Classification: TLP:CLEAR | Publication Date: 2026-10-23 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 21 New Leak-Site Listings in 72 Hours — Sector Targeting Analysis, Claim-Verification Caveats & Detection Rules

Executive Summary

Between 2026-10-21 and 2026-10-23, the N0N ransomware operation published 21 new entries on its dark web leak site, naming organizations across seven sectors and at least six countries. The gang claims to have compromised manufacturing, energy, healthcare, retail/e-commerce, and technology firms, along with a large block of anonymized "Company #101–#109" entries suggesting either staged extortion pressure or victims mid-negotiation.

Every entry in this dataset is an accusation by a criminal actor, not a confirmed breach. 12 of the 21 listings were independently observed by a second leak-site crawler (confirming the gang posted the claim); 9 appear on ransomware.live only. No tier of this data confirms that any intrusion occurred. Named organizations may dispute these listings, and neither confirmation nor denial is available for any of them at time of publication.

For defenders, the actionable signal is not the victim list itself but N0N's operating tempo and sector spread: a compressed 72-hour posting wave spanning critical infrastructure-adjacent sectors (Energy & Utilities, Healthcare) alongside mid-market manufacturing and retail. Organizations in these sectors should treat this window as an elevated-threat period and run the detection content in this briefing now.

Sourcing & Verification

This briefing is built from ransomware.live leak-site monitoring of N0N's .onion infrastructure. Readers must understand exactly what this data is — and is not:

• 12 of 21 listings were independently observed by a second leak-site crawler (tier: MULTI-SOURCE). This confirms the gang published the claim — nothing more.
• 9 of 21 listings appear on ransomware.live only (tier: SINGLE-SOURCE). A second crawler has not confirmed these postings exist; treat them with additional caution.
• Inclusion in this briefing reflects the threat actor's claim and is NOT confirmation of a breach for any organization named.
• A named organization may dispute a listing. A denial is likewise not proof the claim is false — disclosure obligations vary by jurisdiction and sector, and not every incident is reportable. Neither silence nor denial settles the question.
• Security Arsenal will publish corrections to this briefing and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

Current Campaign Analysis

Claimed Victim Listings (2026-10-21 → 2026-10-23)

N0N's leak site lists the following named organizations. Per sourcing rules, these are unverified criminal claims:

• Horn of Africa Regional Environment Centre and Network (Other, ET) — 2026-10-23 [MULTI-SOURCE]
• PROTEX Confection (Manufacturing, TN) — 2026-10-23 [MULTI-SOURCE]
• SunTechnics Fabrisolar AG (Energy & Utilities, CH) — 2026-10-23 [MULTI-SOURCE]
• Performance Ford Inc (Retail & E-Commerce, US) — 2026-10-22 [MULTI-SOURCE]
• Heritage Senior Living (Healthcare, US) — 2026-10-21 [MULTI-SOURCE]
• Hanjin Information Systems & Telecommunication Co., Ltd. (Technology, KR) — 2026-10-21 [MULTI-SOURCE]

Nine additional entries use anonymized "Company #101–#109" placeholders (including entries geolocated to BG and PT). Eight of these are SINGLE-SOURCE and one (Company #103, PT) — along with #101 and #102 — lacks second-crawler confirmation that the posting even exists.

Sector Targeting

The named listings cluster in Manufacturing, Energy & Utilities, Retail & E-Commerce, Healthcare, and Technology — a classic RaaS affiliate portfolio balancing high-pressure sectors (healthcare, energy) against soft-target mid-market firms. The solar/renewables energy listing (SunTechnics Fabrisolar AG) and the senior-living healthcare listing (Heritage Senior Living) fit the established pattern of targeting organizations with low downtime tolerance and sensitive data inventories.

Geographic Concentration

Spread across ET, TN, CH, US, BG, KR, and PT — no single-country concentration. This dispersion is characteristic of opportunity-driven affiliate access (whatever edge device or phished credential comes up) rather than a directed geographic campaign.

Victim Profile

Named organizations skew small-to-mid-market: regional automotive retail, specialty manufacturing, senior-care operators, and a national IT services firm. These are precisely the organizations most likely to have internet-facing edge infrastructure without 24/7 SOC coverage — and most likely to appear as leak-site claims without subsequent public breach disclosure.

Posting Frequency & Escalation

21 listings in ~72 hours, with a visible cadence pattern: named victims published first (pressure tier), interleaved with anonymized "Company #" entries (negotiation tier). Expect the anonymized entries to either resolve to named organizations or disappear (payment/takedown) over the next 7–14 days. Analysts should re-pull the leak site daily.

CVE Exposure Hypothesis (Sector-Level — NOT Victim Attribution)

We have no evidence linking any specific CVE to any specific named listing above. However, N0N's known initial-access pattern (edge device and management-plane exploitation) maps directly onto currently KEV-listed vulnerabilities with confirmed ransomware use. Organizations in the targeted sectors should treat the following as priority patch items:

• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1). Perimeter gateway compromise is a direct match for this gang's access profile.
• CVE-2026-20316 — Cisco Secure FMC hard-coded password. Management-plane takeover of the firewall stack.
• CVE-2026-59310 — VMware vCenter path traversal. Hypervisor management compromise enables mass encryption — the highest-impact pre-ransomware target.
• CVE-2026-63077 — JetBrains TeamCity deserialization. CI/CD compromise enables supply-chain-style lateral spread and credential theft.
• CVE-2026-48027 — Nx Console embedded malicious code. Developer-workstation initial access vector.

If any of these are unpatched in your environment, you are carrying the same exposure this gang's affiliates are known to monetize.

Detection Engineering

The following content targets N0N's known playbook: edge exploitation → credential theft → WMI/PsExec lateral movement → data staging → shadow copy deletion → detonation.

---
title: N0N Ransomware - Pre-Encryption Defense Evasion via Shadow Copy Deletion
id: 8f3a2c11-4b7e-4d9a-a1c2-n0n000000001
status: experimental
description: Detects Volume Shadow Copy deletion and backup catalog tampering consistent with N0N pre-encryption staging. High-fidelity when correlated with vssadmin, wmic, or bcdedit execution by non-system accounts.
author: Security Arsenal Threat Intelligence
date: 2026/10/23
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
  selection_cmd:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'delete catalog'
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
  filter_system:
    User|contains: 'SYSTEM'
  condition: selection_img and selection_cmd and not filter_system
falsepositives:
  - Legitimate backup maintenance windows (filter on approved service accounts and change tickets)
level: high
tags:
  - attack.impact
  - attack.t1490
---
title: N0N Ransomware - Lateral Movement via PsExec or Remote Service Creation
id: 8f3a2c11-4b7e-4d9a-a1c2-n0n000000002
status: experimental
description: Detects remote service installation and PsExec-style execution patterns used by N0N affiliates for lateral movement prior to mass encryption deployment.
author: Security Arsenal Threat Intelligence
date: 2026/10/23
references:
  - https://securityarsenal.com/darkside
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 7045
    ServiceName|contains:
      - 'PSEXESVC'
      - 'PAExec'
      - 'csexecsvc'
    ServiceFileName|contains:
      - '\ADMIN$\'
      - '\IPC$\'
      - '%TEMP%'
      - 'PSEXESVC.exe'
  condition: selection
falsepositives:
  - Enterprise software deployment tools (SCCM, PDQ) — baseline approved deployment servers and alert on deviations
level: high
tags:
  - attack.lateral_movement
  - attack.t1569.002
  - attack.t1021.002
---
title: N0N Ransomware - Data Staging via Archiving Utility Before Exfiltration
id: 8f3a2c11-4b7e-4d9a-a1c2-n0n000000003
status: experimental
description: Detects mass compression of data into archives using rar/7z with password flags, a consistent N0N staging behavior before double-extortion exfiltration.
author: Security Arsenal Threat Intelligence
date: 2026/10/23
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\7za.exe'
      - '\winrar.exe'
  selection_cmd:
    CommandLine|contains:
      - ' a '
      - '-p'
      - '-hp'
      - '-v500m'
      - '-v1g'
  condition: selection_img and selection_cmd
falsepositives:
  - IT archival workflows — correlate with volume (multiple archives across file servers in short windows is the malicious signature)
level: medium
tags:
  - attack.collection
  - attack.t1560.001

// N0N pre-ransomware hunt: lateral movement + staging chain within 6h window
// Run across the last 7 days; results clustered by device indicate an active intrusion chain
let Window = 7d;
let Lateral =
    DeviceProcessEvents
    | where TimeGenerated > ago(Window)
    | where FileName in~ ("psexec.exe", "psexesvc.exe", "wmic.exe", "wmiprvse.exe")
       or (ProcessCommandLine has_any ("\\ADMIN$", "\\IPC$") and InitiatingProcessAccountName !in~ ("system"))
    | project LateralTime = TimeGenerated, DeviceName, AccountName = InitiatingProcessAccountName, LateralCmd = ProcessCommandLine;
let Staging =
    DeviceProcessEvents
    | where TimeGenerated > ago(Window)
    | where FileName in~ ("rar.exe", "7z.exe", "7za.exe", "winrar.exe")
       and ProcessCommandLine has_any (" -p", " -hp", " -v")
    | project StageTime = TimeGenerated, DeviceName, StageCmd = ProcessCommandLine;
let ShadowDel =
    DeviceProcessEvents
    | where TimeGenerated > ago(Window)
    | where ProcessCommandLine has_any ("delete shadows", "shadowcopy delete", "recoveryenabled no")
    | project ShadowTime = TimeGenerated, DeviceName, ShadowCmd = ProcessCommandLine;
Lateral
| join kind=inner Staging on DeviceName
| join kind=inner ShadowDel on DeviceName
| where StageTime between (LateralTime .. LateralTime + 6h) and ShadowTime between (StageTime .. StageTime + 6h)
| summarize FirstSeen = min(LateralTime), LastSeen = max(ShadowTime), DistinctHosts = dcount(DeviceName),
    SampleCommands = make_set(strcat(LateralCmd, " | ", StageCmd, " | ", ShadowCmd), 3)
    by DeviceName, AccountName
| order by LastSeen desc;

# N0N Rapid Triage Script — run elevated on suspect hosts during elevated-threat windows
# Checks: exposed RDP, scheduled tasks added in last 7 days, shadow copy tampering, suspicious services
$days = 7
$cutoff = (Get-Date).AddDays(-$days)
$report = @()

# 1. RDP exposure check
$rdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$nlaEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -ErrorAction SilentlyContinue).UserAuthentication -eq 1
if ($rdpEnabled -and -not $nlaEnabled) {
    $report += "[HIGH] RDP enabled WITHOUT NLA - brute-force exposure (known N0N access path)"
}

# 2. Scheduled tasks created in last 7 days (persistence check)
Get-ScheduledTask | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    $taskPath = (Get-Item ("HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree" + $_.TaskPath + $_.TaskName) -ErrorAction SilentlyContinue)
    if ($taskPath -and $taskPath.GetValue('SD')) {
        # Fallback: check task XML registration date
        $xml = Export-ScheduledTask -TaskName $_.TaskName -TaskPath $_.TaskPath -ErrorAction SilentlyContinue
        if ($xml -match '<Date>([^<]+)</Date>' -and ([datetime]$Matches[1]) -gt $cutoff) {
            $report += "[MED] New scheduled task: $($_.TaskPath)$($_.TaskName)"
        }
    }
}

# 3. Shadow copy status (deletion = imminent encryption indicator)
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) {
    $report += "[CRITICAL] No Volume Shadow Copies present - possible vssadmin deletion (T1490)"
}

# 4. Suspicious services (PsExec-style lateral movement artifacts)
Get-CimInstance Win32_Service | Where-Object {
    $_.Name -match 'PSEXESVC|PAExec|csexec' -or $_.PathName -match 'ADMIN\$|TEMP\\.*\.exe'
} | ForEach-Object { $report += "[HIGH] Suspicious service: $($_.Name) -> $($_.PathName)" }

# 5. Recent failed logons (RDP brute-force signature)
$fails = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=$cutoff} -MaxEvents 5000 -ErrorAction SilentlyContinue |
    Group-Object { $_.Properties[5].Value } | Where-Object Count -gt 50
$fails | ForEach-Object { $report += "[MED] $($_.Count) failed logons for account '$($_.Name)' in last $days days" }

if ($report) { $report | ForEach-Object { Write-Host $_ -ForegroundColor Red } }
else { Write-Host "[OK] No N0N-aligned indicators found on $env:COMPUTERNAME" -ForegroundColor Green }

Incident Response Priorities

T-Minus Detection Checklist (Before Encryption Fires)

1. vssadmin / bcdedit / wbadmin execution by any non-backup account — the single highest-fidelity pre-detonation signal.
2. Mass archive creation (rar/7z with password flags) on file servers — data staging for double extortion.
3. PsExec service artifacts (PSEXESVC) or Event ID 7045 service installs across multiple hosts in short windows.
4. New scheduled tasks on servers, especially those invoking payloads from TEMP or user-profile paths.
5. EDR/AV tampering: service stops, exclusion additions, or uninstall attempts on security tooling.
6. Outbound spikes to cloud storage (MEGA, GoFile, Temp.sh) or unfamiliar VPS endpoints from server VLANs.

Assets This Gang Prioritizes for Exfiltration

Based on sector targeting in this campaign, assume N0N operators prioritize: HR/payroll records (healthcare/senior-living listings), customer PII and payment data (retail/e-commerce), engineering/IP documents (manufacturing/energy), and financial records usable for extortion leverage. Identify where these live and confirm exfiltration egress filtering covers them today.

Containment — Ordered by Urgency

1. Isolate, don't reboot. Network-isolate any host showing T-minus indicators. Reboots destroy volatile evidence and can trigger detonation logic.
2. Kill edge access. Disable compromised VPN/firewall management interfaces; force credential resets domain-wide (assume credential theft occurred days ago).
3. Snapshot and preserve. Image affected hosts and capture memory before remediation.
4. Block staging egress. Emergency-block consumer file-sharing and unclassified outbound destinations at the proxy.
5. Validate backups offline. Confirm restore integrity from immutable copies before declaring containment — N0N's playbook includes backup discovery and deletion.
6. Assume double extortion. Engage legal/comms early; the leak-site clock starts at intrusion, not at detection.

Hardening Recommendations

Immediate (24 Hours)

• Patch the KEV set above: CVE-2026-50751 (Check Point), CVE-2026-20316 (Cisco FMC), CVE-2026-59310 (vCenter), CVE-2026-63077 (TeamCity), CVE-2026-48027 (Nx Console). These are confirmed ransomware-exploited and map to this gang's access profile.
• Enforce NLA + MFA on all RDP, or disable external RDP entirely. Audit for brute-force failures (Event 4625 spikes).
• Deploy the Sigma rules and KQL query in this briefing; run the triage PowerShell script on internet-adjacent servers.
• Verify immutable/offline backups and test one restore today.
• Block macro execution from internet-sourced Office documents (Mark of the Web policies).

Short-Term (2 Weeks)

• Segment management planes: vCenter, firewall management, and CI/CD infrastructure must not be reachable from general user VLANs.
• Deploy deception tripwires: canary credentials and honey file-shares that alert on staging behavior.
• Implement egress allowlisting on server subnets — ransomware staging dies without outbound bulk transfer.
• Move to phishing-resistant MFA (FIDO2) on all remote access and privileged accounts.
• Establish a leak-site monitoring watch for your organization name and brand terms — the first notification of an N0N claim may come from the dark web, not your SOC.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub