Classification: TLP:CLEAR | Publication Date: 2026-11-05 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

Executive Summary

Between 2026-11-03 and 2026-11-04, the ransomware operation tracked as N0N published 20 new claimed victims on its dark web leak site — a compressed burst of postings that suggests either a mass-exploitation wave or a backlog dump timed for maximum pressure. Claimed victims are concentrated in the United States, with additional claims naming organizations in Germany, Saudi Arabia, and the United Arab Emirates. Sector attribution for all 20 listings is currently Not Found in our data; we will not guess.

Critically: every organization named below is a claim by a criminal group, not a confirmed breach. Thirteen of the twenty listings were independently observed by a second leak-site crawler (the gang demonstrably made the post); seven appear on a single monitoring source only. No listing in this dataset confirms that any intrusion occurred.

Defenders — particularly organizations with internet-facing VPN concentrators, RDP, VMware vCenter, or CI/CD infrastructure — should treat this posting surge as a trigger to run the pre-encryption hunts in the Detection Engineering section below. The window between initial access and detonation is where this fight is won.

Sourcing & Verification

• Corroboration status: 13 of the 20 listings in this briefing were independently observed by a second leak-site crawler (tagged [MULTI-SOURCE]). The remaining 7 listings (tagged [SINGLE-SOURCE]) appear on ransomware.live only, with no second-crawler confirmation that the posting even exists.
• What inclusion means: Every listing reflects the threat actor's claim. Inclusion in this briefing is not confirmation of a breach, and no corroboration tier in our data confirms a breach — only the named organization or its regulator can do that.
• Disputes and denials: A named organization may dispute a listing. A denial is likewise not proof the claim is false — disclosure obligations vary by jurisdiction and not every incident is reportable, so neither silence nor denial settles the question.
• Corrections: Security Arsenal will publish corrections to this briefing as warranted. We welcome contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

N0N is a comparatively opaque operation in the current ransomware ecosystem. The following reflects what is observable from leak-site behavior and open reporting; where the public record is thin, we say so rather than invent detail.

• Aliases: None firmly established in public reporting. The group brands itself "N0N" on its leak site.
• Operating model: Not definitively established. The compressed posting cadence (20 claims in ~48 hours) is consistent with either a closed group running a single exploitation campaign, or a RaaS program absorbing affiliate intrusions in bulk. We assess it is premature to attribute a model.
• Ransom demands: Not publicly documented for this group with reliable figures. As with most double-extortion crews, demands are expected to scale with victim revenue and the sensitivity of claimed exfiltrated data.
• Initial access (hypothesis, sector-level): No confirmed initial-access vector has been published for N0N's current wave. However, the CVEs listed in this briefing (see below) represent actively exploited, ransomware-confirmed exposure across exactly the perimeter and management-plane technologies criminal groups of this profile typically leverage: VPN/firewall appliances, virtualization management, and CI/CD servers.
• Extortion model: The leak-site structure indicates a double-extortion playbook — name-and-shame postings implying data theft prior to or alongside encryption. Claims of exfiltration are unverified for every listing.
• Dwell time: Unknown for N0N specifically. Industry-wide, the interval from initial access to detonation has compressed from weeks to days (and in some cases under 24 hours) — which is why the T-minus checklist in the IR section is ordered the way it is.

Current Campaign Analysis

Claimed victims (2026-11-03 through 2026-11-04)

N0N has listed / claims to have compromised the following organizations on its leak site. Sector fields are "Not Found" in our data and are not inferred.

Sector targeting

Sector attribution is Not Found for all 20 listings. We will not speculate. Practically, this means every sector with the exposure profile described below should treat this campaign as relevant.

Geographic concentration

• United States: 10 of 20 claimed victims (50%) — the clear center of gravity.
• Germany, Saudi Arabia, UAE: 1 claimed victim each.
• Unknown: 2 listings lack country attribution.

A US-weighted victim list with Gulf-state and European outliers is consistent with opportunistic mass exploitation rather than a geopolitically targeted campaign — but with sectors unknown, that assessment is low-confidence.

Victim profile

Company size and revenue cannot be estimated because sector data is absent. We make a smaller, honest point: the victim set skews US and was published in bulk.

Posting frequency / escalation pattern

The defining feature of this wave is temporal compression: 15 claims on 2026-11-03 and 5 on 2026-11-04, versus a baseline of 20 postings across the group's last 100-listing window being entirely composed of this burst. This pattern typically indicates one of three things: (1) a single initial-access vector exploited at scale (e.g., a perimeter CVE), (2) access purchased in bulk from an initial access broker, or (3) a PR-driven backlog dump. Defenders should assume (1) or (2) until evidence says otherwise.

CVE exposure (hypothesis — not victim attribution)

We have no evidence linking any specific named listing above to any specific CVE. What we can say: the following vulnerabilities are on CISA's Known Exploited Vulnerabilities catalog with confirmed ransomware abuse, and each represents a plausible initial-access or privilege-escalation path for a campaign of exactly this shape. If you run this technology, patch or mitigate now regardless of N0N:

• CVE-2026-59310 — Broadcom VMware vCenter path traversal (KEV 2026-08-18): network-accessible path traversal against the virtualization management plane. Compromise of vCenter is a force multiplier — one foothold becomes control of every hosted workload.
• CVE-2026-63077 — JetBrains TeamCity deserialization of untrusted data (KEV 2026-08-05): unauthenticated remote code execution against CI/CD infrastructure — a supply-chain-flavored entry point with access to build secrets and deployment pipelines.
• CVE-2026-20316 — Cisco Secure Firewall Management Center hard-coded password (KEV 2026-07-29): management-plane credential exposure on the very devices meant to enforce segmentation.
• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1) (KEV 2026-06-08): VPN gateway authentication bypass — a textbook initial-access vector for ransomware crews.
• CVE-2026-48027 — Nx Console embedded malicious code (KEV 2026-05-27): supply-chain compromise of developer tooling; relevant to build-environment intrusion paths.

Detection Engineering

The rules below target the generic-but-reliable TTP chain for double-extortion ransomware operations of N0N's profile: perimeter/VPN initial access, suspicious child processes, lateral movement via PsExec/WMI, and pre-encryption staging (shadow copy deletion, mass archive creation). They are written to be environment-tunable — tighten falsepositives handling to your baseline.

---
title: VPN Gateway Authentication Anomaly Followed by Internal Logon Burst
id: 9f3a1c2e-7b41-4e8a-a1d2-n0n000000001
status: experimental
description: Detects a successful VPN perimeter authentication from an unusual source followed within 30 minutes by multiple internal logon events from the VPN-assigned address — consistent with post-exploitation pivot after VPN edge compromise (e.g., improper-auth flaws in security gateways).
author: Security Arsenal Threat Intelligence
date: 2026/11/05
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  category: authentication
  product: windows
detection:
  selection_vpn:
    EventID: 4624
    LogonType: 10
    IpAddress|contains:
      - 'vpn-pool' # tune to your VPN address pool
  selection_burst:
    EventID: 4624
    LogonType:
      - 3
      - 10
  condition: selection_vpn and selection_burst
  timeframe: 30m
falsepositives:
  - Remote administrators on standing VPN sessions
level: high
tags:
  - attack.initial_access
  - attack.t1133
  - attack.lateral_movement
  - attack.t1021
---
title: Ransomware Pre-Encryption Staging - Shadow Copy Deletion and Backup Tampering
id: 9f3a1c2e-7b41-4e8a-a1d2-n0n000000002
status: experimental
description: Detects deletion of Volume Shadow Copies, disabling of recovery options, or catalog backup deletion via vssadmin, wmic, bcdedit, or wbadmin — near-universal pre-detonation behavior in human-operated ransomware campaigns.
author: Security Arsenal Threat Intelligence
date: 2026/11/05
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
      - '\wbadmin.exe'
  selection_cmd:
    CommandLine|contains:
      - 'delete shadows'
      - 'resize shadowstorage'
      - 'shadowcopy delete'
      - 'recoveryenabled no'
      - 'delete catalog'
      - 'delete systemstatebackup'
  condition: selection_img and selection_cmd
falsepositives:
  - Legitimate backup maintenance windows (correlate with change tickets)
  - Rare disk-cleanup scripts
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.defense_evasion
---
title: Lateral Movement via PsExec-Style Service Creation or WMI Remote Process
id: 9f3a1c2e-7b41-4e8a-a1d2-n0n000000003
status: experimental
description: Detects remote service installation (Event 7045) with PsExec-like naming, or WMI-spawned processes (parent WmiPrvSE.exe) launching command interpreters or scripting engines — common operator tradecraft during the spread-and-stage phase before encryption.
author: Security Arsenal Threat Intelligence
date: 2026/11/05
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\WmiPrvSE.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  selection_svc:
    EventID: 7045
    ServiceName|contains:
      - 'PSEXESVC'
      - 'RemCom'
  condition: (selection_parent and selection_child) or selection_svc
falsepositives:
  - SCCM / management-agent software distribution
  - Admin remote administration tooling (allowlist known service names)
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1047
  - attack.t1569.002

// Hunt: pre-ransomware staging + lateral movement correlated per host (24h window)
// Looks for shadow-copy tampering, suspicious service installs, archive staging,
// and remote execution artifacts clustering on the same device.
let Window = 24h;
let Staging =
    DeviceProcessEvents
    | where Timestamp > ago(Window)
    | where (FileName in~ ("vssadmin.exe","wmic.exe","bcdedit.exe","wbadmin.exe")
             and ProcessCommandLine has_any ("delete shadows","shadowcopy delete","recoveryenabled no","delete catalog"))
            or (FileName in~ ("rar.exe","7z.exe","winrar.exe") and ProcessCommandLine has_any (" a "," -p","recurse"))
    | project StagingTime=Timestamp, DeviceName, StagingCmd=ProcessCommandLine, AccountName;
let Lateral =
    union (
        DeviceEvents
        | where Timestamp > ago(Window)
        | where ActionType == "ServiceInstalled"
        | extend ServiceName = tostring(parse_json(AdditionalFields).ServiceName)
        | where ServiceName has_any ("PSEXESVC","RemCom") or ServiceName matches regex @"^[A-Za-z0-9]{4,8}$"
        | project LatTime=Timestamp, DeviceName, LatArtifact=ServiceName
    ),(
        DeviceProcessEvents
        | where Timestamp > ago(Window)
        | where InitiatingProcessFileName =~ "WmiPrvSE.exe"
        | where FileName in~ ("cmd.exe","powershell.exe","rundll32.exe")
        | project LatTime=Timestamp, DeviceName, LatArtifact=FileName
    );
Staging
| join kind=inner Lateral on DeviceName
| where abs(datetime_diff('minute', StagingTime, LatTime)) <= 240
| summarize FirstSeen=min(StagingTime), LastSeen=max(LatTime),
            StagingCommands=make_set(StagingCmd), LateralArtifacts=make_set(LatArtifact),
            Accounts=make_set(AccountName)
    by DeviceName
| sort by FirstSeen asc;

# Rapid triage: 7-day scheduled task additions, shadow copy state, and exposed RDP
# Run elevated. Outputs a single triage report per host.
$report = @()

Write-Host "=== [1] Scheduled tasks created in the last 7 days ===" -ForegroundColor Cyan
$cutoff = (Get-Date).AddDays(-7)
Get-ScheduledTask | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    $reg = (Get-ScheduledTask -TaskName $_.TaskName -TaskPath $_.TaskPath -ErrorAction SilentlyContinue)
    $created = $null
    try { $created = ([xml](Export-ScheduledTask -TaskName $_.TaskName -TaskPath $_.TaskPath)).Task.RegistrationInfo.Date } catch {}
    if ($created -and ([datetime]$created) -gt $cutoff) {
        $report += [pscustomobject]@{Type="NewScheduledTask"; Detail="$($_.TaskPath)$($_.TaskName)"; When=$created}
    }
}

Write-Host "=== [2] Volume Shadow Copies present ===" -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) {
    $report += [pscustomobject]@{Type="ShadowCopy"; Detail="NONE FOUND - verify not deleted (T1490)"; When=(Get-Date)}
} else {
    foreach ($s in $shadows) {
        $report += [pscustomobject]@{Type="ShadowCopy"; Detail="$($s.DeviceObject)"; When=$s.InstallDate}
    }
}

Write-Host "=== [3] RDP exposure check ===" -ForegroundColor Cyan
$rdpEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections).fDenyTSConnections -eq 0
$nla = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue).UserAuthentication
$rdpListen = Test-NetConnection -ComputerName localhost -Port 3389 -WarningAction SilentlyContinue
$report += [pscustomobject]@{Type="RDP"; Detail="Enabled=$rdpEnabled NLA=$nla Listening=$($rdpListen.TcpTestSucceeded)"; When=(Get-Date)}

Write-Host "=== [4] Recent 7045 service installs ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=$cutoff} -ErrorAction SilentlyContinue |
    ForEach-Object { $report += [pscustomobject]@{Type="ServiceInstall"; Detail=$_.Message.Split("`n")[0]; When=$_.TimeCreated} }

$report | Sort-Object When | Format-Table -AutoSize
$report | Export-Csv -Path ".\triage_$(hostname)_$(Get-Date -Format yyyyMMdd_HHmm).csv" -NoTypeInformation

Incident Response Priorities

T-minus detection checklist (before encryption fires)

1. Shadow copy / backup tampering — vssadmin delete shadows, bcdedit recoveryenabled no, backup catalog deletion. This is the single highest-fidelity pre-detonation signal.
2. Mass archive creation — rar.exe/7z.exe runs against file shares, especially with password flags and recursion into user directories.
3. New services & scheduled tasks — Event 7045 with random-looking service names; tasks created in the last 7 days on servers (run the triage script above).
4. WMI/PsExec fan-out — one host spawning processes on many hosts within minutes.
5. Egress anomalies — sustained outbound transfers to unfamiliar cloud storage or VPS endpoints from servers that don't normally push data out.
6. EDR/AV tampering — disabled sensors, deleted logs, or new exclusions appearing in security tooling policy.

Assets this profile of gang prioritizes for exfiltration

Based on double-extortion tradecraft generally (no N0N-specific confirmation): finance and HR data stores, legal/contract repositories, file servers backing executive departments, email archives, and customer databases. If you can only watch five things this week, watch those.

Containment actions, ordered by urgency

1. Isolate affected hosts at the network layer (EDR isolate or switch-port shutdown) — do not power off; preserve volatile evidence.
2. Disable compromised accounts and revoke active sessions — including VPN, M365, and service accounts seen in lateral movement.
3. Block identified egress destinations at the proxy/firewall; sinkhole C2 domains where possible.
4. Protect backups immediately — verify offline/immutable copies are unreachable from production credentials before doing anything else.
5. Snapshot and preserve — memory capture and disk images on patient-zero candidates before remediation.
6. Engage IR retainer / external support — if the checklist above fires on more than one host, assume an enterprise-wide event until disproven.

Hardening Recommendations

Immediate (24 hours)

• Patch or mitigate the KEV set: CVE-2026-59310 (vCenter), CVE-2026-63077 (TeamCity), CVE-2026-20316 (Cisco FMC), CVE-2026-50751 (Check Point IKEv1), CVE-2026-48027 (Nx Console). These are actively exploited with confirmed ransomware use — independent of N0N attribution.
• Enforce phishing-resistant MFA on all VPN and remote access; disable IKEv1 Aggressive Mode on Check Point gateways where operationally feasible.
• Block PsExec-style remote service creation on workstations via firewall rules (deny inbound SMB/RPC between workstations); restrict WMI to admin jump hosts.
• Enable tamper protection on EDR and alert on vssadmin/bcdedit execution environment-wide.
• Run the triage PowerShell script on domain controllers, file servers, and backup infrastructure today.

Short-term (2 weeks)

• Segment the virtualization and management planes: vCenter, FMC, and CI/CD servers reachable only from dedicated admin jump hosts with MFA.
• Deploy the Sigma detections above into your SIEM and tune false positives; onboard the KQL hunt as a scheduled analytic rule.
• Immutable, credentialedly-isolated backups: ensure backup infrastructure uses credentials that production domain admin cannot touch.
• Egress filtering: default-deny outbound from server VLANs except allowlisted destinations — kills most bulk exfil paths.
• Tabletop the double-extortion scenario: legal, comms, and IR alignment on leak-site claims before your name (allegedly) appears on one.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub