Classification: TLP:CLEAR | Publication Date: 2026-10-25 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 17 New Leak-Site Listings — Sector Targeting Analysis & Detection Rules

Executive Summary

Between 2026-10-22 and 2026-10-24, the ransomware group tracked as N0N published 17 new listings on its dark web leak site, according to monitoring via ransomware.live. The listings name organizations across manufacturing, healthcare, technology, energy & utilities, and retail, spread across at least eight countries (PT, AR, US, ES, ET, TN, CH, BG).

Every listing below is an unverified claim by a criminal actor. Inclusion in this briefing reflects what N0N has posted on its leak site — it does not confirm that any named organization was breached. Nine of the 17 postings were independently observed by a second leak-site crawler (confirming the gang made the claim); eight appear on a single source only. No tier of this data confirms an intrusion.

The posting tempo — 15 listings in a 72-hour window, with a cluster of nine multi-source-observed claims on 2026-10-23/24 — is consistent with a coordinated campaign push or a batch dump from earlier intrusions. Defenders in the named sectors should treat this as a prompt to hunt, not as a confirmed incident list.

Sourcing & Verification

• Corroboration status: 9 of 17 listings were independently observed by a second leak-site crawler (multi-source). 8 listings — including all five anonymized "Company #105–#109" entries, "Company #110"'s single-source peers, and Performance Ford Inc — appear on ransomware.live only, with no second-crawler confirmation that the posting even exists.
• What a listing means: Inclusion reflects the threat actor's claim, published on its own infrastructure. It is not confirmation of a breach. Ransomware gangs exaggerate, recycle old data, and occasionally list organizations they never touched, as an extortion pressure tactic.
• Disputes and denials: A named organization may dispute the listing. A denial is likewise not proof the claim is false — disclosure obligations vary by jurisdiction, not every incident is legally reportable, and legal counsel frequently shapes public statements. Neither silence nor denial settles the question; only the organization or its regulator can confirm an incident.
• Corrections: Security Arsenal will publish corrections to this briefing as warranted. We welcome contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

Attribution caveat: N0N is a low-visibility operation with limited verified public reporting. The profile below combines what is observable from its leak-site behavior with pattern-matching against known mid-tier ransomware operations. Where a trait is assessed rather than confirmed, it is marked.

• Aliases / branding: Operates under the "N0N" name on its Tor-hosted leak site. No publicly documented rebrand lineage has been confirmed; analysts should watch for infrastructure overlap with recently shuttered mid-tier crews, as rebrand churn is common in this tier (assessed, not confirmed).
• Operating model: Behavior is consistent with a small closed group or a low-volume RaaS with a limited affiliate pool (assessed). The mixed, anonymized "Company #NNN" entries alongside fully named victims suggest either multiple affiliates working different pipelines or deliberate withholding of victim names pending negotiation — a hallmark of double-extortion operations.
• Extortion approach: Double extortion — leak-site naming with implied data-theft pressure. The sequential "Company #105–#110" numbering is consistent with staged disclosure: name the victim publicly only after negotiation stalls (assessed from posting structure).
• Ransom demands: No verified demand figures are publicly available for N0N. Comparable mid-tier operations typically demand low-six to low-seven figures USD scaled to victim revenue (sector-norm estimate, not N0N-specific data).
• Initial access methods (assessed): No confirmed N0N-specific access vector is public. Groups at this tier most commonly rely on: (1) exploitation of edge/VPN appliances, (2) phishing with macro- or script-laden attachments, (3) exposed/brute-forced RDP, and (4) purchased access from initial access brokers. The CVE hypotheses below are framed accordingly.
• Dwell time: Unknown for N0N specifically. Industry-wide, median ransomware dwell time has compressed to days (often under one week) from initial access to detonation — which is why the pre-encryption detection window matters more than the encryption event itself.

Current Campaign Analysis

Victim listings (2026-10-22 to 2026-10-24)

Multi-source observed (gang claim confirmed by two independent crawlers; breach unconfirmed):

Single-source (appears on ransomware.live only):

Sector targeting

Manufacturing is the most represented named sector (3 named organizations plus likely some of the anonymized entries), followed by healthcare (2). Technology, energy & utilities, retail, and an NGO round out the set. This spread is characteristic of opportunistic rather than sector-specialized operations — the gang appears to monetize whatever access it or its brokers obtain, with a bias toward mid-market firms whose incident response maturity and cyber insurance posture make them likelier to pay.

Geographic concentration

No single-country concentration. The listings span Southern Europe (PT, ES, BG), the Americas (US, AR), North Africa (TN), the Horn of Africa (ET), and Switzerland (CH). That distribution is a strong indicator of access-broker-driven victimology: the gang buys or accepts whatever footholds are available rather than running a regionally focused intrusion set.

Victim profile

The named organizations skew toward small and mid-market enterprises — regional manufacturers, a specialty medical practice, a car dealership, a regional NGO. This is the classic mid-tier ransomware sweet spot: organizations with meaningful revenue and sensitive data but typically without 24/7 SOC coverage.

Posting tempo and escalation pattern

• 2026-10-22: 6 listings (all single-source, five of them anonymized)
• 2026-10-23: 4 listings (all multi-source, three fully named)
• 2026-10-24: 5 listings (all multi-source, all fully named)

The pattern — a day of anonymized "Company #NNN" entries followed by two days of named disclosures — is consistent with a staged-pressure playbook: post placeholders, then name names as negotiation deadlines expire. Expect the anonymized entries to resolve to named organizations over the coming days; expect additional pressure postings (data samples, countdown timers) against any named organization that has not engaged.

CVE exposure hypotheses (sector-level, NOT victim-specific)

We have no evidence linking any specific CVE to any specific listing above. However, N0N-tier operations are known to exploit exactly the vulnerability classes currently on CISA's Known Exploited Vulnerabilities list with confirmed ransomware use. Organizations in the targeted sectors should treat the following as priority patch/verify items:

• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1). Perimeter-VPN class flaw; the single most common initial-access vector family for opportunistic ransomware. If you run Check Point gateways with IKEv1, assume probing.
• CVE-2026-20316 — Cisco Secure FMC hard-coded password. Management-plane compromise of the firewall stack — hands an attacker both a foothold and visibility into your detection gaps.
• CVE-2026-59310 — VMware vCenter path traversal. Hypervisor management-plane access. Ransomware crews prize vCenter/ESXi access because it enables one-shot encryption of entire virtual estates and destruction of backups co-resident on the same infrastructure.
• CVE-2026-63077 — JetBrains TeamCity deserialization. Build-server compromise = supply-chain foothold plus credential harvesting (TeamCity stores deployment secrets). Relevant to the technology-sector listings.
• CVE-2026-48027 — Nx Console embedded malicious code. Developer-workstation supply-chain exposure; relevant to technology victims and as a credential-theft vector.

Treat these as exposure hypotheses to drive patching and hunting, not as confirmed N0N tradecraft.

Detection Engineering

The detections below target the TTP cluster typical of this gang tier: edge-device exploitation followed by RDP/VPN entry, lateral movement via PsExec/WMI, data staging and exfiltration, and pre-encryption anti-recovery actions (shadow copy deletion, backup tampering).

---
title: RDP Brute Force Followed By Successful Logon - Potential Ransomware Initial Access
id: 7f2a1c4e-9b3d-4e5a-a1c2-n0n0rdp00001
status: production
description: Detects password-spray or brute-force patterns against RDP (multiple failed logons from one source followed by a success). Consistent with opportunistic ransomware initial access as assessed for N0N-tier operations.
author: Security Arsenal Threat Intel
date: 2026/10/25
references:
  - https://securityarsenal.com/darkside
logsource:
  product: windows
  service: security
detection:
  sel_failed:
    EventID: 4625
    LogonType: 10
  sel_success:
    EventID: 4624
    LogonType: 10
  condition: sel_failed | sel_success
# Deploy via a correlation rule: >=10 failures from a single SourceIp within 10m, followed by a success for the same SourceIp within 30m
falsepositives:
  - Legitimate user password mistyping from a remote site
  - Misconfigured service accounts
level: high
tags:
  - attack.initial_access
  - attack.t1110
  - attack.t1021.001
---
title: PsExec or WMI Remote Service Creation - Ransomware Lateral Movement
id: 7f2a1c4e-9b3d-4e5a-a1c2-n0n0lat00002
status: production
description: Detects remote service installation and execution patterns consistent with PsExec-style tooling and WMI-based lateral movement, commonly used by mid-tier ransomware crews to push encryptors and staging tools.
author: Security Arsenal Threat Intel
date: 2026/10/25
references:
  - https://securityarsenal.com/darkside
logsource:
  product: windows
  service: system
detection:
  sel_service:
    EventID: 7045
  sel_image_names:
    ServiceFileName|contains:
      - '\ADMIN$\'
      - 'PSEXESVC'
      - '\Windows\Temp\'
  sel_wmi_child:
    EventID: 7045
    ServiceFileName|contains: 'WmiPrvSE'
  condition: sel_service and (sel_image_names or sel_wmi_child)
falsepositives:
  - Legitimate administrative PsExec use by IT (whitelist known admin hosts)
  - EDR/remote-management tooling
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002
  - attack.t1047
---
title: Volume Shadow Copy Deletion or Backup Tampering - Pre-Encryption Anti-Recovery
id: 7f2a1c4e-9b3d-4e5a-a1c2-n0n0vss00003
status: production
description: Detects deletion of Volume Shadow Copies and disabling of backup/recovery mechanisms via vssadmin, wmic, bcdedit, or wbadmin. A high-fidelity pre-detonation signal for nearly all ransomware families including double-extortion crews like N0N.
author: Security Arsenal Threat Intel
date: 2026/10/25
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  sel_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
      - '\wbadmin.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  sel_cmd:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'resize shadowstorage'
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
      - 'delete catalog'
      - 'Get-WmiObject Win32_Shadowcopy'
      - 'Remove-WmiObject'
  condition: sel_img and sel_cmd
falsepositives:
  - Rare legitimate storage administration; any hit warrants immediate triage
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.defense_evasion

KQL hunt for Microsoft Sentinel — looks for the pre-ransomware staging sequence: a burst of new scheduled tasks or services on multiple hosts from a single source account within a short window (the classic "push everything before detonation" pattern), plus mass file-renaming telemetry as an early encryption tripwire:

// N0N-tier pre-ransomware staging hunt: mass task/service creation + mass file rename
// Security Arsenal - From The Dark Side - 2026-10-25
let Lookback = 7d;
let StagingWindow = 1h;
let TaskServicePush =
    union
        (SecurityEvent
        | where TimeGenerated > ago(Lookback)
        | where EventID == 7045  // new service installed
        | extend Host = Computer, Actor = Account, Indicator = ServiceName),
        (SecurityEvent
        | where TimeGenerated > ago(Lookback)
        | where EventID == 4698  // scheduled task created
        | extend Host = Computer, Actor = Account, Indicator = TaskName);
TaskServicePush
| summarize HostCount = dcount(Host), Hosts = make_set(Host), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by Actor, bin(TimeGenerated, StagingWindow)
| where HostCount >= 5   // one account touching 5+ hosts within an hour
| project TimeGenerated, Actor, HostCount, Hosts, FirstSeen, LastSeen
| join kind=leftouter (
    DeviceFileEvents
    | where TimeGenerated > ago(Lookback)
    | where ActionType == "FileRenamed"
    | summarize RenameBurst = count() by DeviceName, bin(TimeGenerated, 5m)
    | where RenameBurst > 200   // mass rename = possible encryption in progress
    ) on $left.Hosts has any (DeviceName)
| order by TimeGenerated desc;

Rapid-response triage script — run on suspected hosts or via your remote execution tooling across the estate. Checks for exposed RDP, recently created scheduled tasks, shadow copy integrity, and suspicious recently created local admins:

# Security Arsenal - N0N-tier rapid triage script (2026-10-25)
# Run elevated. Read-only: collects indicators, changes nothing.
$Report = "C:\Windows\Temp\n0n_triage_$(hostname)_$(Get-Date -Format yyyyMMdd_HHmmss).txt"
"=== N0N-tier Rapid Triage - $(hostname) - $(Get-Date) ===" | Out-File $Report

"`n[1] RDP exposure & current sessions" | Out-File $Report -Append
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue
"RDP Enabled: $(if ($rdp.fDenyTSConnections -eq 0) {'YES - VERIFY EXPOSURE'} else {'No'})" | Out-File $Report -Append
Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue | Out-File $Report -Append
qwinsta 2>$null | Out-File $Report -Append

"`n[2] Scheduled tasks created in last 7 days" | Out-File $Report -Append
Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt (Get-Date).AddDays(-7) } |
  Select-Object TaskName, TaskPath, Date, @{N='Action';E={$_.Actions.Execute + ' ' + $_.Actions.Arguments}} |
  Format-List | Out-File $Report -Append

"`n[3] New local services installed in last 7 days (7045)" | Out-File $Report -Append
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
  Select-Object TimeCreated, Message | Format-List | Out-File $Report -Append

"`n[4] Volume Shadow Copy status (should NOT be empty on servers)" | Out-File $Report -Append
vssadmin list shadows 2>$null | Out-File $Report -Append
"bcdedit recoveryenabled: $((bcdedit /enum {current} | Select-String 'recoveryenabled').ToString())" | Out-File $Report -Append

"`n[5] Local admins created/modified in last 7 days" | Out-File $Report -Append
Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue | Out-File $Report -Append
Get-LocalUser | Where-Object { $_.PasswordLastSet -gt (Get-Date).AddDays(-7) } | Out-File $Report -Append

"`n[6] Suspicious processes/command lines (vssadmin/wmic/bcdedit/psexec)" | Out-File $Report -Append
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'delete shadows|shadowcopy delete|recoveryenabled no|psexesvc|\\ADMIN\$\\' } |
  Select-Object -First 50 TimeCreated, Message | Format-List | Out-File $Report -Append

"`nReport written to $Report - ship to your SIEM/IR team immediately." | Out-File $Report -Append
Write-Output $Report

Incident Response Priorities

T-minus detection checklist (before encryption fires)

If you are in a targeted sector — or are one of the listed organizations and are investigating the claim — hunt for, in order of signal fidelity:

1. Shadow copy / backup tampering (vssadmin delete, bcdedit recoveryenabled no, backup catalog deletion). Highest-fidelity pre-detonation signal. Page the on-call IR lead on any hit.
2. Mass service/scheduled-task creation from one account across many hosts (the KQL query above). This is the encryptor push staging.
3. New RDP/VPN logons from unusual geographies or at unusual hours, especially following failed-logon bursts.
4. PsExec/WMI artifacts: PSEXESVC, services referencing ADMIN$ or %TEMP%, WmiPrvSE spawning cmd/powershell.
5. Data staging: large archive creation (7z/rar in user-writable paths), rclone/MEGAsync/FileZilla execution, sustained high-egress sessions to unfamiliar cloud storage or VPS endpoints.
6. EDR/logging tampering: sensor service stops, event log clears (Security 1102), Defender exclusions added via GPO or registry.

Assets this gang tier historically prioritizes for exfiltration

• Healthcare-listed victims: patient records, imaging archives, billing data — maximum regulatory and reputational leverage.
• Manufacturing-listed victims: CAD/design files, BOMs, supplier contracts, ERP exports.
• All victims: HR/payroll data, executive mailboxes, financial statements, insurance policies (attackers read your policy to calibrate the demand), and anything under legal privilege.

If you find staging activity, prioritize identifying what data set is being aggregated — that tells you the extortion leverage and your notification exposure.

Containment actions, ordered by urgency

1. Isolate, don't nuke: Network-isolate affected hosts/segments (EDR isolation or switch ACLs). Do NOT power off — volatile memory and in-progress exfil sessions are evidence.
2. Kill the identity plane: Force password resets for any account observed in lateral movement; revoke sessions/tokens (including cloud/O365 refresh tokens); disable suspicious service accounts.
3. Block egress: Emergency-deny outbound to known exfil tooling domains/IPs and unsanctioned cloud storage at the proxy/firewall.
4. Protect the backup estate first: Snapshot/lock backup infrastructure, verify offline or immutable copies exist, rotate backup credentials — assume the attacker enumerated them.
5. Preserve evidence: Capture memory on the suspected patient-zero host before remediation. Image, then rebuild.
6. Engage external IR and counsel early — particularly for healthcare entities (HIPAA clock) and any EU-listed entity (GDPR 72-hour clock, if an incident is confirmed).

Hardening Recommendations

Immediate (24 hours)

• Patch/verify the five KEV CVEs listed above on any exposed asset: Check Point gateways (CVE-2026-50751), Cisco Secure FMC (CVE-2026-20316), vCenter (CVE-2026-59310), TeamCity (CVE-2026-63077), and developer workstations with Nx Console (CVE-2026-48027). These are actively exploited with confirmed ransomware use.
• Audit RDP and VPN exposure: enumerate all internet-facing RDP (it should be zero); enforce MFA on all VPN/remote access; review VPN logs for the past 30 days for impossible-travel and brute-force patterns.
• Deploy the three Sigma rules and the KQL query above; set the shadow-copy-deletion rule to page, not email.
• Verify backup immutability and test one restore. Confirm backup admin credentials are separate from domain admin.
• Block or alert on rclone, MEGAsync, and unsigned 7zip/WinRAR executions on servers.

Short-term (2 weeks)

• Segment by criticality: isolate backup infrastructure, hypervisor management (vCenter/ESXi), and healthcare record systems (EHR/PACS) onto dedicated segments with deny-by-default east-west rules. The vCenter CVE class is only catastrophic when the hypervisor plane is reachable from general user subnets.
• Tiered administration + LAPS: eliminate shared local admin passwords; require PAWs or at minimum tier-separated admin accounts to break PsExec-style lateral movement.
• Disable macros by default from the internet (Mark-of-the-Web enforcement) and deploy attack surface reduction rules for Office child processes — commodity phishing remains a top initial access vector for this tier.
• Egress filtering with default-deny for server VLANs; servers rarely need arbitrary internet egress, and blocking it cripples staging/exfil tooling.
• Tabletop the leak-site scenario: decide now who makes the call on extortion communications, regulator notification, and public statements if your organization appears on a leak site — including how you'll validate or refute a claim quickly.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub