N0N Ransomware Gang: 20 New Leak Site Postings — Sector Targeting Analysis, Detection Rules & IR Playbook

Classification: TLP:CLEAR | Publication Date: 2026-11-06 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

Executive Summary

The ransomware group operating under the name N0N published 20 victim listings on its dark web leak site between 2026-11-05 and 2026-11-06, according to data aggregated via ransomware.live. The postings name organizations across six sectors — Healthcare, Technology, Energy & Utilities, Professional Services, Retail & E-Commerce, and one category returned as "Not Found" — spanning eight countries: Italy, the United States, Saudi Arabia, the United Arab Emirates, Canada, Denmark, Indonesia, and Germany.

All listings published between November 5 and November 6, 2026, indicating a burst of activity within a compressed 48-hour window. Fifteen of the 20 listings were independently observed by a second leak-site crawler, confirming the gang did make these postings. Five listings appear on a single source only. It is critical to understand that a leak-site listing is an accusation by a criminal organization, not a confirmed breach. No tier in this data confirms that any named organization has been compromised. Only the affected organization or its regulator can confirm or deny an incident.

Among the named organizations, N0N claims to have compromised entities including Dompé Farmaceutici S.p.A., Cogent Biosciences, Inc., Chartboost LLC, Centrepoint, Resource Consultants, Max Fashion, Hallmark Cards, Inc., Scry Analytics, Delta Dental of Missouri, and The Container Store. An additional five listings appear as unidentified entries labeled "Company #133" through "Company #137."

Security teams operating in the healthcare, technology, energy, professional services, and retail sectors should treat this campaign as an active threat signal. This briefing provides detection engineering content, incident response priorities, and hardening recommendations based on N0N's known tactics, techniques, and procedures (TTPs).

Sourcing & Verification

This briefing is built on data pulled directly from N0N's dark web leak site via ransomware.live, a ransomware tracking service that monitors criminal infrastructure on the Tor network.

• Corroboration breakdown: Of the 20 listings referenced in this report, 15 were independently observed by a second leak-site crawler, indicating both monitoring sources recorded the same claim by the gang. The remaining 5 listings were observed on a single source only.
• Inclusion reflects the threat actor's claim and is NOT confirmation of a breach. A leak-site posting is a unilateral statement by a criminal organization. It may be accurate, exaggerated, fabricated, or refer to an incident the victim resolved before publication.
• A named organization may dispute the listing. A denial from a listed organization is likewise not proof that the claim is false. Disclosure obligations vary by jurisdiction, sector, and regulatory framework, and not every security incident is legally reportable. Neither silence nor denial settles the question definitively.
• Security Arsenal will publish corrections to this briefing as new information becomes available. We welcome contact from any organization named in this report at security@securityarsenal.com.

Threat Actor Profile — N0N

Aliases & Attribution

N0N is a ransomware operation that emerged in the criminal underground with a dedicated Tor-based leak site used for double-extortion victim naming. The group does not have widely documented public aliases at the time of this writing, though the name itself follows the leetspeak convention of substituting a zero for the letter "o." Attribution to a specific nation-state or established ransomware cartel has not been confirmed in open-source reporting.

RaaS vs. Closed-Group Model

Based on the volume and diversity of victim postings observed on the N0N leak site, the group's operational pattern is consistent with either a Ransomware-as-a-Service (RaaS) model recruiting affiliates or a highly active closed group conducting intrusions in-house. The breadth of sectors and geographies in a single 48-hour posting window suggests multiple parallel intrusion streams, which leans toward an affiliate model, though this cannot be confirmed from leak-site data alone.

Ransom Demands

Specific ransom amounts from N0N operations have not been publicly documented in verified incident reports. However, based on the victim profile — which includes mid-market to large enterprises across multiple sectors — ransom demands are likely calibrated to the target's estimated annual revenue and perceived ability to pay. Groups with similar victim profiles typically demand between $500,000 and $5 million USD per incident, though this range is speculative in the absence of confirmed N0N-specific negotiation data.

Initial Access Methods

While no specific initial access vector has been forensically confirmed for any of the current N0N listings, ransomware groups operating at this volume typically rely on the following intrusion methods:

• Exploitation of internet-facing remote access services — including unpatched VPN concentrators, exposed RDP gateways, and misconfigured Citrix or VMware Horizon appliances
• Credential-based attacks — including password spraying against VPN and webmail portals, credential stuffing using breached password databases, and brute-force attacks against RDP endpoints
• Phishing with malicious attachments or links — leading to macro-based initial execution or credential harvesting via adversary-in-the-middle (AiTM) frameworks
• Purchase of initial access from brokers — access-as-a-service markets on dark web forums where specialized access brokers sell pre-established footholds in corporate networks
• Supply chain or trusted third-party compromise — leveraging compromised managed service providers (MSPs) or software dependencies to gain downstream access

The actively exploited CVEs listed in this briefing represent sector-level exposure that ransomware operators are known to target. There is no evidence linking any specific CVE to any specific named victim on N0N's leak site. However, the CISA KEV entries for VMware vCenter (CVE-2026-59310), Cisco Secure FMC (CVE-2026-20316), and Check Point Security Gateway (CVE-2026-50751) represent precisely the kind of perimeter and management-plane vulnerabilities that ransomware groups exploit for initial access and lateral movement.

Double Extortion Approach

N0N maintains a dedicated leak site on the Tor network, which is the defining characteristic of a double-extortion operation. The group's playbook follows the standard model:

1. Gain initial access to the target network
2. Establish persistence and escalate privileges
3. Move laterally to identify and access sensitive data
4. Exfiltrate data to attacker-controlled infrastructure
5. Deploy ransomware to encrypt systems
6. List the victim on the leak site if the ransom is not paid within a specified deadline

The presence of five "Company #" entries (anonymized victim identifiers) suggests that N0N uses a staging approach where victims are first listed under generic identifiers — likely while negotiations are ongoing — and may be named publicly if the victim refuses to pay.

Average Dwell Time

Specific dwell-time metrics for N0N intrusions have not been publicly confirmed. However, ransomware operations across the ecosystem have demonstrated a median dwell time of 4 to 11 days between initial access and ransomware detonation, with some operators moving within 24 to 72 hours when time pressure is high. The burst of 20 listings in 48 hours suggests either simultaneous detonations across multiple intrusions or a coordinated publication of previously negotiated failures.

Current Campaign Analysis

Sectors Being Targeted

The 20 listings posted on N0N's leak site between November 5 and November 6, 2026, cover the following sectors:

Note: 5 additional listings from the 20 total are not detailed in the victim list provided but contribute to the overall count.

Healthcare and retail represent the heaviest concentration of named victims, consistent with ransomware groups' preference for sectors where operational disruption creates maximum pressure to pay. Healthcare organizations face patient safety implications and strict regulatory penalties for data exposure, while retail operations face revenue loss from point-of-sale disruption and reputational damage from customer data exposure.

Geographic Concentration

The campaign spans eight countries across North America, Europe, the Middle East, and Southeast Asia:

• United States (US): 7 listings — the largest single-country concentration
• Italy (IT): 1 listing
• Saudi Arabia (SA): 1 listing
• United Arab Emirates (AE): 1 listing
• Canada (CA): 1 listing
• Denmark (DK): 1 listing
• Indonesia (ID): 1 listing
• Germany (DE): 1 listing (from the broader 20-posting data)

The US-centric targeting aligns with the broader ransomware economy's preference for organizations in jurisdictions with high cyber-insurance penetration and a legal environment where data breach notifications create reputational leverage. The inclusion of Middle Eastern and Southeast Asian targets suggests either opportunistic access acquisition or deliberate geographic diversification to reduce law enforcement focus from any single jurisdiction.

Victim Profile

Based on the named organizations, the campaign targets mid-market to large enterprise organizations:

• Dompé Farmaceutici S.p.A. — Italian multinational pharmaceutical company, a major European drug manufacturer
• Cogent Biosciences, Inc. — US-based clinical-stage biotechnology company
• Chartboost LLC — US-based mobile advertising and monetization platform
• Centrepoint — Saudi Arabia-based energy and utilities sector entity
• Resource Consultants — US-based professional services firm
• Max Fashion — UAE-based retail fashion chain with regional operations
• Hallmark Cards, Inc. — US-based multinational greeting card and consumer products manufacturer
• Scry Analytics — US-based technology company
• Delta Dental of Missouri — US-based dental insurance provider
• The Container Store — US-based specialty retail chain

The mix of publicly traded companies, private enterprises, and insurance providers suggests that N0N's affiliates are not restricting themselves to a single victim profile. The inclusion of both consumer-facing brands (Hallmark Cards, The Container Store, Max Fashion) and B2B entities (Chartboost, Scry Analytics, Resource Consultants) indicates broad targeting criteria rather than a sector-specific campaign.

Observed Posting Frequency & Escalation Patterns

The 20 listings were published across a two-day window — 15 on 2026-11-05 and 5 on 2026-11-06. This burst pattern is consistent with several operational scenarios:

1. Mass detonation event: Multiple intrusions reached the encryption/leak-publication phase simultaneously, possibly indicating coordinated timing across affiliate teams.
2. Negotiation deadline expiry: The gang may have set a common deadline for multiple victims and published all non-payers at once.
3. Site update cycle: The gang may batch-publish listings on a periodic schedule rather than in real time.

The presence of five anonymized "Company #" entries suggests an ongoing negotiation pipeline. These entries may be upgraded to named listings if victims do not meet the gang's demands, representing a forward indicator for organizations that may suspect they are in N0N's negotiation pipeline.

CVE Exposure Assessment

No specific CVE has been forensically linked to any N0N intrusion. However, the following CISA KEV entries represent perimeter and infrastructure vulnerabilities that ransomware groups actively exploit for initial access. Organizations in the targeted sectors should verify their exposure immediately:

These CVEs are discussed as sector-level exposure hypotheses. There is no evidence connecting any specific CVE to any specific N0N victim listing. Organizations should prioritize patching these vulnerabilities regardless of this campaign, as they are confirmed as actively exploited by ransomware operators per CISA.

Detection Engineering

The following detection content targets the TTPs most commonly associated with ransomware operations matching N0N's profile. These rules and queries are designed for organizations that may be at risk of similar intrusions, regardless of whether they appear on the current victim list.

Sigma Rules

---
title: Suspicious Volume Shadow Copy Deletion via vssadmin or wmic
id: 8f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: production
description: Detects deletion of Volume Shadow Copies using vssadmin.exe or wmic.exe, a common pre-encryption step used by ransomware operators including those matching the N0N profile. This technique destroys recovery points before detonation.
author: Security Arsenal Threat Intelligence
references:
  - https://attack.mitre.org/techniques/T1490/
date: 2026/11/06
modified: 2026/11/06
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
  service: sysmon
detection:
  selection_vssadmin:
    Image|endswith: '\\vssadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'resize shadowstorage'
  selection_wmic:
    Image|endswith: '\\wmic.exe'
    CommandLine|contains:
      - 'shadowcopy'
      - 'delete'
  selection_bcdedit:
    Image|endswith: '\\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
  condition: selection_vssadmin or selection_wmic or selection_bcdedit
falsepositives:
  - Legitimate system administration scripts
  - Backup software maintenance operations
level: high
---
title: Potential Ransomware Lateral Movement via PsExec or WMI Remote Execution
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: production
description: Detects lateral movement indicators consistent with ransomware operator playbook, including PsExec service installation, WMI remote process creation, and remote service creation patterns. Aligned with TTPs used by ransomware groups for pre-encryption lateral propagation.
author: Security Arsenal Threat Intelligence
references:
  - https://attack.mitre.org/techniques/T1569/002/
  - https://attack.mitre.org/techniques/T1047/
  - https://attack.mitre.org/techniques/T1543/003/
date: 2026/11/06
modified: 2026/11/06
tags:
  - attack.lateral_movement
  - attack.t1569.002
  - attack.t1047
  - attack.t1543.003
logsource:
  category: process_creation
  product: windows
  service: sysmon
detection:
  selection_psexec:
    Image|endswith:
      - '\\PSEXESVC.exe'
      - '\\PsExec.exe'
    CommandLine|contains:
      - '-accepteula'
      - '-s '
      - '\\'
  selection_wmi_remote:
    ParentImage|endswith: '\\wmiprvse.exe'
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\wscript.exe'
      - '\\cscript.exe'
  selection_remote_service:
    Image|endswith: '\\sc.exe'
    CommandLine|contains:
      - 'create'
      - '\\'
      - 'binpath'
  condition: 1 of selection_*
falsepositives:
  - IT administration tools (SCCM, PDQ Deploy)
  - Legitimate remote management activities
  - Patching and software deployment systems
level: high
---
title: Mass File Renaming or Encryption Activity Indicative of Ransomware Detonation
id: 7d8e9f0a-1b2c-3d4e-5f6a-7b8c9d0e1f2a
status: production
description: Detects high-volume file modification, renaming, or encryption patterns consistent with ransomware detonation. Correlates multiple file events from a single process within a short timeframe to identify mass encryption activity.
author: Security Arsenal Threat Intelligence
references:
  - https://attack.mitre.org/techniques/T1486/
date: 2026/11/06
modified: 2026/11/06
tags:
  - attack.impact
  - attack.t1486
logsource:
  category: file_event
  product: windows
  service: sysmon
detection:
  selection:
    EventType:
      - 'FileCreate'
      - 'FileRename'
    Image|endswith:
      - '\\rundll32.exe'
      - '\\powershell.exe'
      - '\\cmd.exe'
      - '\\wscript.exe'
      - '\\cscript.exe'
      - '\\mshta.exe'
      - '\\regsvr32.exe'
  filter_known_software:
    Image|contains:
      - '\\Program Files\\'
      - '\\Windows\\'
  condition: selection and not filter_known_software
falsepositives:
  - Software installation or update processes
  - Legitimate file synchronization tools
  - Development build processes
level: critical

KQL — Microsoft Sentinel Hunt Query

This hunt query targets pre-ransomware staging indicators associated with ransomware lateral movement, data staging, and pre-encryption reconnaissance. Run this query against your Sentinel workspace to hunt for signs of an active N0N-style intrusion before encryption fires.

// N0N-Style Ransomware Pre-Detonation Hunt
// Searches for lateral movement, data staging, and shadow copy manipulation indicators
// Time window: Last 7 days

let SuspiciousProcesses = dynamic(["vssadmin.exe", "wmic.exe", "bcdedit.exe", "PsExec.exe", "PsExec64.exe", "PSEXESVC.exe", "psexesvc.exe", "csvde.exe", "ntdsutil.exe", "rclone.exe", "megacmd.exe", "7z.exe", "winrar.exe", "rar.exe"]);

// Part 1: Shadow Copy Deletion and Boot Configuration Tampering
let ShadowCopyTampering = DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("vssadmin.exe", "wmic.exe", "bcdedit.exe")
| where ProcessCommandLine has_any ("delete shadows", "resize shadowstorage", "shadowcopy delete", "recoveryenabled no", "bootstatuspolicy ignoreallfailures")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName
| extend IndicatorType = "Shadow Copy Deletion / Boot Config Tampering";

// Part 2: Lateral Movement via PsExec or Remote Service Creation
let LateralMovement = DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("PsExec.exe", "PsExec64.exe", "PSEXESVC.exe", "psexesvc.exe")
   or (FileName =~ "sc.exe" and ProcessCommandLine has_all ("create", "binpath") and ProcessCommandLine has "\\\\")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName
| extend IndicatorType = "Lateral Movement - PsExec/Remote Service";

// Part 3: Data Staging and Exfiltration Tool Execution
let DataStaging = DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("rclone.exe", "megacmd.exe", "7z.exe", "winrar.exe", "rar.exe", "csvde.exe", "ntdsutil.exe")
| where ProcessCommandLine has_any ("copy", "move", "archive", "sync", "dump", "export", ".zip", ".rar", ".7z")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName
| extend IndicatorType = "Data Staging / Exfiltration Tool";

// Part 4: Mass File Encryption Pattern (high-volume file modifications from single process)
let MassEncryption = DeviceFileEvents
| where TimeGenerated > ago(7d)
| where ActionType in ("FileCreated", "FileRenamed")
| where InitiatingProcessFileName in~ ("rundll32.exe", "powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe", "mshta.exe", "regsvr32.exe")
| summarize FileEventCount = count(), UniqueExtensions = dcount(tostring(split(FileName, ".")[-1])) by DeviceName, InitiatingProcessFileName, bin(TimeGenerated, 5m)
| where FileEventCount > 50 and UniqueExtensions > 3
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileEventCount, UniqueExtensions
| extend IndicatorType = "Mass File Encryption Pattern";

// Combine all indicators
union ShadowCopyTampering, LateralMovement, DataStaging, MassEncryption
| sort by TimeGenerated desc

PowerShell Rapid-Response Hardening & Detection Script

This PowerShell script performs rapid checks for common ransomware pre-detonation indicators and applies immediate hardening controls. Run with administrative privileges on potentially affected systems.

<#
.SYNOPSIS
    Security Arsenal — N0N Ransomware Rapid Response & Hardening Script
.DESCRIPTION
    Checks for ransomware pre-detonation indicators and applies emergency hardening.
    Run with elevated privileges on systems suspected of compromise or at risk.
.NOTES
    Author: Security Arsenal Threat Intelligence
    Date: 2026-11-06
    Version: 1.0
    Classification: TLP:CLEAR
#>

#Requires -RunAsAdministrator

$timestamp = Get-Date -Format "yyyy-MM-dd_HH-mm-ss"
$reportPath = "$env:TEMP\SA-RapidResponse_$timestamp.txt"
$findings = @()

function Write-Finding {
    param([string]$Category, [string]$Finding, [string]$Severity)
    $entry = "[$Severity] [$Category] $Finding"
    $script:findings += $entry
    Write-Host $entry -ForegroundColor $(
        switch ($Severity) {
            "CRITICAL" { "Red" }
            "HIGH"     { "Yellow" }
            "MEDIUM"   { "Cyan" }
            "INFO"     { "Green" }
            default    { "White" }
        }
    )
}

Write-Host "========================================" -ForegroundColor White
Write-Host " Security Arsenal — N0N Rapid Response" -ForegroundColor White
Write-Host " $(Get-Date)" -ForegroundColor White
Write-Host "========================================" -ForegroundColor White
Write-Host ""

# --- CHECK 1: Exposed RDP ---
Write-Host "[CHECK 1] Auditing RDP configuration..." -ForegroundColor Cyan
$rdpEnabled = Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections" -ErrorAction SilentlyContinue
if ($rdpEnabled.fDenyTSConnections -eq 0) {
    Write-Finding -Category "RDP" -Finding "RDP is ENABLED on this system. Verify network-level restrictions are in place." -Severity "HIGH"
    $rdpPort = (Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name "PortNumber" -ErrorAction SilentlyContinue).PortNumber
    if ($rdpPort -eq 3389) {
        Write-Finding -Category "RDP" -Finding "RDP is running on default port 3389. Consider changing to a non-standard port." -Severity "MEDIUM"
    }
    # Check for RDP brute force attempts in last 24 hours
    $failedLogons = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)} -MaxEvents 1000 -ErrorAction SilentlyContinue
    $rdpFailures = $failedLogons | Where-Object { $_.Message -match "Logon Type:\s+10" -or $_.Message -match "Logon Type:\s+3" }
    if ($rdpFailures.Count -gt 50) {
        Write-Finding -Category "RDP" -Finding "Detected $($rdpFailures.Count) failed logon attempts in last 24h — possible brute force in progress." -Severity "CRITICAL"
    } elseif ($rdpFailures.Count -gt 10) {
        Write-Finding -Category "RDP" -Finding "Detected $($rdpFailures.Count) failed logon attempts in last 24h — elevated failure rate." -Severity "HIGH"
    }
} else {
    Write-Finding -Category "RDP" -Finding "RDP is disabled. Good." -Severity "INFO"
}

# --- CHECK 2: Volume Shadow Copies ---
Write-Host "`n[CHECK 2] Checking Volume Shadow Copies..." -ForegroundColor Cyan
$shadows = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($shadows) {
    Write-Finding -Category "VSS" -Finding "$($shadows.Count) shadow copies found on this system." -Severity "INFO"
} else {
    Write-Finding -Category "VSS" -Finding "No Volume Shadow Copies found. This may indicate prior ransomware activity or intentional deletion." -Severity "CRITICAL"
}
# Check VSS service status
$vssService = Get-Service -Name "VSS" -ErrorAction SilentlyContinue
if ($vssService.Status -ne "Running" -and $vssService.StartType -eq "Disabled") {
    Write-Finding -Category "VSS" -Finding "Volume Shadow Copy service is DISABLED. This may indicate tampering." -Severity "CRITICAL"
}

# --- CHECK 3: Recently Created Scheduled Tasks (last 7 days) ---
Write-Host "`n[CHECK 3] Enumerating scheduled tasks created in the last 7 days..." -ForegroundColor Cyan
$cutoff = (Get-Date).AddDays(-7)
$recentTasks = Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object { $_.Date -gt $cutoff }
if ($recentTasks) {
    foreach ($task in $recentTasks) {
        $actions = ($task.Actions | ForEach-Object { $_.Execute + " " + $_.Arguments }) -join "; "
        Write-Finding -Category "ScheduledTask" -Finding "Task '$($task.TaskName)' created $($task.Date) — Action: $actions" -Severity "HIGH"
    }
} else {
    Write-Finding -Category "ScheduledTask" -Finding "No suspicious scheduled tasks created in the last 7 days." -Severity "INFO"
}

# --- CHECK 4: Suspicious Processes Currently Running ---
Write-Host "`n[CHECK 4] Checking for suspicious running processes..." -ForegroundColor Cyan
$suspiciousNames = @("rclone", "megacmd", "psexec", "psexesvc", "csvde", "ntdsutil", "lazagne", "mimikatz", "procdump", "comsvcs")
foreach ($name in $suspiciousNames) {
    $procs = Get-Process -Name $name -ErrorAction SilentlyContinue
    if ($procs) {
        foreach ($proc in $procs) {
            Write-Finding -Category "Process" -Finding "Suspicious process running: $($proc.ProcessName) (PID: $($proc.Id)) — Path: $($proc.Path)" -Severity "CRITICAL"
        }
    }
}

# --- CHECK 5: New Local Admin Accounts (last 7 days) ---
Write-Host "`n[CHECK 5] Checking for recently created local accounts..." -ForegroundColor Cyan
$admins = Get-LocalGroupMember -Group "Administrators" -ErrorAction SilentlyContinue
foreach ($admin in $admins) {
    try {
        $user = Get-LocalUser -Name $admin.Name.Split("\\")[-1] -ErrorAction Stop
        if ($user.PasswordLastSet -gt $cutoff -or $user.Created -gt $cutoff) {
            Write-Finding -Category "Account" -Finding "Admin account '$($user.Name)' has recent activity (Created: $($user.Created), PasswordLastSet: $($user.PasswordLastSet))." -Severity "HIGH"
        }
    } catch { }
}

# --- CHECK 6: Recent Large Archive Files (Data Staging) ---
Write-Host "`n[CHECK 6] Scanning for recently created large archive files (potential data staging)..." -ForegroundColor Cyan
$archiveExtensions = @("*.zip", "*.rar", "*.7z", "*.tar", "*.gz", "*.bz2")
$searchPaths = @("C:\Users", "C:\Temp", "C:\Windows\Temp", "$env:APPDATA", "$env:LOCALAPPDATA")
foreach ($path in $searchPaths) {
    if (Test-Path $path) {
        foreach ($ext in $archiveExtensions) {
            $files = Get-ChildItem -Path $path -Filter $ext -Recurse -ErrorAction SilentlyContinue |
                     Where-Object { $_.LastWriteTime -gt $cutoff -and $_.Length -gt 100MB }
            foreach ($file in $files) {
                Write-Finding -Category "DataStaging" -Finding "Large archive found: $($file.FullName) ($([math]::Round($file.Length/1MB, 2)) MB, Modified: $($file.LastWriteTime))" -Severity "CRITICAL"
            }
        }
    }
}

# --- HARDENING: Disable RDP (Uncomment to activate) ---
# Write-Host "`n[HARDENING] Disabling RDP..." -ForegroundColor Magenta
# Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections" -Value 1
# Write-Finding -Category "Hardening" -Finding "RDP has been disabled." -Severity "INFO"

# --- HARDENING: Enable Windows Defender Real-Time Protection ---
$defenderStatus = Get-MpComputerStatus -ErrorAction SilentlyContinue
if ($defenderStatus) {
    if (-not $defenderStatus.RealTimeProtectionEnabled) {
        Set-MpPreference -DisableRealtimeMonitoring $false -ErrorAction SilentlyContinue
        Write-Finding -Category "Hardening" -Finding "Re-enabled Windows Defender Real-Time Protection." -Severity "INFO"
    } else {
        Write-Finding -Category "Defender" -Finding "Windows Defender Real-Time Protection is enabled." -Severity "INFO"
    }
    if ($defenderStatus.TamperProtectionEnabled -eq $false) {
        Write-Finding -Category "Defender" -Finding "Tamper Protection is DISABLED. Enable via Microsoft 365 Defender portal." -Severity "HIGH"
    }
}

# --- HARDENING: Block PsExec via Firewall (temporary) ---
# Uncomment the following lines to block inbound PsExec-style SMB named pipe access:
# New-NetFirewallRule -DisplayName "Block PsExec ADMIN$" -Direction Inbound -Protocol TCP -LocalPort 445 -RemoteAddress Any -Action Block -ErrorAction SilentlyContinue

# --- Summary ---
Write-Host "`n========================================" -ForegroundColor White
Write-Host " SCAN COMPLETE — $($findings.Count) findings" -ForegroundColor White
Write-Host " Report saved to: $reportPath" -ForegroundColor White
Write-Host "========================================" -ForegroundColor White

$findings | Out-File -FilePath $reportPath -Encoding UTF8

# Exit code based on severity
if ($findings -match "\[CRITICAL\]") {
    Write-Host "`n*** CRITICAL FINDINGS DETECTED — ISOLATE THIS SYSTEM IMMEDIATELY ***" -ForegroundColor Red
    exit 1
} elseif ($findings -match "\[HIGH\]") {
    Write-Host "`n*** HIGH SEVERITY FINDINGS — INVESTIGATE IMMEDIATELY ***" -ForegroundColor Yellow
    exit 2
} else {
    Write-Host "`nNo critical indicators found. Continue monitoring." -ForegroundColor Green
    exit 0
}

Incident Response Priorities

T-Minus Detection Checklist — Before Encryption Fires

Ransomware operators matching N0N's profile follow a predictable operational sequence. The following indicators may be detectable before mass encryption begins:

Phase 1 — Initial Access & Foothold (T-7 to T-3 days):

• Unusual VPN or RDP logon events, especially from unfamiliar IP addresses or at atypical hours
• New local or domain accounts created without corresponding change-management tickets
• Execution of credential harvesting tools (Mimikatz, LaZagne, ProcDump targeting lsass.exe)
• Phishing email delivery reports showing macro-enabled documents or HTML smuggling attachments
• Anomalous authentication to management interfaces (vCenter, FMC, Check Point SmartConsole)

Phase 2 — Reconnaissance & Lateral Movement (T-3 to T-1 days):

• Internal network scanning from non-standard sources (SharpHound, BloodHound, ADRecon execution)
• PsExec or WMI-based remote process execution events
• New remote services created on multiple hosts within a short timeframe
• SMB lateral movement to administrative shares (ADMIN$, C$, IPC$)
• Kerberos ticket anomalies (overpass-the-hash, golden ticket indicators)

Phase 3 — Data Staging & Exfiltration (T-2 to T-0 days):

• Large archive files (zip, rar, 7z) created in user directories, temp folders, or staging locations
• Execution of exfiltration tools (Rclone, MEGAcmd, FileZilla, WinSCP) with cloud storage destinations
• Abnormal outbound data transfer volumes to cloud storage or file-sharing services
• NTDS.dit access or export attempts via ntdsutil or Volume Shadow Copy

Phase 4 — Pre-Encryption (T-0 hours):

• Volume Shadow Copy deletion — vssadmin.exe delete shadows, wmic shadowcopy delete
• Boot configuration tampering — bcdedit.exe recoveryenabled no, bootstatuspolicy ignoreallfailures
• Backup service termination — sc.exe stop/delete targeting backup agents (Veeam, Commvault, Veritas)
• Security tool disablement — attempts to stop or uninstall EDR, antivirus, or monitoring agents
• Mass file system access — a single process accessing thousands of files across multiple directories

Critical Assets This Gang Historically Prioritizes

Based on the sectors represented in N0N's current campaign, organizations should prioritize protection of:

• Healthcare data: Patient records (PHI), clinical trial data, pharmaceutical research (relevant to Dompé Farmaceutici and Cogent Biosciences listing claims), dental insurance records (Delta Dental of Missouri claim)
• Customer and payment data: E-commerce transaction records, customer PII, loyalty program data (relevant to Hallmark Cards, The Container Store, Max Fashion claims)
• Intellectual property: Source code, algorithms, product roadmaps (relevant to Chartboost and Scry Analytics claims)
• Energy infrastructure data: SCADA configurations, operational technology documentation (relevant to Centrepoint claim)
• Professional services data: Client engagements, financial records, HR data (relevant to Resource Consultants claim)
• Domain controller data: NTDS.dit, Active Directory databases — universal target for any ransomware group
• Backup infrastructure: Backup catalogs, backup repositories, snapshot metadata

Containment Actions — Ordered by Urgency

If pre-ransomware indicators are detected, execute the following containment actions in order:

1. IMMEDIATE (0-15 minutes): Isolate the affected host(s) from the network. Pull the network cable or disable the switch port. Do NOT power off the system — memory-resident evidence is critical for forensic analysis.

2. IMMEDIATE (0-15 minutes): Disable the compromised user account(s) in Active Directory and any associated service accounts. Force password resets for all accounts that authenticated from or to the affected system.

3. URGENT (15-30 minutes): Block outbound traffic to known ransomware exfiltration destinations at the perimeter firewall. Specifically block or alert on connections to cloud storage APIs (mega.nz, Dropbox, Google Drive, OneDrive) from server VLANs.

4. URGENT (15-30 minutes): Disable PsExec and remote service creation across the environment via Group Policy or EDR network isolation policies. Restrict WMI and WinRM to authorized management hosts only.

5. URGENT (30-60 minutes): Verify integrity of backup infrastructure. Ensure backup systems are isolated from the production network and that backup agents have not been tampered with. Verify that Volume Shadow Copies have not been deleted on critical systems.

6. HIGH (1-4 hours): Conduct enterprise-wide hunt using the KQL query provided above. Identify all systems with matching indicators and add them to the containment scope.

7. HIGH (1-4 hours): Activate incident response retainer or engage external IR support. If you suspect N0N involvement specifically, contact Security Arsenal at security@securityarsenal.com for gang-specific intelligence support.

8. MEDIUM (4-24 hours): Preserve forensic evidence. Capture memory images and disk images from affected systems before any remediation. Preserve all relevant logs (Windows Event Logs, EDR telemetry, firewall logs, VPN logs, DNS logs).

Hardening Recommendations

Immediate (Within 24 Hours)

These controls address the most likely initial access vectors for ransomware groups matching N0N's profile and would have raised the cost of intrusion significantly:

1. Patch CISA KEV vulnerabilities immediately. Verify that CVE-2026-59310 (VMware vCenter), CVE-2026-20316 (Cisco Secure FMC), and CVE-2026-50751 (Check Point Security Gateway) are patched across your environment. These are confirmed as actively exploited by ransomware operators and represent perimeter-level initial access vectors.

2. Disable or restrict RDP. If RDP is not business-critical, disable it entirely. If it is required, enforce Network Level Authentication (NLA), restrict access via firewall rules to specific source IP ranges, and place RDP behind a VPN or zero-trust access gateway. Change from default port 3389.

3. Enforce MFA on all remote access. Multi-factor authentication on VPN, webmail, RDP gateways, and cloud management consoles blocks the most common credential-based initial access techniques.

4. Audit and restrict administrative shares. Disable ADMIN$ and C$ shares on workstations via Group Policy where operationally feasible. At minimum, alert on any access to administrative shares from non-management workstations.

5. Block macro execution in Office documents. Set Office macro policies to block macros from the internet (Mark of the Web). Use Attack Surface Reduction (ASR) rules to block Office applications from creating child processes.

6. Deploy ASR rules for ransomware protection. Enable the following Microsoft Defender ASR rules in block mode:

   • Block executable content from email client and webmail
   • Block Office applications from creating executable content
   • Block credential stealing from lsass.exe
   • Block process creations originating from PsExec and WMI commands

7. Alert on Volume Shadow Copy deletion. Deploy the Sigma rule provided above to your SIEM. Any execution of vssadmin delete shadows or wmic shadowcopy delete outside of approved maintenance windows should trigger an immediate incident response page.

Short-Term (Within 2 Weeks)

These architecture-level changes reduce the blast radius and detectability window for ransomware operations:

1. Implement network segmentation. Segment your network so that a compromise in one VLAN cannot laterally propagate to critical infrastructure. Specifically isolate:

   • Backup infrastructure on a dedicated, access-controlled segment
   • Domain controllers with restricted management paths (Privileged Access Workstations only)
   • IoT and OT networks from corporate IT
   • Server-to-server SMB traffic restricted to necessary flows only

2. Deploy tiered administrative model. Implement Microsoft Tiered Administration (Tier 0/1/2) to prevent domain admin credentials from being exposed on workstations or member servers. Use LAPS for local admin password management and gMSA for service accounts.

3. Immutable backup architecture. Transition to an immutable or air-gapped backup solution where backup data cannot be modified or deleted from the production network. Verify that backup restoration is tested and documented — a backup that cannot be restored is not a backup.

4. Deploy canary files and honeypot credentials. Place decoy files with monitored access patterns in high-value directories. Deploy honey tokens (fake credentials, fake database entries) that trigger alerts when accessed or used.

5. Endpoint Detection & Response (EDR) with ransomware-specific policies. Ensure EDR is deployed across all endpoints and servers with behavioral detection enabled. Configure EDR to block or isolate on:

   • Mass file modification patterns
   • Shadow copy deletion
   • Unauthorized encryption tool execution
   • Suspicious process injection chains

6. DNS filtering and egress monitoring. Block DNS resolution for known ransomware C2 domains and exfiltration destinations. Alert on DNS queries to dynamic DNS providers and newly registered domains from server VLANs.

7. Incident response runbook rehearsal. Conduct a tabletop exercise specifically for a N0N-style double-extortion scenario. Test your organization's decision-making for ransom negotiation, regulatory notification, law enforcement engagement, and public communications. The time to decide whether you will negotiate is before you are named on a leak site, not after.

This briefing reflects unverified threat-actor claims observed on criminal infrastructure. Security Arsenal provides this analysis for defensive purposes only. Organizations named in this report may contact us at security@securityarsenal.com for additional intelligence support or to provide corrections.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub