Classification: TLP:CLEAR | Publication Date: 2026-10-24 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 20 Leak-Site Listings in 72 Hours — Sector Targeting Analysis, Detection Rules & IR Priorities

Executive Summary

Between 2026-10-21 and 2026-10-23, the ransomware group tracked as N0N listed 20 organizations on its dark web leak site — a compressed posting cadence that signals an active campaign wave rather than routine trickle disclosure. The claimed victims span eight countries (ES, ET, TN, CH, US, BG, KR, PT) and seven sectors, with named listings in Healthcare (Heritage Senior Living, US), Energy & Utilities (SunTechnics Fabrisolar AG, CH), Manufacturing (PROTEX Confection, TN), Technology (Hanjin Information Systems & Telecommunication Co., Ltd., KR), and Retail & E-Commerce (Performance Ford Inc, US).

Critical caveat: every entry below is a claim made by a criminal organization on its own infrastructure. A leak-site listing is an accusation, not a confirmed breach. None of the organizations named here have been confirmed — by this data or any tier within it — to have suffered a compromise. This briefing treats the claims as actionable threat-actor telemetry: the campaign tempo, sector selection, and geographic spread are real signals even where individual claims remain unverified.

Defensive posture recommendation: organizations in the listed sectors and countries — particularly US healthcare and Swiss/Korean technology and energy firms — should treat the next 14 days as an elevated-threat window and execute the detection and hardening content in Sections 5–7.

Sourcing & Verification

• Corroboration status: 13 of the 20 listings analyzed were independently observed by a second leak-site crawler (MULTI-SOURCE). 7 listings — including Company #103 (PT) and Company #102 — appear on a single source only (ransomware.live), with no second-crawler confirmation that the postings even exist.
• What corroboration means: MULTI-SOURCE confirms only that the gang made the claim on its leak site. No tier in this dataset confirms that a breach occurred. Only the named organization or its regulator can confirm an incident.
• Disputes and denials: a named organization may dispute a listing, and a denial is likewise not proof the claim is false. Disclosure obligations vary by jurisdiction and sector, and not every incident is reportable — neither silence nor denial settles the question.
• Corrections: Security Arsenal will publish corrections to this briefing if warranted. We welcome contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

Public reporting on N0N remains thin relative to established brands (LockBit, Akira, Play). What follows reflects observed leak-site behavior and patterns consistent with mid-tier operations of this profile; where attribution is uncertain, we say so.

• Aliases: No confirmed aliases are publicly established. The self-styled "N0N" branding appears consistently across its leak infrastructure.
• Operating model: Behavior is consistent with a closed or semi-closed RaaS — the burst posting pattern (9+ listings in a single day) suggests either multiple affiliates detonating on a coordinated timeline, or a single operator batching disclosures. We cannot currently distinguish between the two.
• Ransom demands: No verified demand figures are available for this group. Groups of this tier typically open demands in the low-to-mid six figures for SMB victims and scale against perceived revenue.
• Initial access (assessed, not confirmed per-victim): The sector mix and mid-market victim profile are consistent with opportunistic edge-device exploitation and credential-based access: VPN/firewall appliance exploitation, RDP exposure, and phishing with macro- or script-based payloads. See the CVE hypothesis discussion below.
• Extortion model: Double extortion — the leak site itself is evidence of a name-and-shame data-theft layer preceding or accompanying encryption.
• Dwell time: Unknown for N0N specifically. The industry's prevailing pattern for this actor tier is days-to-weeks of staging before detonation; the batch posting here implies victims may share a common access-acquisition window.

Current Campaign Analysis

Sector Targeting

From the 20 listings in the last 100 postings window:

The high count of "Not Found" entries is itself notable: N0N is redacting or withholding victim identities for a large share of listings — a common pressure tactic ("pay or we name you") that also inflates apparent campaign scale.

Geographic Concentration

Eight countries across four continents with no single dominant geography: ES, US, CH, KR, TN, BG, PT, ET. This dispersion argues for opportunistic access acquisition (scanners + initial access brokers) rather than deliberate regional targeting.

Victim Profile

The named organizations are overwhelmingly small-to-mid-market: a regional auto dealership, a senior living operator, a specialty solar manufacturer, a regional confection manufacturer, an NGO. Estimated revenue range across named victims: roughly $5M–$150M. This is the classic mid-tier ransomware sweet spot — large enough to pay, small enough to lack mature SOC coverage.

Posting Frequency / Escalation

• 2026-10-21: 4 listings (2 single-source)
• 2026-10-22: 7 listings
• 2026-10-23: 4+ listings in the observed window

This compressed cadence — 20 listings in roughly 72 hours — is an escalation pattern consistent with either a campaign push or a deadline-driven dump ahead of infrastructure rotation.

CVE Connection — Hypothesis Only

We have no evidence linking any named listing to any specific CVE. However, N0N's apparent opportunistic edge-access model overlaps with vulnerabilities currently on CISA's KEV with confirmed ransomware use. Defenders should treat the following as sector-level exposure hypotheses, not attribution:

• CVE-2026-50751 (Check Point Security Gateway improper authentication, IKEv1) — edge VPN auth bypass; prime initial-access candidate for opportunistic crews.
• CVE-2026-20316 (Cisco Secure FMC hard-coded password) — management-plane compromise enabling policy tampering and lateral pivot.
• CVE-2026-59310 (VMware vCenter path traversal) — direct path to the virtualization layer where ransomware detonation does maximum damage.
• CVE-2026-63077 (JetBrains TeamCity deserialization) — CI/CD compromise enabling supply-chain staging; relevant given the KR technology-sector listing.
• CVE-2026-48027 (Nx Console embedded malicious code) — developer-toolchain supply chain exposure.

Prioritize patching in that order for internet-facing assets.

Detection Engineering

The following content targets the TTP cluster typical of this actor tier: edge/VPN access, macro execution, RDP brute force, PsExec/WMI lateral movement, and pre-encryption staging (shadow copy deletion, mass file staging).

---
title: N0N Campaign - Pre-Encryption Volume Shadow Copy Deletion
id: 9f1a2b3c-4d5e-4f6a-8b7c-1a2b3c4d5e01
status: experimental
description: Detects deletion or resizing of Volume Shadow Copies via vssadmin, wmic, or PowerShell — a near-universal pre-detonation step in ransomware playbooks consistent with N0N-tier actors.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
date: 2026/10/24
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\diskshadow.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_args:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'resize shadowstorage'
      - 'Delete Shadows'
      - 'shadow delete'
  condition: selection_tool and selection_args
falsepositives:
  - Backup administrators performing legitimate shadow storage maintenance
level: high
tags:
  - attack.impact
  - attack.t1490
---
title: N0N Campaign - PsExec or WMI Remote Service Execution for Lateral Movement
id: 9f1a2b3c-4d5e-4f6a-8b7c-1a2b3c4d5e02
status: experimental
description: Detects remote service creation patterns consistent with PsExec-style lateral movement and WMI process spawning observed in mid-tier ransomware intrusions.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
date: 2026/10/24
logsource:
  product: windows
  service: system
detection:
  selection_service:
    EventID: 7045
    Service_File_Name|contains:
      - 'PSEXESVC'
      - 'ADMIN$'
      - '%COMSPEC%'
  selection_wmi_child:
    EventID: 1
    ParentImage|endswith: '\WmiPrvSE.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\rundll32.exe'
  condition: 1 of selection_*
falsepositives:
  - Legitimate administrative tooling (SCCM, PDQ Deploy) — baseline service names per environment
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002
---
title: N0N Campaign - Office Macro Spawning Script or Shell Child Process
id: 9f1a2b3c-4d5e-4f6a-8b7c-1a2b3c4d5e03
status: experimental
description: Detects Office applications spawning script interpreters or shells — initial execution stage of phishing-delivered payloads consistent with N0N-tier initial access.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
date: 2026/10/24
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; some legacy LOB macro integrations spawn cmd — whitelist by hash, not by name
level: critical
tags:
  - attack.initial_access
  - attack.t1566.001
  - attack.t1059

Sentinel hunt query for pre-ransomware staging and lateral movement indicators:

// N0N-tier pre-detonation hunt: lateral movement + staging + defensive evasion (72h window)
let Lookback = 72h;
let LateralMoves =
    SecurityEvent
    | where TimeGenerated > ago(Lookback)
    | where EventID == 4624 and LogonType in (3, 10)
    | where IpAddress !startswith "10." or AccountType == "Machine"
    | summarize LateralSources = dcount(IpAddress), Targets = dcount(Computer) by Account, bin(TimeGenerated, 1h)
    | where Targets > 5;
let ShadowTampering =
    SecurityEvent
    | where TimeGenerated > ago(Lookback)
    | where EventID == 4688
    | where Process has_any ("vssadmin", "diskshadow", "wmic") and CommandLine has_any ("delete shadows", "shadowcopy delete", "resize shadowstorage", "shadow delete")
    | project ShadowTime = TimeGenerated, ShadowHost = Computer, ShadowAccount = Account, CommandLine;
let MassStaging =
    DeviceFileEvents
    | where TimeGenerated > ago(Lookback)
    | where FolderPath has_any ("\\staging\\", "\\exfil\\", "\\temp\\") or FileName endswith_any (".7z", ".rar")
    | summarize ArchiveOps = count() by DeviceName, InitiatingProcessAccountName, bin(TimeGenerated, 1h)
    | where ArchiveOps > 50;
LateralMoves
| join kind=inner (ShadowTampering) on $left.Account == $right.ShadowAccount
| join kind=leftouter (MassStaging) on $left.TimeGenerated between (MassStaging_TimeGenerated .. TimeGenerated)
| project TimeGenerated, Account, Targets, ShadowHost, CommandLine, ArchiveOps
| sort by TimeGenerated desc

Rapid-response audit script — run on any suspected host to surface the last 7 days of persistence and defensive-evasion artifacts:

# Security Arsenal — N0N-tier rapid triage script (run elevated on suspect hosts)
# Surfaces: new scheduled tasks, shadow copy state, exposed RDP, suspicious services (last 7 days)
$cutoff = (Get-Date).AddDays(-7)
$report = @()

Write-Host "=== [1] Scheduled tasks created/modified in last 7 days ===" -ForegroundColor Cyan
Get-ScheduledTask | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    $taskPath = "$($_.TaskPath)$($_.TaskName)"
    try {
        $xml = Export-ScheduledTask -TaskName $_.TaskName -TaskPath $_.TaskPath -ErrorAction Stop
        if ($xml -match '<Date>([^<]+)</Date>') {
            $created = [datetime]$Matches[1]
            if ($created -gt $cutoff) { $report += "[TASK] $taskPath created $created" }
        }
    } catch {}
}

Write-Host "=== [2] Volume Shadow Copy state ===" -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) { $report += "[ALERT] NO shadow copies present — possible pre/post-detonation deletion" }
else { $shadows | ForEach-Object { $report += "[VSS] $($_.DeviceObject) created $($_.InstallDate)" } }

Write-Host "=== [3] RDP exposure check ===" -ForegroundColor Cyan
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue
if ($rdp.fDenyTSConnections -eq 0) { $report += "[ALERT] RDP ENABLED — verify it is not internet-exposed (3389)" }
$nla = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue
if ($nla.UserAuthentication -eq 0) { $report += "[ALERT] NLA DISABLED on RDP — brute force exposure" }

Write-Host "=== [4] New services installed in last 7 days (7045 events) ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=$cutoff} -ErrorAction SilentlyContinue |
  ForEach-Object { $report += "[SVC] $($_.TimeCreated): $($_.Message -split "`n")[0]" }

Write-Host "=== [5] Failed logon burst (RDP brute force indicator) ===" -ForegroundColor Cyan
$fails = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=$cutoff} -ErrorAction SilentlyContinue
if (($fails | Measure-Object).Count -gt 100) { $report += "[ALERT] $(($fails | Measure-Object).Count) failed logons in 7 days — possible brute force" }

$report | Out-File "$env:TEMP\arsenal_triage_$(Get-Date -Format yyyyMMdd_HHmm).txt"
$report | ForEach-Object { Write-Host $_ }

Incident Response Priorities

T-Minus Detection Checklist (before encryption fires)

1. Shadow copy tampering — any vssadmin delete shadows or diskshadow execution on servers (see Sigma rule 1). This is the single highest-fidelity pre-detonation signal.
2. Batch admin-share access — one account touching ADMIN$/C$ on 5+ hosts within an hour.
3. New service installations (Event 7045) — especially randomized 8-char service names or paths in %TEMP%/%PROGRAMDATA%.
4. Archive tool staging — 7z.exe/rar.exe runs against file shares, or multi-GB outbound transfers to unfamiliar endpoints/IPs.
5. AV/EDR tampering — service stop attempts against Defender, Sentinel, CrowdStrike, or Veeam/backup agents.

Assets This Actor Tier Prioritizes for Exfiltration

• File servers and NAS hosting HR, finance, and legal shares
• Backup infrastructure (Veeam/Commvault) — targeted for deletion and theft
• For healthcare-profile victims: patient records and PHI databases
• For manufacturing/energy-profile victims: engineering drawings, OT-adjacent documentation, SCADA network diagrams
• Domain controller ntds.dit where achievable

Containment Actions, Ordered by Urgency

1. Isolate, don't power off — network-quarantine any host triggering shadow-copy or mass-staging alerts; preserve memory for forensics.
2. Disable the suspect identity plane — disable the lateral-movement account at the IdP/AD level, revoke tokens, force enterprise-wide password reset for tier-0/tier-1 accounts.
3. Block egress at the edge — sinkhole outbound to unknown cloud storage and newly-registered domains; exfil is the leverage, stop it first.
4. Snapshot and freeze evidence — capture volatile data from affected hosts before remediation wipes artifacts.
5. Engage IR retainers and counsel early — for any organization N0N has named, begin legal review of disclosure obligations now, regardless of whether the claim is confirmed.

Hardening Recommendations

Immediate (24 hours)

• Patch the KEV edge stack: Check Point Security Gateway (CVE-2026-50751), Cisco Secure FMC (CVE-2026-20316), vCenter (CVE-2026-59310), TeamCity (CVE-2026-63077). Verify no exposed Nx Console instances (CVE-2026-48027).
• Audit RDP exposure: confirm no internet-facing 3389; enforce NLA; move administrative RDP behind VPN + MFA or eliminate it.
• Enable MFA on all remote access, including VPN and any legacy IKEv1 configurations pending the Check Point patch.
• Block Office macros from the internet via Mark-of-the-Web GPO.
• Verify backups are immutable/offline and test one restore — assume the gang will target shadow copies and backup catalogs.
• Deploy the Sigma rules above to your SIEM and run the 72-hour KQL hunt immediately.

Short-Term (2 Weeks)

• Segment the network so that a single compromised workstation cannot reach file servers, backup infrastructure, or hypervisor management planes.
• Deploy decoy canary files/shares on high-value file servers; alert on any access.
• Implement application allowlisting (WDAC/AppLocker) on servers to deny unauthorized binaries (PsExec clones, archive tools, script interpreters) on tier-0 assets.
• Centralize and extend log retention — minimum 90 days hot for Security/System logs and EDR telemetry; this actor tier's dwell time can exceed default retention.
• Restrict local admin via LAPS and tiered administration; the lateral movement math above only works with reused credentials.
• Establish a leak-site monitoring cadence for your own organization and key suppliers — being named before you know you have a problem is now a standard extortion pressure point.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub