105" through "Company #110"), a pressure tactic consistent with active double-extortion negotiation.

Critical caveat up front: every entry below is a claim made by a criminal organization on a leak site. None of these listings confirms a breach occurred. Sixteen of the 17 listings were independently observed by a second leak-site crawler — meaning we are confident the gang posted the claims — but only the named organizations or their regulators can confirm whether an intrusion actually happened.

Defenders in the affected sectors should treat this briefing as a pre-positioning opportunity: the detection content below targets N0N's known tradecraft and is deployable regardless of whether any specific claim proves out.

Sourcing & Verification

• Corroboration status: 16 of 17 listings in this dataset were independently observed by a second leak-site crawler (tagged [MULTI-SOURCE]). One listing appears on a single crawler only. Multi-source corroboration confirms the gang made the claim — it does not confirm the claim is true.
• Claims, not confirmations: Inclusion in this briefing reflects the threat actor's assertion and is not confirmation of a breach, ransomware detonation, or data theft at any named organization.
• Disputes and denials: A named organization may dispute its listing. A denial is likewise not proof the claim is false — disclosure obligations vary by jurisdiction and sector, and not every incident is legally reportable. Neither silence nor denial settles the question; only the organization or its regulator can confirm an incident.
• Corrections: Security Arsenal will publish corrections promptly. We welcome contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

N0N operates as a closed ransomware collective rather than a broadly franchised RaaS platform — our monitoring shows consistent operator tooling and infrastructure reuse rather than the churn of affiliate-branded payloads typical of open RaaS programs. Key characteristics from our tracking of the group:

• Extortion model: Double extortion. Victims are listed on the leak site with countdown timers, followed by staged data publication. The five anonymized "Company #NNN" listings in this batch are consistent with victims in active negotiation whose identity is withheld as leverage.
• Ransom demands: Proportionate to estimated victim revenue, typically ranging from low six figures for small manufacturers and clinics to seven figures for multi-site enterprises, payable in Monero or Bitcoin.
• Initial access (historical, not attributed to any specific victim below): Exploitation of exposed remote access (VPN concentrators, RDP), spearphishing with macro-laden attachments, and compromised credentials purchased from initial access brokers. The group has also been observed abusing supply-chain and developer-tooling compromise paths.
• Dwell time: Observed dwell time before detonation has averaged 4–11 days, with the encryption stage typically executed during weekend or overnight windows — consistent with the Thursday–Friday posting cluster in this campaign.
• Post-compromise tooling: PsExec and WMI for lateral movement, Cobalt Strike for C2, scheduled tasks for persistence, and Volume Shadow Copy deletion via vssadmin/wbadmin immediately prior to detonation.

Current Campaign Analysis

Sector Targeting

From the 17 listings in the current batch:

Manufacturing remains the gang's anchor sector — consistent with ransomware-economy logic: production halts create immediate, quantifiable financial pressure and these organizations often run legacy OT-adjacent Windows estates with slower patch cadence. The healthcare listings (a US specialty clinic and an Argentine medical assistance firm) fit the pattern of targeting mid-size providers where HIPAA/GDPR exposure raises extortion leverage without triggering the scrutiny that comes with hospital-scale incidents.

Geographic Concentration

The claims span PT, AR, US, ES, ET, TN, CH, and BG. This is notably dispersed — no single-country concentration — which suggests opportunistic initial access (whatever VPN/RDP/phishing entry points were available) rather than a geopolitically targeted campaign. The presence of claims against organizations in Ethiopia, Tunisia, and Bulgaria is consistent with the gang pricing demands to local market conditions.

Victim Profile

Based on sector and the named organizations' public footprints, the claimed victims skew toward small-to-mid-market enterprises — single-site manufacturers, specialty medical practices, regional dealers, and mid-size engineering firms. Estimated revenue range is roughly $5M–$150M annually. This is the classic N0N sweet spot: large enough to pay six-to-seven-figure demands, small enough to lack 24/7 SOC coverage and formal IR retainers.

Posting Frequency & Escalation

The 17 claims were published across just three dates (2026-10-22 through 2026-10-24) — 1 listing on the 24th cluster precedes batches of 4–6 per day. This compressed cadence, combined with six anonymized listings, suggests the gang is either (a) burning through a backlog of compromised networks purchased from access brokers, or (b) deliberately flooding the leak site to pressure concurrent negotiations. Watch for the anonymized listings to be named or data-dropped over the next 7–14 days.

CVE Exposure Context — Hypothesis Only

We have no evidence linking any specific CVE to any specific listing above. However, N0N's historical initial-access tradecraft overlaps with several vulnerabilities currently on CISA's Known Exploited Vulnerabilities list with confirmed ransomware use. Organizations in the targeted sectors should treat the following as priority patch/verification items — framed explicitly as sector-level exposure hypothesis, not victim attribution:

• CVE-2026-50751 (Check Point Security Gateway, improper authentication in IKEv1): Edge-VPN compromise is N0N's most consistent entry path. Any unpatched gateway is a standing invitation.
• CVE-2026-20316 (Cisco Secure FMC, hard-coded password): Network-infrastructure compromise enables the traffic visibility and lateral reach the gang uses for exfiltration staging.
• CVE-2026-59310 (VMware vCenter, path traversal): vCenter access enables mass hypervisor-level encryption — the highest-impact detonation pattern.
• CVE-2026-63077 (JetBrains TeamCity, deserialization RCE): CI/CD compromise fits the group's developer-tooling interest and provides code-signing and deployment pipeline access.
• CVE-2026-48027 (Nx Console, embedded malicious code): A supply-chain vector consistent with the technology-sector listing in this batch.

Detection Engineering

The following content targets N0N's documented TTPs: VPN/RDP initial access, macro execution, PsExec/WMI lateral movement, Cobalt Strike C2, data staging, and shadow copy deletion pre-encryption.

---
title: N0N Ransomware - PsExec/WMI Remote Service Execution for Lateral Movement
id: 8f3a1c2e-n0n0-4a7b-9c1d-202610250001
status: production
description: Detects remote service creation and execution patterns consistent with N0N's use of PsExec and WMI for lateral movement prior to ransomware detonation. Alerts on ADMIN$ share writes combined with new service installation or WMI process creation from non-admin workstation segments.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
  - https://attack.mitre.org/techniques/T1021/002/
  - https://attack.mitre.org/techniques/T1047/
date: 2026/10/25
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec:
    Image|endswith:
      - '\PSEXESVC.exe'
      - '\psexec.exe'
    ParentImage|endswith: '\services.exe'
  selection_wmi_remote:
    ParentImage|endswith: '\WmiPrvSE.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\rundll32.exe'
      - '\mshta.exe'
  selection_service_install:
    EventID: 7045
    ServiceFileName|contains:
      - 'ADMIN$'
      - '\\%COMSPEC%'
      - 'PSEXESVC'
  condition: selection_psexec or selection_wmi_remote or selection_service_install
falsepositives:
  - Legitimate administrative PsExec use by IT teams
  - SCCM/Intune remote management
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1047
---
title: N0N Ransomware - Volume Shadow Copy Deletion Pre-Encryption Staging
id: 8f3a1c2e-n0n0-4a7b-9c1d-202610250002
status: production
description: Detects deletion or resizing of Volume Shadow Copies via vssadmin, wbadmin, wmic, or PowerShell WMI/CIM — a near-universal N0N pre-detonation action executed minutes to hours before encryption. Combined with boot config tampering detection.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
  - https://attack.mitre.org/techniques/T1490/
date: 2026/10/25
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'resize shadowstorage'
  selection_wbadmin:
    Image|endswith: '\wbadmin.exe'
    CommandLine|contains:
      - 'delete catalog'
      - 'delete systemstatebackup'
  selection_wmic_shadow:
    Image|endswith:
      - '\wmic.exe'
      - '\powershell.exe'
    CommandLine|contains:
      - 'shadowcopy delete'
      - 'Win32_ShadowCopy'
      - 'Get-WmiObject Win32_ShadowCopy | Remove'
  selection_bcdedit:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'ignoreallfailures'
  condition: 1 of selection_*
falsepositives:
  - Legitimate backup maintenance scripts (rare with delete syntax)
level: critical
tags:
  - attack.impact
  - attack.t1490
---
title: N0N Ransomware - Data Staging and Exfiltration via Compressed Archives and Cloud Sync Tools
id: 8f3a1c2e-n0n0-4a7b-9c1d-202610250003
status: production
description: Detects mass archive creation and execution of dual-use exfiltration tools (rclone, MEGAsync, WinSCP scripting) consistent with N0N's double-extortion staging phase. High-volume 7z/rar compression on servers followed by outbound transfer tools is a strong pre-leak indicator.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
  - https://attack.mitre.org/techniques/T1560/001/
  - https://attack.mitre.org/techniques/T1567/002/
date: 2026/10/25
logsource:
  category: process_creation
  product: windows
detection:
  selection_compression:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
      - '\winrar.exe'
    CommandLine|contains:
      - ' a '
      - ' -p'
      - ' -mhe'
  selection_exfil_tools:
    Image|endswith:
      - '\rclone.exe'
      - '\MEGAsync.exe'
      - '\FileZilla.exe'
      - '\winscp.com'
      - '\curl.exe'
    CommandLine|contains:
      - 'copy'
      - 'sync'
      - 'move'
      - '--transfers'
      - '/upload'
  filter_admin_workstations:
    Computer|startswith: 'ITADMIN-'
  condition: (selection_compression or selection_exfil_tools) and not filter_admin_workstations
falsepositives:
  - Legitimate backup jobs using 7z
  - Approved rclone sync jobs (baseline and allowlist destinations)
level: high
tags:
  - attack.collection
  - attack.exfiltration
  - attack.t1560.001
  - attack.t1567.002

// N0N Hunt: Lateral movement + pre-ransomware staging correlation (Microsoft Sentinel)
// Looks for hosts exhibiting BOTH suspicious remote execution AND shadow copy / staging indicators
// within a 7-day window — the gang's observed dwell-time signature.
let Lookback = 7d;
let SuspiciousRemoteExec =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where InitiatingProcessParentFileName =~ "WmiPrvSE.exe"
       or (FileName =~ "PSEXESVC.exe")
       or (ProcessCommandLine has_any ("shadowcopy delete", "delete shadows",
            "recoveryenabled no", "resize shadowstorage"))
    | summarize RemoteExecEvents = count(),
                FirstSeen = min(TimeGenerated),
                LastSeen = max(TimeGenerated),
                Commands = make_set(ProcessCommandLine, 10)
         by DeviceName, AccountName;
let StagingIndicators =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName in~ ("7z.exe", "7za.exe", "rar.exe", "rclone.exe",
         "MEGAsync.exe", "winscp.com")
       or (ProcessCommandLine has_any ("vssadmin", "wbadmin delete"))
    | summarize StagingEvents = count(),
                StagingTools = make_set(FileName, 10)
         by DeviceName, AccountName;
SuspiciousRemoteExec
| join kind=inner StagingIndicators on DeviceName
| extend RiskScore = RemoteExecEvents + (StagingEvents * 3)
| project DeviceName, AccountName, FirstSeen, LastSeen,
          RemoteExecEvents, StagingEvents, StagingTools, Commands, RiskScore
| order by RiskScore desc;

# Security Arsenal - N0N Rapid Triage Script
# Run on suspected hosts. Checks: shadow copies, recent scheduled tasks,
# exposed RDP listeners, and new local admin accounts (last 7 days).
# TLP:CLEAR | 2026-10-25

$cutoff = (Get-Date).AddDays(-7)
$report = @{}

Write-Host "[1/5] Volume Shadow Copies (expect non-zero on protected volumes)" -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
$report.ShadowCopyCount = @($shadows).Count
if ($report.ShadowCopyCount -eq 0) {
    Write-Warning "NO shadow copies found - consistent with pre-encryption deletion (T1490)."
}

Write-Host "[2/5] Scheduled tasks created/modified in last 7 days" -ForegroundColor Cyan
$report.RecentTasks = Get-ScheduledTask | Where-Object {
    $_.Date -gt $cutoff -and $_.TaskPath -notlike '\Microsoft*'
} | Select-Object TaskName, TaskPath, Date, @{N='Action';E={$_.Actions.Execute}}
$report.RecentTasks | Format-Table -AutoSize

Write-Host "[3/5] RDP exposure check" -ForegroundColor Cyan
$rdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server' `
    -Name fDenyTSConnections -ErrorAction SilentlyContinue).fDenyTSConnections
$rdpListening = Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue
$report.RDPEnabled = ($rdpEnabled -eq 0)
$report.RDPListening = [bool]$rdpListening
if ($report.RDPListening) {
    Write-Warning "RDP is LISTENING on 3389. Verify NLA + gateway-only access."
}

Write-Host "[4/5] Failed logon burst check (brute-force indicator, 4625, last 24h)" -ForegroundColor Cyan
$failed = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; `
    StartTime=(Get-Date).AddDays(-1)} -ErrorAction SilentlyContinue
$report.FailedLogons24h = @($failed).Count
if ($report.FailedLogons24h -gt 100) {
    Write-Warning "$($report.FailedLogons24h) failed logons in 24h - possible brute force."
}

Write-Host "[5/5] Local administrators changed in last 7 days" -ForegroundColor Cyan
$report.AdminChanges = Get-WinEvent -FilterHashtable @{LogName='Security'; `
    Id=4732,4728,4756; StartTime=$cutoff} -ErrorAction SilentlyContinue |
    Select-Object TimeCreated, Id, Message
$report.AdminChanges | Format-List

$report | ConvertTo-Json -Depth 4 | Out-File ".\n0n_triage_$(Get-Date -Format 'yyyyMMdd_HHmm').json"
Write-Host "Report written. Escalate any warnings to IR immediately." -ForegroundColor Green

Incident Response Priorities

T-Minus Detection Checklist (Before Encryption Fires)

N0N's observed playbook gives defenders a 4–11 day window. In priority order:

1. Shadow copy deletion commands — the single highest-fidelity pre-detonation signal. Any vssadmin delete shadows on a server is a page-the-oncall event.
2. New service installations on servers via ADMIN$ (Event ID 7045) — PsExec staging for mass deployment.
3. Archive tool execution on file servers or database hosts — 7z/rar with password flags (-p, -mhe) indicates exfil staging for the extortion phase.
4. rclone/MEGAsync/WinSCP execution from servers — N0N does not exfiltrate from workstations; it stages from servers.
5. Cobalt Strike indicators — named pipes matching \\.\pipe\MSSE-* or \\.\pipe\status_*, and beacon-like periodic HTTPS to low-reputation domains.
6. Anomalous WMI child processes (WmiPrvSE spawning cmd/powershell/rundll32) across multiple hosts within the same hour — lateral sweep in progress.

Assets This Gang Prioritizes for Exfiltration

Based on observed double-extortion data drops across past N0N campaigns:

• HR and payroll data (PII maximizes regulatory pressure, especially for the healthcare and EU-listed claims in this batch under GDPR)
• Financial records, contracts, and invoices — used to calculate demand size and embarrass the victim
• For manufacturers specifically: CAD files, product designs, and customer order books
• Email archives of executives — mined for negotiation leverage
• Backup catalogs — the gang enumerates backup infrastructure early; assume Veeam/Commvault credentials are targeted within 48 hours of entry

Containment Actions — Ordered by Urgency

1. Isolate, don't power off suspected hosts — preserve memory for forensics; network isolation stops C2 and spread without destroying evidence.
2. Disable the compromised identity tier — force password resets for any account observed in lateral movement telemetry; revoke active sessions and tokens.
3. Block outbound at the edge to known exfil destinations (rclone remotes, MEGA, anonymous file-sharing); allowlist-only egress for servers.
4. Take backups offline/immutable immediately — if shadow copy deletion fired, online backups are the next target.
5. Patch the edge — Check Point (CVE-2026-50751), Cisco FMC (CVE-2026-20316), vCenter (CVE-2026-59310) before re-enabling external access.
6. Engage IR counsel before any negotiation contact — and do not assume a leak-site claim is authentic without internal telemetry corroboration; gangs have listed victims they never breached.

Hardening Recommendations

Immediate (24 Hours)

• Verify patch status on all KEV items listed above, prioritizing Check Point gateways and Cisco FMC — edge device compromise is this gang's most reliable door. If you cannot patch immediately, take IKEv1-disabled or VPN-offline measures.
• Disable or restrict RDP to gateway-only access with NLA enforced; audit for any host listening on 3389 that is not in the approved inventory (use the triage script above).
• Enable tamper protection and restricted shadow copy deletion — alert on any vssadmin/wbadmin/bcdedit execution on servers.
• Enforce MFA on all remote access and email — no exceptions for service accounts; N0N's phishing-to-credential path dies here.
• Deploy the Sigma rules and KQL hunt above and run a retro-hunt over the last 14 days, matching the gang's maximum observed dwell time.
• Block macro execution from internet-sourced Office files via Mark-of-the-Web group policy if not already done.

Short-Term (2 Weeks)

• Segment OT/production networks from IT for manufacturers — the gang's encryption wave crosses flat networks in minutes. N0N targets manufacturing precisely because segmentation is rare.
• Implement application allowlisting on servers (7z/rar/rclone should not execute on file servers without an approved task context).
• Move to immutable, air-gapped, or logically isolated backups with restore testing — assume the online backup tier will be attacked.
• Deploy egress filtering with allowlist-only outbound for server VLANs — the double-extortion model fails if data can't leave.
• Establish a detection-as-code pipeline for the Sigma rules above so future N0N-relevant rules deploy in hours, not weeks.
• Tabletop the leak-site scenario — executives should rehearse the decision tree for a criminal claim appearing publicly before verification is complete, including comms, legal, and regulatory-notification decision points. The "Company #NNN" anonymized pressure tactic in this campaign is exactly the scenario to rehearse.

Security Arsenal monitors ransomware leak sites continuously. All victim listings referenced in this briefing are unverified threat-actor claims. Named organizations are encouraged to contact us at security@securityarsenal.com.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub