Classification: TLP:CLEAR | Publication Date: 2026-11-12 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 22 Leak-Site Listings Across Five Countries — Claim Verification Gaps, Exposure Analysis & Detection Rules

Executive Summary

Between 2026-11-09 and 2026-11-11, the N0N ransomware operation published 22 victim listings on its dark web leak site, with the bulk (19 of 22) posted in a single 24-hour burst on 2026-11-09. The named organizations are anonymized in our source data (Company #199 through #213); geographic attribution spans Qatar (QA), Ethiopia (ET), the United States (US), the Netherlands (NL), and Italy (IT), with two listings carrying no country attribution. Critically, none of the 22 listings were corroborated by a second independent crawler, and sector attribution is unavailable for every listing in the current dataset. N0N claims to have compromised each of these organizations; no claim in this dataset constitutes confirmation of a breach.

The operational pattern — a concentrated posting surge followed by a brief pause — is consistent with a batch-detonation or batch-claim playbook, where the actor stages access across multiple environments and publishes claims in waves to maximize extortion pressure. Defenders in the affected geographies, and any organization running VMware vCenter, JetBrains TeamCity, Cisco FMC, or Check Point gateways (see Exposure Hypothesis below), should treat this as a prompt to hunt for pre-encryption staging indicators immediately, not as confirmation that any specific named entity is compromised.

Sourcing & Verification

Verification posture for this briefing, stated plainly:

• Corroboration counts: 0 of 22 listings were independently observed by a second leak-site crawler. All 22 listings (Company #199–#213) appear on a single source only — ransomware.live. Single-source means we cannot independently confirm the posting itself exists as captured, let alone the underlying claim.
• What inclusion means: Every organization in this briefing appears here because the N0N threat actor claims to have compromised it and published that claim on its leak site. Inclusion reflects the threat actor's claim and is NOT confirmation of a breach. A leak-site posting is an accusation by a criminal. Ransomware groups have documented histories of listing organizations they never breached, re-listing old incidents as new, and fabricating victims outright to inflate perceived operational tempo.
• Neither silence nor denial settles the question: A named organization may dispute its listing, and a denial is likewise not proof the claim is false. Breach disclosure obligations vary by jurisdiction, sector, and data type, and not every incident is reportable. We do not draw inferences from a named organization's public silence either.
• Corrections: Security Arsenal will publish corrections to this briefing as new information emerges. We welcome contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

Attribution caveat: N0N is a low-visibility operation with limited public reporting as of this publication. The profile below distinguishes between what is directly observable from leak-site telemetry and what is inferred from behavioral patterns common to comparable crews. Items marked (inferred) should be treated as analytical assessment, not established fact.

• Known aliases: None confirmed in public reporting at this time. The group's branding uses a stylized zero ('0') in place of the letter 'o'; monitor for both "N0N" and "NON" string variants in underground forum chatter and negotiation-portal traffic.
• Operating model: (Inferred) Behaviorally consistent with a closed or semi-closed group rather than a high-volume open RaaS. The batch-posting pattern (19 listings in one day, then near-silence) suggests a small operator set working a staged victim pipeline rather than a broad affiliate program publishing claims continuously.
• Ransom demands: No verified ransom amounts are available in the current dataset. Comparable mid-tier crews typically open demands at 3–7% of estimated victim annual revenue, negotiable downward 40–60% through the portal. Treat any specific figure circulating on forums as unverified.
• Initial access methods: (Inferred) No victim-specific access vector is confirmed. The exposure hypothesis section below covers KEV-listed vulnerabilities in edge and management infrastructure (vCenter, TeamCity, Cisco FMC, Check Point) that ransomware operators broadly are exploiting in 2026; common vectors for crews of this profile also include phishing with macro/HTML-smuggling delivery, exposed RDP, and purchased VPN credentials from initial access brokers.
• Extortion approach: Double extortion — leak-site publication of named victims implies a data-theft-then-encrypt or data-theft-only-then-threaten model. The leak site is the pressure mechanism; assume exfiltration is claimed in every listing even where encryption is unconfirmed.
• Dwell time: Unknown for this group specifically. Industry-wide median dwell time for ransomware operators in 2025–2026 reporting clusters at 4–11 days, with the exfiltration phase typically beginning 24–72 hours before encryption or first leak-site publication. Use this window to scope retro-hunts.

Current Campaign Analysis

Posting frequency and escalation pattern

The 22 listings in the last 100 postings all fall within 2026-11-09 through 2026-11-11:

• 2026-11-09: 13 listings (Company #199–#211 range, including the unknown-country entries #206 and #208)
• 2026-11-11: 2 listings (Company #212, Company #213)
• Remainder distributed across 2026-11-09 per source timestamps

This is a burst pattern, not a steady drip. Two interpretations: (1) a single intrusion set matured simultaneously and the operator published claims in one administrative session; or (2) the group is padding the site with claims of varying authenticity to simulate scale. The 0/22 corroboration rate keeps both hypotheses open.

Geographic concentration

Of the 15 listings with visible metadata in our sample: US — 9, QA — 1, ET — 1, NL — 1, IT — 1, unknown — 2. The US weighting (60% of attributed listings) is consistent with ransom-payment propensity targeting. The presence of Qatar and Ethiopia — less commonly seen in top-tier crew victimology — may indicate opportunistic exposure-driven access rather than deliberate market selection, or an initial access broker feeding the group whatever credentials are selling.

Sector targeting

Sector attribution is Not Found for all 22 listings. We will not invent sector data. Defensive implication: no industry can self-exempt, and no industry-specific spike can be claimed. The correct posture is geography- and exposure-driven (below), not sector-driven.

Victim profile

With sectors and revenue data unavailable, no defensible victim-size estimate exists. The anonymized naming convention ("Company #NNN") itself is notable: it suggests the actor is withholding victim identities pending negotiation — a standard double-extortion pressure tactic in which full naming is the escalation lever if payment stalls. Expect de-anonymization of some listings within 7–21 days if negotiations fail.

Exposure hypothesis — KEV vulnerabilities

This is a hypothesis, not attribution. No evidence links any specific CVE to any specific listing above. However, the following CISA KEV entries are confirmed ransomware-exploited and represent perimeter/management-plane exposure that any organization in the affected geographies should remediate regardless of N0N:

Prioritization logic: internet-facing instances of any of the above, in QA/ET/US/NL/IT, unpatched past KEV due dates, constitute the highest-probability overlap with this campaign's access profile.

Detection Engineering

The following detections target the TTP cluster consistent with double-extortion crews of N0N's profile: edge/VPN access, RDP and remote-service lateral movement, and pre-encryption staging (shadow copy deletion, archive creation, exfil tooling).

---
title: External RDP Logon Burst Following Failed Authentication - Potential Brute Force Success
id: 7c1a9f2e-n0n1-4a2b-8c3d-rdpbrute0001
status: experimental
description: Detects a successful network logon (Type 3/10) from an external IP preceded by 10+ failed logons within 15 minutes. Consistent with RDP/VPN credential attacks used as ransomware initial access.
author: Security Arsenal Threat Intelligence
date: 2026/11/12
references:
  - https://securityarsenal.com/darkside
logsource:
  product: windows
  service: security
detection:
  selection_failed:
    EventID: 4625
    LogonType:
      - 3
      - 10
  selection_success:
    EventID: 4624
    LogonType:
      - 3
      - 10
  filter_internal:
    IpAddress|startswith:
      - '10.'
      - '192.168.'
      - '172.16.'
  condition: selection_failed and selection_success and not filter_internal
timeframe: 15m
falsepositives:
  - Legitimate remote users with expired cached credentials
  - Misconfigured service accounts
level: high
tags:
  - attack.initial_access
  - attack.t1110
  - attack.t1078
---
title: Remote Service Creation via PsExec or WMI - Lateral Movement Indicator
id: 7c1a9f2e-n0n1-4a2b-8c3d-psexec00002
status: experimental
description: Detects service installation events (7045) with PsExec-style naming patterns or binaries executing from ADMIN$/temp shares, consistent with ransomware-operator lateral movement tooling.
author: Security Arsenal Threat Intelligence
date: 2026/11/12
references:
  - https://securityarsenal.com/darkside
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 7045
  selection_psexec:
    ServiceName|contains:
      - 'PSEXESVC'
      - 'PAExec'
      - 'csexec'
      - 'RemCom'
  selection_paths:
    ImagePath|contains:
      - '\ADMIN$\'
      - '\Temp\'
      - '\Users\Public\'
    ImagePath|endswith: '.exe'
  condition: selection and (selection_psexec or selection_paths)
falsepositives:
  - Legitimate administrative tooling (SCCM, PDQ Deploy) - baseline known deployment servers
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002
  - attack.t1043
---
title: Pre-Encryption Staging - Shadow Copy Deletion Combined with Archive Utility Execution
id: 7c1a9f2e-n0n1-4a2b-8c3d-staging00003
status: experimental
description: Detects Volume Shadow Copy deletion via vssadmin/wmic/bcdedit in proximity to execution of archive utilities (rar, 7z) - the classic pre-detonation sequence of double-extortion ransomware operations.
author: Security Arsenal Threat Intelligence
date: 2026/11/12
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    - Image|endswith: '\vssadmin.exe'
      CommandLine|contains:
        - 'delete shadows'
        - 'Delete Shadows'
    - Image|endswith: '\wmic.exe'
      CommandLine|contains: 'shadowcopy delete'
    - Image|endswith: '\bcdedit.exe'
      CommandLine|contains: 'recoveryenabled no'
  selection_archive:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\7za.exe'
      - '\winrar.exe'
    CommandLine|contains:
      - ' a '
      - ' -p'
  condition: selection_vss or selection_archive
timeframe: 1h
falsepositives:
  - IT backup maintenance windows (vssadmin delete shadows is rare in normal ops - investigate all hits)
  - Legitimate software packaging using 7z
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.t1560.001
  - attack.exfiltration

// Sentinel hunt: pre-ransomware staging behavior cluster
// Looks for discovery + archive staging + shadow copy tampering within a 4h window per host
// Scope: 14 days (covers typical dwell-time window for exfil-before-encrypt crews)
let lookback = 14d;
let window = 4h;
let Discovery = SecurityEvent
    | where TimeGenerated > ago(lookback)
    | where EventID == 4688
    | where Process has_any ("net.exe", "net1.exe", "nltest.exe", "arp.exe", "ipconfig.exe")
    | where CommandLine has_any ("group \"domain admins\"", "/domain_trusts", "localgroup administrators", "view \\\\", "adapters")
    | project DiscoveryTime=TimeGenerated, Computer, Account, DiscoveryCmd=CommandLine;
let ArchiveStaging = SecurityEvent
    | where TimeGenerated > ago(lookback)
    | where EventID == 4688
    | where Process has_any ("rar.exe", "7z.exe", "7za.exe", "winrar.exe")
    | where CommandLine has_any (" a ", " -p", " -m5", " -v")  // create archive, password, max compression, split volumes
    | project ArchiveTime=TimeGenerated, Computer, Account, ArchiveCmd=CommandLine;
let VSSTamper = SecurityEvent
    | where TimeGenerated > ago(lookback)
    | where EventID == 4688
    | where (Process has "vssadmin.exe" and CommandLine has "delete shadows")
        or (Process has "wmic.exe" and CommandLine has "shadowcopy delete")
        or (Process has "bcdedit.exe" and CommandLine has "recoveryenabled no")
    | project VSSTime=TimeGenerated, Computer, Account, VSSCmd=CommandLine;
Discovery
| join kind=inner ArchiveStaging on Computer, Account
| where ArchiveTime between (DiscoveryTime .. DiscoveryTime + window)
| join kind=inner VSSTamper on Computer
| where VSSTime between (DiscoveryTime .. DiscoveryTime + window)
| project Computer, Account, DiscoveryTime, DiscoveryCmd, ArchiveTime, ArchiveCmd, VSSTime, VSSCmd
| summarize arg_max(VSSTime, *) by Computer
| sort by DiscoveryTime asc;

# Security Arsenal Rapid Triage - run on suspected staging hosts or as a fleet-wide GPO/Intune push
# Checks: exposed RDP, scheduled tasks created in last 7 days, shadow copy tampering, suspicious services
# Usage: Run elevated. Review output file before assuming compromise.

$report = "C:\IR-Triage_$(hostname)_$(Get-Date -Format 'yyyyMMdd_HHmm').txt"
"=== N0N-Campaign Rapid Triage - $(hostname) - $(Get-Date) ===" | Out-File $report

# 1. RDP exposure check
"`n--- RDP Configuration ---" | Out-File $report -Append
$rdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections
"RDP Enabled (0=enabled): $rdpEnabled" | Out-File $report -Append
$nla = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -ErrorAction SilentlyContinue).SecurityLayer
"NLA/SecurityLayer: $nla (2=TLS required)" | Out-File $report -Append
Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue |
    Select-Object LocalAddress, LocalPort, State | Out-File $report -Append

# 2. Scheduled tasks created/modified in last 7 days (persistence check)
"`n--- Scheduled Tasks Modified Since $((Get-Date).AddDays(-7).ToString('yyyy-MM-dd')) ---" | Out-File $report -Append
Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt (Get-Date).AddDays(-7) } |
    Select-Object TaskName, TaskPath, Date, @{N='RunAs';E={$_.Principal.UserId}},
        @{N='Action';E={($_.Actions | ForEach-Object { $_.Execute + ' ' + $_.Arguments }) -join '; '}} |
    Format-List | Out-File $report -Append

# 3. Shadow copy status (ransomware pre-detonation tampering)
"`n--- Volume Shadow Copies ---" | Out-File $report -Append
$shadows = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) { "WARNING: No shadow copies found - possible deletion event." | Out-File $report -Append }
else { $shadows | Select-Object DeviceObject, InstallDate, VolumeName | Format-List | Out-File $report -Append }
"VSS Service State: $((Get-Service VSS).Status)" | Out-File $report -Append

# 4. Non-standard services pointing at temp/user paths (PsExec-style lateral movement residue)
"`n--- Suspicious Service Binaries ---" | Out-File $report -Append
Get-WmiObject Win32_Service | Where-Object {
    $_.PathName -match 'Temp|Users\\Public|ADMIN\$|ProgramData\\[A-Za-z0-9]{6,}\\' -and
    $_.PathName -notmatch 'Windows\\Temp\\[a-f0-9-]{36}'  # exclude common installer GUID temp
} | Select-Object Name, State, StartMode, PathName | Format-List | Out-File $report -Append

# 5. Recent failed logon bursts (brute force indicator) - last 24h, top source IPs
"`n--- Failed Logon Bursts (24h) ---" | Out-File $report -Append
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)} -ErrorAction SilentlyContinue |
    ForEach-Object { ([xml]$_.ToXml()).Event.EventData.Data | Where-Object Name -eq 'IpAddress' | Select-Object -ExpandProperty '#text' } |
    Group-Object | Sort-Object Count -Descending | Select-Object -First 10 Name, Count |
    Format-Table | Out-File $report -Append

"`nTriage complete: $report"

Incident Response Priorities

T-minus detection checklist (pre-encryption)

If any listing plausibly maps to your organization or a third party in your supply chain, hunt this sequence — it is the standard double-extortion kill chain:

1. T-96 to T-48h: Anomalous authentication to VPN/RDP/vCenter from new geographies or ASN; new local admin creation; net group "domain admins" /domain enumeration.
2. T-72 to T-24h: Archive utility execution (rar/7z) against file shares, HR directories, finance folders; unusually large outbound transfers to cloud storage (MEGA, GoFile, Dropbox) or unfamiliar VPS IPs.
3. T-24 to T-1h: vssadmin delete shadows, bcdedit recoveryenabled no, backup-agent service stops (Veeam, Commvault), EDR tampering attempts (driver loads, service disables).
4. Detonation: Simultaneous file-renaming bursts across hosts; ransomware note drops; wallpaper changes. If you are here, the exfil already happened — shift to extortion management.

Assets historically prioritized for exfiltration by double-extortion crews

• HR records (PII — maximizes regulatory exposure under GDPR for NL/IT entities, state breach laws for US)
• Legal correspondence and litigation files (privilege pressure)
• Financial statements, tax records, M&A material (insider-trading / competitive pressure)
• Source code repositories and CI/CD secrets (relevant to the TeamCity KEV exposure hypothesis — a compromised build server yields both)
• Customer databases and contracts (third-party notification cascades)

Containment actions, ordered by urgency

1. Isolate, don't reboot. Segmented network isolation preserves volatile memory for forensics. Rebooting destroys staging evidence and can trigger dead-man encryption logic.
2. Kill the egress path. Block outbound to known exfil destinations and throttle abnormal upload volumes at the proxy/firewall. Cutting exfil mid-stream degrades extortion leverage.
3. Credential scorch. Force-reset all privileged accounts, KRBTGT (twice), service accounts, and any VPN/RDP-accessible credentials. Assume full credential theft.
4. Snapshot and preserve hypervisors. Given the vCenter KEV exposure, treat the virtualization layer as compromised until proven otherwise; preserve VM logs before cleanup.
5. Activate legal/comms early. With 0/22 corroboration, a listing may be fabricated — but disclosure-clock analysis and extortion-negotiation counsel should start on suspicion, not confirmation.
6. Do not pay as a first move. Payment does not guarantee data deletion and, in some jurisdictions, creates sanctions exposure. Engage professional negotiation support first.

Hardening Recommendations

Immediate (24 hours)

• Patch the KEV five — vCenter (CVE-2026-59310), TeamCity (CVE-2026-63077), Cisco FMC (CVE-2026-20316), Check Point (CVE-2026-50751), Nx Console (CVE-2026-48027). These are confirmed ransomware-exploited; internet-facing instances are the priority. If patching is impossible, isolate the management interfaces behind allow-listed VPN-only access today.
• Disable or ACL RDP to known-admin jump hosts only; enforce NLA; move any 3389 exposure behind VPN with MFA.
• Deploy the Sigma rules and KQL query above into your SIEM; run the triage script against any host with recent anomalous logons.
• Audit shadow copies and backup integrity — verify VSS snapshots exist on file servers and that backups are offline/immutable and restorable (test one restore this week).
• Enable egress alerting on >1GB outbound transfers to consumer cloud storage and unfamiliar ASNs.

Short-term (2 weeks)

• Phishing-resistant MFA everywhere — FIDO2 for VPN, RDP gateways, vCenter, and all remote administration. Credential replay is the cheapest access vector and the one most crews of this profile rely on.
• Tiered administration model — separate workstation/server/identity admin tiers; no domain admin logons on general-purpose hosts. This breaks the credential-theft-to-mass-encryption path.
• Segment CI/CD and virtualization management planes onto dedicated VLANs with default-deny east-west rules. TeamCity and vCenter should not be reachable from user subnets.
• Deploy canary files and decoy shares — early-warning tripwires that fire on first-touch, well before encryption spreads.
• EDR in block mode with tamper protection enforced; alert (not just log) on EDR service-stop attempts.
• Immutable backup architecture — object-lock or air-gapped copies with a documented, exercised restore runbook. Recovery speed is the single biggest determinant of whether extortion succeeds.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub