Classification: TLP:CLEAR | Publication Date: 2026-10-25 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 22 Leak-Site Listings in Current Campaign — Sector Targeting Analysis & Detection Rules

Executive Summary

Ransomware.live monitoring of the N0N ransomware gang's dark web leak site shows 22 organizations listed in the gang's last 100 postings, with 15 of those listings published between 2026-10-23 and 2026-10-25 — a compressed three-day release cadence that suggests either a coordinated victim-publication wave or a backlog dump timed for maximum pressure. The gang claims to have compromised organizations spanning Energy & Utilities, Manufacturing, Technology, Professional Services, Healthcare, Retail & E-Commerce, and Other sectors across eight countries (BG, US, PT, AR, ES, ET, TN, CH).

Every listing on a ransomware leak site is an accusation by a criminal group, not a confirmed breach. Fifteen of the 22 listings were independently observed by a second leak-site crawler, confirming the gang did publish the claims; the underlying intrusions remain unverified. Regardless of verification status, organizations in the named sectors should treat this campaign as an active-threat signal: the detection content in this briefing targets the initial-access, lateral-movement, and pre-encryption staging behaviors consistent with this class of double-extortion operation, including exploitation of perimeter appliances and virtualization management planes tracked in CISA's Known Exploited Vulnerabilities catalog.

Sourcing & Verification

• Corroboration tier: 15 of 22 N0N listings were independently observed by a second leak-site crawler (tagged MULTI-SOURCE in this briefing); 7 appear on a single source only. MULTI-SOURCE confirms the gang published the claim — it does not confirm a breach occurred.
• Nature of claims: Inclusion on N0N's leak site reflects the threat actor's claim and is not confirmation of a breach, intrusion, or data theft. No tier of leak-site data confirms a compromise; only the named organization or its regulator can do that.
• Disputes and denials: A named organization may dispute the listing, and a denial is likewise not proof the claim is false — disclosure obligations vary by jurisdiction and sector, and not every incident is reportable. Neither silence nor denial settles the question.
• Corrections: Security Arsenal will publish corrections as verifiable information emerges and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

N0N is an emerging ransomware operation whose leak site has become consistently active in the current monitoring window. Public attribution and tooling details for N0N remain thin — the gang has no widely documented aliases, and its underground presence is primarily visible through its victim-publication activity rather than forum recruitment or affiliate marketing.

Operating model. N0N's structure is not publicly confirmed. The volume and sector diversity of its recent postings are consistent with either a small closed crew or a young Ransomware-as-a-Service (RaaS) program in early affiliate recruitment. Analysts should treat the affiliate question as unresolved and monitor underground forums for recruitment posts, which would signal a scale-up.

Extortion approach. The leak-site structure — named victims with sector tags, published in daily batches — follows the standard double-extortion playbook: file encryption plus the threat of data publication. Claims against healthcare entities (Arthritis Center of Riverside; Asisken Asistencia Médica S.A.) and a family law practice (Mach Law APC) suggest the gang is deliberately selecting organizations holding highly sensitive personal data, where leak exposure carries outsized regulatory and reputational cost.

Ransom demands and dwell time. No verified ransom amounts or negotiation artifacts for N0N are available in this dataset. For emerging double-extortion crews of this profile, industry reporting typically observes demands in the low-to-mid six figures against small and mid-sized enterprises, and dwell times ranging from days to several weeks before encryption and leak-site publication. Treat these as contextual estimates, not N0N-specific facts.

Initial access methods. No incident-response forensics specific to N0N intrusions are available. However, the gang's victimology — SMBs and mid-market firms across manufacturing, energy, and professional services — aligns with the access vectors most commonly exploited against these segments: internet-facing VPN and firewall appliances, exposed RDP, phishing with macro-enabled lures, and unpatched virtualization/CI infrastructure. The CISA KEV entries discussed below represent confirmed ransomware-exploited exposure in exactly these technology classes and should be treated as sector-level hypotheses for N0N's access vector, not as confirmed vectors for any named victim.

Current Campaign Analysis

Sector targeting

Across the 22 listings, the spread is broad but shows clear weighting toward organizations with operational sensitivity and weak security budgets:

Manufacturing is the single largest named sector — consistent with the broader 2026 trend of gangs favoring organizations where downtime pressure is immediate and cyber-insurance coverage is common.

Geographic concentration

The United States accounts for the plurality of geolocated listings (Mach Law APC, Keidel Supply Company Incorporated, Andrews Advisory Group LLC, Adirondack Networks, Inc., Arthritis Center of Riverside), but the campaign is genuinely multi-regional: Bulgaria (TOPLIVO AD), Portugal (GPIC Projectos Con Instalacoes Lda), Argentina (Asisken Asistencia Médica S.A.), Spain (Company #110), Ethiopia (Horn of Africa Regional Environment Centre and Network), Tunisia (PROTEX Confection), and Switzerland (SunTechnics Fabrisolar AG). This distribution — including regions with lower disclosure-maturity — is typical of opportunity-driven crews following exposed infrastructure rather than a geographically focused operation.

Victim profile

The named organizations skew toward small and mid-sized enterprises: regional distributors, specialty manufacturers, a family law practice, a regional medical clinic, and a fuel retailer (TOPLIVO AD). Estimated revenues for this profile generally fall between roughly $5M and $250M — large enough to pay mid-six-figure ransoms, small enough to lack 24/7 SOC coverage. The inclusion of energy-sector names (TOPLIVO AD in Bulgaria; SunTechnics Fabrisolar AG in Switzerland) and a medical assistance provider raises the stakes: even unverified claims against these entities warrant heightened attention from sector ISACs.

Posting cadence and escalation pattern

The observed listings cluster tightly: at least one listing on 2026-10-23, six on 2026-10-24, and six on 2026-10-25. This burst pattern typically indicates one of three things: (1) a batch of intrusions reaching the extortion deadline simultaneously, (2) an intentional publication wave to build the gang's brand credibility, or (3) newly onboarded affiliates dumping backlog victims. Defenders should expect the cadence to continue or accelerate over the coming week.

CVE linkage — hypothesis, not attribution

None of the following CVEs is confirmed as the initial access vector for any N0N victim. They are listed because they are (a) in CISA's KEV catalog with confirmed ransomware use and (b) present in the technology stack typical of this victim profile. Prioritize patching regardless of N0N:

• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1). Perimeter VPN gateways are the highest-probability access vector for SMB-targeting crews.
• CVE-2026-20316 — Cisco Secure Firewall Management Center hard-coded password. Management-plane compromise yields full network visibility and policy control.
• CVE-2026-59310 — VMware vCenter path traversal. vCenter access enables hypervisor-level encryption of entire VM estates — the single most devastating ransomware outcome.
• CVE-2026-63077 — JetBrains TeamCity deserialization. CI/CD compromise enables supply-chain staging and credential theft from build agents.
• CVE-2026-48027 — Nx Console embedded malicious code. Developer-tooling compromise as a supply-chain entry point.

Detection Engineering

The detections below target behaviors characteristic of double-extortion crews operating against this victim profile: perimeter/VPN exploitation, brute-force remote access, macro-based execution, PsExec/WMI lateral movement, Cobalt Strike-style beaconing, shadow-copy deletion, and pre-encryption data staging.

---
title: N0N-Style Pre-Ransomware Staging - Shadow Copy Deletion and Backup Tampering
id: 9f3a1c2e-7b4d-4e1a-a0n0-202610250001
status: experimental
description: Detects deletion of Volume Shadow Copies and backup catalog tampering via vssadmin, wmic, bcdedit, or wbadmin - behavior consistently observed in the hours immediately preceding ransomware detonation and extortion-driven leak-site publication.
author: Security Arsenal Threat Intelligence
date: 2026/10/25
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
level: high
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
      - '\wbadmin.exe'
  selection_cli:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'recoveryenabled no'
      - 'delete catalog'
      - 'delete systemstatebackup'
  condition: selection_img and selection_cli
falsepositives:
  - Legitimate backup maintenance windows (rare; vssadmin delete shadows is almost never legitimate on servers)
fields:
  - Image
  - CommandLine
  - ParentImage
  - User
tags:
  - attack.impact
  - attack.t1490
---
title: N0N-Style Lateral Movement - PsExec and Remote Service Creation via ADMIN$
id: 9f3a1c2e-7b4d-4e1a-a0n0-202610250002
status: experimental
description: Detects remote service installation and ADMIN$ writes consistent with PsExec-style tooling and SMB-based lateral movement used by ransomware operators to push encryption and exfiltration payloads across the estate.
author: Security Arsenal Threat Intelligence
date: 2026/10/25
references:
  - https://securityarsenal.com/darkside
logsource:
  product: windows
  service: system
level: high
detection:
  selection_event:
    EventID: 7045
  selection_svc:
    ServiceName|contains:
      - 'PSEXESVC'
      - 'paexec'
      - 'csexec'
      - 'RemCom'
    ServiceFileName|contains:
      - 'ADMIN$'
      - '\\%SystemRoot%\\'
  condition: selection_event and 1 of selection_svc*
falsepositives:
  - Legitimate administrative PsExec use by IT - whitelist known admin jump hosts and service accounts
fields:
  - ServiceName
  - ServiceFileName
  - ComputerName
  - AccountName
tags:
  - attack.lateral-movement
  - attack.t1569.002
  - attack.t1021.002
---
title: N0N-Style Initial Access - RDP and VPN Brute Force Followed by Successful Logon
id: 9f3a1c2e-7b4d-4e1a-a0n0-202610250003
status: experimental
description: Detects a burst of failed logons (Event 4625) from a single external source followed by a successful network logon (Event 4624 type 3/10) within a short window - the signature of RDP/VPN password spraying or brute force used by ransomware initial-access brokers.
author: Security Arsenal Threat Intelligence
date: 2026/10/25
references:
  - https://securityarsenal.com/darkside
logsource:
  product: windows
  service: security
level: medium
detection:
  selection_failed:
    EventID: 4625
    LogonType:
      - 3
      - 10
  timeframe: 10m
  condition: selection_failed | count(IpAddress) by ComputerName > 20
falsepositives:
  - Misconfigured service accounts, network scanners - tune threshold for your environment
fields:
  - IpAddress
  - TargetUserName
  - ComputerName
  - LogonType
tags:
  - attack.credential-access
  - attack.t1110
  - attack.t1133

// N0N-Style Pre-Ransomware Hunt: Lateral movement + staging indicators correlated on a single host
// Look for hosts showing remote service creation, suspicious archive compression, and shadow-copy tampering within 24h
// Microsoft Sentinel / Defender XDR
let window = 24h;
let SuspiciousServices =
    DeviceEvents
    | where TimeGenerated > ago(window)
    | where ActionType == "ServiceInstalled"
    | extend ServiceName = tostring(AdditionalFields.ServiceName)
    | where ServiceName has_any ("PSEXESVC", "paexec", "RemCom", "csexec")
       or tostring(AdditionalFields.FileName) has_any ("ADMIN$")
    | summarize ServiceEvents = count(), Services = make_set(ServiceName) by DeviceId, DeviceName;
let ShadowCopyTamper =
    DeviceProcessEvents
    | where TimeGenerated > ago(window)
    | where FileName in~ ("vssadmin.exe", "wmic.exe", "bcdedit.exe", "wbadmin.exe")
    | where ProcessCommandLine has_any ("delete shadows", "shadowcopy delete", "recoveryenabled no", "delete catalog")
    | summarize TamperEvents = count(), Cmds = make_set(ProcessCommandLine) by DeviceId, DeviceName;
let DataStaging =
    DeviceProcessEvents
    | where TimeGenerated > ago(window)
    | where FileName in~ ("rclone.exe", "7z.exe", "winrar.exe", "rar.exe", "megasync.exe", "filezilla.exe")
    | where ProcessCommandLine has_any ("copy", "sync", "a -", "-mx", "--transfers", "upload")
    | summarize StagingEvents = count(), Tools = make_set(FileName) by DeviceId, DeviceName;
SuspiciousServices
| join kind=inner ShadowCopyTamper on DeviceId
| join kind=leftouter DataStaging on DeviceId
| project DeviceName, ServiceEvents, Services, TamperEvents, Cmds, StagingEvents, Tools
| extend RiskScore = (ServiceEvents * 2) + (TamperEvents * 3) + (todouble(StagingEvents) * 1.5)
| order by RiskScore desc;

# N0N Rapid-Response Triage Script — run on suspect hosts or domain-wide via GPO/Intune
# Checks: shadow copies, scheduled tasks (last 7 days), exposed RDP, suspicious services
$ReportPath = "C:\IR-Triage-$(hostname)-$(Get-Date -Format 'yyyyMMdd-HHmm').txt"
"=== N0N RAPID TRIAGE — $(hostname) — $(Get-Date) ===" | Out-File $ReportPath

"`n[1] VOLUME SHADOW COPIES (should exist; absence = tampering indicator)" | Out-File $ReportPath -Append
try {
    $vss = Get-CimInstance Win32_ShadowCopy -ErrorAction Stop
    if ($vss) { $vss | Select-Object DeviceObject, InstallDate | Format-Table | Out-String | Out-File $ReportPath -Append }
    else { "!!! NO SHADOW COPIES FOUND — POSSIBLE VSSADMIN DELETION !!!" | Out-File $ReportPath -Append }
} catch { "VSS query failed: $_" | Out-File $ReportPath -Append }

"`n[2] SCHEDULED TASKS CREATED/MODIFIED IN LAST 7 DAYS (persistence check)" | Out-File $ReportPath -Append
Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt (Get-Date).AddDays(-7) } |
    Select-Object TaskName, TaskPath, Date, @{N='Author';E={$_.Author}} |
    Format-Table -AutoSize | Out-String | Out-File $ReportPath -Append

"`n[3] RDP EXPOSURE CHECK" | Out-File $ReportPath -Append
$rdp = Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue
$nla = Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue
"RDP Enabled: $(if ($rdp.fDenyTSConnections -eq 0) {'YES — verify NLA + MFA + restrict source IPs'} else {'No'})" | Out-File $ReportPath -Append
"NLA Required: $(if ($nla.UserAuthentication -eq 1) {'Yes'} else {'NO — ENABLE IMMEDIATELY'})" | Out-File $ReportPath -Append

"`n[4] SUSPICIOUS SERVICES (PSEXESVC / random 8-char names / ADMIN$ binaries)" | Out-File $ReportPath -Append
Get-CimInstance Win32_Service | Where-Object {
    $_.Name -match 'PSEXESVC|paexec|RemCom' -or
    $_.PathName -match 'ADMIN\$' -or
    ($_.Name -match '^[a-zA-Z0-9]{8}$' -and $_.PathName -notmatch 'system32|Program Files')
} | Select-Object Name, State, PathName, StartName | Format-Table -AutoSize | Out-String | Out-File $ReportPath -Append

"`n[5] STAGING TOOL PRESENCE (rclone/7z/rar/megasync in unusual paths)" | Out-File $ReportPath -Append
Get-ChildItem -Path 'C:\Users','C:\ProgramData','C:\Windows\Temp' -Recurse -Include 'rclone.exe','megasync.exe','7z.exe','rar.exe' -ErrorAction SilentlyContinue -Depth 3 |
    Select-Object FullName, CreationTime | Format-Table -AutoSize | Out-String | Out-File $ReportPath -Append

"`nTriage complete. Report: $ReportPath" | Out-File $ReportPath -Append
Write-Host "Triage complete -> $ReportPath"

Incident Response Priorities

T-minus detection checklist — before encryption fires:

1. vssadmin / bcdedit / wbadmin execution on servers — shadow-copy deletion is the single highest-fidelity pre-detonation signal. If you see it, assume detonation is hours away.
2. Batch remote service creation (Event 7045) across multiple hosts within minutes — mass payload staging.
3. Compression utilities (7z/rar) or rclone/megasync running under service accounts or on servers that never archive data.
4. New local/domain admin accounts or sudden additions to privileged groups, especially created outside change windows.
5. Large outbound transfers to unfamiliar cloud storage, VPS IPs, or Tor-exit-adjacent infrastructure — exfiltration typically precedes the leak-site post by days.
6. EDR/AV tampering: disabled services, deleted sensors, or Safe Mode boot configuration changes.

Assets this class of gang prioritizes for exfiltration (based on the sector mix of N0N's claimed listings):

• Legal and HR records — the Mach Law APC listing shows appetite for privileged/confidential documents; family law files are maximally coercive.
• Protected health information — the Arthritis Center of Riverside and Asisken Asistencia Médica S.A. claims indicate patient data is in scope; HIPAA/GDPR-equivalent exposure drives ransom pressure.
• Financial records, contracts, and customer databases from file servers, NAS devices, and ERP exports.
• Backup catalogs and domain controller ntds.dit — for credential theft and to destroy recovery capability.

Containment actions, ordered by urgency:

1. Isolate, don't power off affected hosts — preserve memory for forensics; kill network paths (switch ACLs, host firewall) first.
2. Disable the suspected compromised accounts and all service accounts that touched affected hosts; force enterprise-wide credential rotation starting with privileged tiers.
3. Block egress to uncategorized cloud storage and known exfil tooling at the proxy/firewall.
4. Protect backups immediately: take backup infrastructure offline from the production network, verify immutability/object-lock status, snapshot the backup catalog.
5. Sweep for persistence (scheduled tasks, services, Run keys, GPO changes) before any reconnection — re-introducing a host with intact persistence re-starts the clock.
6. Engage IR counsel and review notification obligations — but note that a leak-site listing alone does not establish that a reportable breach occurred; base notifications on your own forensic findings.

Hardening Recommendations

Immediate (24 hours):

• Patch the KEV perimeter stack now: Check Point Security Gateway (CVE-2026-50751), Cisco Secure FMC (CVE-2026-20316), VMware vCenter (CVE-2026-59310), JetBrains TeamCity (CVE-2026-63077). These are confirmed ransomware-exploited; assume scanning is continuous.
• Kill exposed RDP: if RDP must be reachable, require VPN + NLA + MFA, restrict by source IP, and alert on any 4625 burst >20 failures/10 min.
• Block macro execution from internet-sourced Office files (Mark-of-the-Web policy) and alert on Office spawning script interpreters.
• Deny vssadmin/wbadmin/bcdedit execution for non-admin users via AppLocker/WDAC and alert on any execution on servers.
• Verify backup immutability (object lock / air gap) and test one restore today — the listing of backup tampering in pre-detonation playbooks makes this non-optional.
• Deploy the Sigma rules and KQL query above to your SIEM and run the triage script against any host showing VPN/RDP logon anomalies.

Short-term (2 weeks):

• Segment the network: isolate virtualization management (vCenter), backup infrastructure, and CI/CD (TeamCity) into dedicated management VLANs reachable only from hardened jump hosts with phishing-resistant MFA.
• Implement egress filtering by default: deny all outbound traffic except through authenticated proxies with category allowlisting — this breaks rclone/megasync exfil channels.
• Tiered administration: eliminate standing domain admin use; deploy PAWs/jump boxes and just-in-time elevation so stolen credentials can't traverse laterally.
• Canary data and honey credentials: plant detectable decoy documents and fake admin accounts; access to either is a near-zero-false-positive breach signal.
• SMB-targeted controls for the victim profile: the organizations N0N names are mostly mid-market — if that describes you, prioritize MDR/24-7 monitoring over tool accumulation; the gap these gangs exploit is unattended overnight/weekend dwell time, not missing signatures.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub