Classification: TLP:CLEAR | Publication Date: 2026-10-17 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 23 New Leak-Site Listings in 24 Hours

Executive Summary

On 2026-10-16, the ransomware group N0N posted 23 new victim listings to its dark web leak site — the largest single-day posting burst we have observed from this actor in recent monitoring. The listings claim organizations in manufacturing, healthcare, and technology sectors, with a geographic concentration in the United States, alongside claims referencing Egypt (EG) and the Netherlands (NL).

Every item below is a claim made by a criminal actor on an extortion site. N0N has listed these organizations; this briefing does not assert — and the underlying data does not support — that any named organization was breached. Of the 23 listings, 17 were independently observed by a second leak-site crawler (confirming the gang made the posting) and 6 appear on a single source only. No tier of this data confirms an intrusion occurred.

Security teams in manufacturing and healthcare — particularly US-based mid-market firms — should treat this burst as a sector-level exposure signal: review the CVEs below, run the detection content in this briefing, and validate backup and segmentation posture. Do not wait for a ransom note.

Sourcing & Verification

• Corroboration breakdown: 17 of 23 listings were independently observed by a second leak-site crawler (MULTI-SOURCE). 6 listings — including "Company #82" — appear on ransomware.live only (SINGLE-SOURCE), meaning we cannot yet confirm the gang itself made those postings.
• What corroboration means: MULTI-SOURCE confirms only that two independent crawlers saw N0N publish the claim. It does not confirm a breach, data theft, or any intrusion. No tier in this dataset confirms victimization — only the named organization or its regulator can do that.
• Inclusion is not accusation by us: Every organization named in this briefing appears because the threat actor claims to have compromised it. A named organization may dispute the listing. A denial is likewise not proof the claim is false — disclosure obligations vary by jurisdiction, not every incident is reportable, and neither silence nor denial settles the question.
• Corrections: Security Arsenal will publish corrections promptly and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

Note: N0N is a lower-profile actor; elements of this profile are assessed from observed posting behavior and ecosystem-typical TTPs rather than confirmed insider reporting. Treat profile specifics as directional.

Current Campaign Analysis

Victim listings (2026-10-16 posting burst)

All entries below are N0N's claims, published to its leak site on 2026-10-16. Corroboration tier refers to whether a second crawler observed the posting — never to breach confirmation.

Named listings:

• Xinos Construction Corp and its accounting group (Manufacturing, country undisclosed) — [MULTI-SOURCE]
• BladeTech Inc (Manufacturing, US) — [MULTI-SOURCE]
• EnVision Eye Care (Healthcare, country undisclosed) — [MULTI-SOURCE]

Unnamed listings ("Company #NN" as posted): N0N also listed Company #71, #72, #74, #75, #76, #77, #78, #79, #80, #81, and #83 [MULTI-SOURCE], plus Company #82 [SINGLE-SOURCE]. Sector for these is recorded as "Not Found" in our collection; claimed countries include the US and undisclosed (?). The high proportion of anonymized listings is itself notable — gangs typically anonymize victims still inside an extortion negotiation window, which suggests a portion of this batch may represent ongoing pressure campaigns rather than refused negotiations.

Sector targeting

Claimed sectors across the recent 100-posting window: Manufacturing, Healthcare, Technology (plus unresolved "Not Found" entries). Manufacturing and healthcare are classic high-pressure targets: operational downtime is expensive, and healthcare carries regulatory and patient-safety leverage that gangs exploit in negotiations. The named healthcare claim (EnVision Eye Care) and manufacturing claims (Xinos Construction Corp, BladeTech Inc) fit this pattern — again, as claims only.

Geographic concentration

Claimed countries: US (dominant), EG, NL. The US weighting matches the broader ransomware economy; the EG and NL entries indicate the operation is not region-locked and will claim victims wherever access is available.

Victim profile

Based on the named listings and sector mix, the claimed victim set skews toward mid-market organizations — regional manufacturers, specialty healthcare providers, and construction firms. Estimated revenue bands for organizations of this profile typically fall between $10M and $500M, the segment most frequently targeted by double-extortion crews because they carry cyber insurance, hold sensitive data, and often lack 24/7 detection capability. (Estimates are inferred from sector/profile, not from confirmed victim financials.)

Posting frequency & escalation pattern

23 listings in a single day is an escalation signal, not business-as-usual drip posting. Batch dumps typically indicate one of three things: (1) a matured pipeline of simultaneous intrusions, (2) acquisition of access from IABs at scale, or (3) a deliberate publicity push to build the brand. Defenders should assume N0N (or its access suppliers) is running a volume playbook — and that organizations with exposed edge services are in scope regardless of sector.

CVE exposure (hypothesis — not victim-attributed)

We have no evidence linking any specific CVE to any specific N0N listing. However, the following CISA KEV entries — all confirmed as exploited, several with confirmed ransomware use — represent exactly the edge and management-plane surface a volume operation like this would target. Frame these as sector-level exposure hypotheses, not attribution:

• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1 key exchange). Edge VPN auth bypass is the canonical initial access route for ransomware crews. If you run Check Point gateways with IKEv1, treat this as your #1 patch this week.
• CVE-2026-20316 — Cisco Secure FMC hard-coded password. Management-plane compromise of the firewall controller gives attackers policy control and network-wide visibility — a force multiplier for lateral movement.
• CVE-2026-59310 — VMware vCenter path traversal. vCenter compromise enables mass hypervisor-level encryption — the highest-impact detonation scenario. ESXi/vCenter environments are disproportionately represented in catastrophic ransomware outcomes.
• CVE-2026-63077 — JetBrains TeamCity deserialization. CI/CD compromise provides both initial access and a supply-chain pivot; relevant to the technology-sector claims.
• CVE-2026-48027 — Nx Console embedded malicious code. Developer-tooling supply-chain vector; consistent with technology-sector targeting claims.

Patch priority: internet-facing edge auth (Check Point, Cisco FMC) → virtualization management (vCenter) → developer tooling (TeamCity, Nx).

Detection Engineering

The following content targets the TTP cluster typical of this class of operation: edge/VPN exploitation and brute force, macro/script execution from phishing, PsExec/WMI lateral movement, Cobalt Strike-style beaconing, and pre-encryption data staging.

---
title: N0N-Campaign — VPN/Edge Auth Anomaly Followed by Internal Lateral Tooling
id: 8f3a1c2e-n0n1-4a7b-9c2d-000000000001
status: experimental
description: Detects successful VPN/edge authentication from an unusual source followed within 24h by PsExec-style service creation or WMI process execution, consistent with ransomware crew post-exploitation after edge compromise (e.g., Check Point IKEv1, Cisco FMC exploitation).
author: Security Arsenal Threat Intelligence
date: 2026/10/17
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec:
    Image|endswith:
      - '\PSEXESVC.exe'
      - '\psexec.exe'
    OR:
      - ServiceName: 'PSEXESVC'
  selection_wmi:
    ParentImage|endswith: '\WmiPrvSE.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\rundll32.exe'
  condition: 1 of selection_*
falsepositives:
  - Legitimate administrative PsExec/WMI usage by IT
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1047
  - attack.t1569.002
---
title: N0N-Campaign — Pre-Encryption Staging — Shadow Copy Deletion and Backup Tampering
id: 8f3a1c2e-n0n1-4a7b-9c2d-000000000002
status: experimental
description: Detects Volume Shadow Copy deletion, backup catalog tampering, or boot configuration changes — the standard pre-detonation anti-recovery sequence used across ransomware operations including leak-site crews like N0N.
author: Security Arsenal Threat Intelligence
date: 2026/10/17
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    - Image|endswith: '\vssadmin.exe'
      CommandLine|contains:
        - 'delete shadows'
        - 'Delete Shadows'
    - Image|endswith: '\wmic.exe'
      CommandLine|contains: 'shadowcopy'
  selection_bcd:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled'
      - 'ignoreallfailures'
  selection_wbadmin:
    Image|endswith: '\wbadmin.exe'
    CommandLine|contains:
      - 'delete catalog'
      - 'delete backup'
  condition: selection_vss or selection_bcd or selection_wbadmin
falsepositives:
  - Rare; legitimate backup maintenance windows
level: critical
tags:
  - attack.impact
  - attack.t1490
---
title: N0N-Campaign — Suspicious Archive Staging of Sensitive Directories Prior to Exfiltration
id: 8f3a1c2e-n0n1-4a7b-9c2d-000000000003
status: experimental
description: Detects creation of large archives (rar/7z) against finance, HR, or file-share directories followed by execution of common exfiltration tooling — the data-theft phase of double extortion observed before leak-site publication.
author: Security Arsenal Threat Intelligence
date: 2026/10/17
logsource:
  category: process_creation
  product: windows
detection:
  selection_archive:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\7za.exe'
      - '\winrar.exe'
    CommandLine|contains:
      - ' a '
      - ' -m'
  selection_exfil_tools:
    Image|endswith:
      - '\rclone.exe'
      - '\megasync.exe'
      - '\filezilla.exe'
      - '\winscp.exe'
      - '\curl.exe'
  condition: 1 of selection_*
falsepositives:
  - Legitimate backup/archival jobs; rclone used by IT
level: medium
tags:
  - attack.collection
  - attack.t1560.001
  - attack.exfiltration
  - attack.t1567

// N0N-campaign hunt: lateral movement + pre-encryption staging correlation (Microsoft Sentinel)
// Looks for hosts showing BOTH remote-execution artifacts (PsExec/WMI) and anti-recovery
// or archive-staging behavior within a 6-hour window — the pre-detonation signature.
let window = 6h;
let LateralExec =
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where FileName =~ "PSEXESVC.exe"
       or (InitiatingProcessFileName =~ "WmiPrvSE.exe" and FileName in~ ("cmd.exe","powershell.exe","rundll32.exe"))
    | project LateralTime = TimeGenerated, DeviceName, AccountName, LateralCmd = ProcessCommandLine;
let Staging =
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where (FileName =~ "vssadmin.exe" and ProcessCommandLine has "delete shadows")
       or (FileName =~ "bcdedit.exe" and ProcessCommandLine has_any ("recoveryenabled","ignoreallfailures"))
       or (FileName =~ "wbadmin.exe" and ProcessCommandLine has "delete")
       or (FileName in~ ("rar.exe","7z.exe","7za.exe","rclone.exe") and ProcessCommandLine has_any ("finance","hr","payroll","\\\\"," -m"))
    | project StagingTime = TimeGenerated, DeviceName, StagingCmd = ProcessCommandLine;
LateralExec
| join kind=inner Staging on DeviceName
| where abs(datetime_diff("minute", StagingTime, LateralTime)) <= (todouble(timespan(window)) / 6000000000.0) or true
| extend TimeDeltaMinutes = abs(datetime_diff("minute", StagingTime, LateralTime))
| where TimeDeltaMinutes <= 360
| summarize FirstSeen = min(LateralTime), StagingEvents = make_set(StagingCmd), LateralEvents = make_set(LateralCmd) by DeviceName, AccountName
| sort by FirstSeen desc;

# N0N rapid-response sweep — run on file servers, jump hosts, and any host near a claimed-compromise path
# Checks: recent scheduled tasks (7d), shadow copy state, RDP exposure, suspicious new services
Write-Host "=== N0N Rapid Response Sweep — $(Get-Date) ===" -ForegroundColor Cyan

Write-Host "`n[1] Scheduled tasks created/modified in last 7 days:" -ForegroundColor Yellow
Get-ScheduledTask | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    [PSCustomObject]@{ TaskName = $_.TaskName; Path = $_.TaskPath; Author = $_.Author; State = $_.State }
} | Where-Object { $_.Path -notlike '\Microsoft*' } | Format-Table -AutoSize

Write-Host "`n[2] Volume Shadow Copies (should exist and be recent):" -ForegroundColor Yellow
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($shadows) { $shadows | Select-Object DeviceObject, InstallDate | Format-Table -AutoSize }
else { Write-Host "  WARNING: No shadow copies found — possible anti-recovery tampering!" -ForegroundColor Red }

Write-Host "`n[3] RDP exposure check:" -ForegroundColor Yellow
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue
$nla = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue
Write-Host ("  RDP Enabled: {0} | NLA Enabled: {1}" -f ($rdp.fDenyTSConnections -eq 0), ($nla.UserAuthentication -eq 1))
if (($rdp.fDenyTSConnections -eq 0) -and ($nla.UserAuthentication -ne 1)) {
    Write-Host "  WARNING: RDP open without NLA — brute-force exposure!" -ForegroundColor Red }

Write-Host "`n[4] Services installed in last 7 days (PsExec-style persistence check):" -ForegroundColor Yellow
Get-CimInstance Win32_Service | Where-Object {
    $_.PathName -match 'PSEXESVC|ADMIN\$|Temp|Users\\Public' -or $_.Name -match '^[A-Za-z0-9]{6,8}$'
} | Select-Object Name, DisplayName, State, PathName, StartName | Format-Table -AutoSize

Write-Host "`n[5] Recent logons of type 3/10 (network/RDP) from new accounts — review output manually:" -ForegroundColor Yellow
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=(Get-Date).AddDays(-2)} -MaxEvents 500 -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'Logon Type:\s+(3|10)' } |
  Select-Object -First 25 TimeCreated, @{n='Message';e={($_.Message -split "`n")[0..6] -join ' '}} | Format-List

Write-Host "`n=== Sweep complete. Investigate any red-flag items immediately. ===" -ForegroundColor Cyan

Incident Response Priorities

T-minus detection checklist — before encryption fires

N0N's batch-posting behavior implies staged, coordinated operations. The window between data theft and detonation is where you win or lose:

1. Anti-recovery commands — vssadmin delete shadows, bcdedit recoveryenabled no, wbadmin delete catalog. Any single occurrence on a server = page the IR lead.
2. Archive tooling on file servers — rar/7z runs against finance, HR, or shared drives outside approved backup windows.
3. Exfil channels — rclone/megasync/winscp installs, or sustained outbound transfers to unfamiliar cloud storage endpoints.
4. PsExec/WMI spread — service creation events (7045) naming PSEXESVC or random 6–8 character services across multiple hosts from one admin account.
5. New edge-device admin sessions — any interactive logon sourced from VPN/edge appliances following the CVE exploitation window above.
6. EDR tampering — sensor service stops, exclusion additions, or driver loads targeting security tooling.

Assets this class of operation historically prioritizes for exfiltration

• Finance and accounting data — note that N0N's own listing names "Xinos Construction Corp and its accounting group," explicitly framing financial records as leverage.
• HR/payroll records — PII for follow-on extortion of individuals.
• Patient/clinical data in healthcare claims (e.g., the EnVision Eye Care listing) — maximum regulatory and reputational pressure.
• Contracts, bids, and legal documents — competitive and negotiation leverage.
• Backup catalogs and credentials — to neutralize recovery before detonation.

Containment actions, ordered by urgency

1. Isolate, don't power off — network-quarantine suspected hosts; preserve volatile memory for forensics.
2. Kill the egress path — block exfil endpoints at the proxy/firewall; suspend suspicious cloud storage sessions.
3. Disable compromised accounts — force-reset any account observed in lateral movement events; revoke active tokens/kerberos tickets.
4. Protect the backups — take backup infrastructure offline from the production network or verify immutability; confirm at least one offline copy predates the earliest suspicious activity.
5. Segment by blast radius — pre-emptively isolate segments containing virtualization management (vCenter) and identity (DCs).
6. Engage IR retainer / legal / comms early — if your organization appears on a leak site, assume the claim will go public regardless of its truth and prepare the response posture accordingly.

Hardening Recommendations

Immediate (24 hours)

• Patch edge auth now: Check Point Security Gateway (CVE-2026-50751) and Cisco Secure FMC (CVE-2026-20316). If you cannot patch, disable IKEv1 where feasible and restrict management interfaces to a jump-host allowlist.
• Audit VPN/edge logs for the past 30 days for anomalous authentications preceding internal SMB/WMI activity.
• Disable or restrict RDP from the internet; enforce NLA; move administrative RDP behind VPN + MFA.
• Block macro execution from internet-sourced Office files (Mark-of-the-Web policy) and enforce Attack Surface Reduction rules for Office child processes.
• Deploy the Sigma rules above and alert at high/critical severity; run the KQL hunt across the last 7 days immediately.
• Verify shadow copies exist on file servers and that backup catalogs are intact (the PowerShell sweep above).

Short-term (2 weeks)

• Segment virtualization management: vCenter (CVE-2026-59310) must sit on a dedicated management VLAN unreachable from general user networks; hypervisor compromise is the worst-case detonation path.
• Immutable/offline backups with at least one copy logically air-gapped; test restore of a critical file share and one line-of-business system.
• Identity hardening: tiered administration, no standing Domain Admin logons to member servers, LAPS everywhere, and detection on DCSync-style replication requests.
• Egress filtering: deny outbound to consumer file-sharing/storage domains by default; alert on new destinations moving >1GB/day.
• Developer-plane controls: patch TeamCity (CVE-2026-63077), pin and integrity-check extensions like Nx Console (CVE-2026-48027), and treat CI/CD as a tier-0 asset.
• Tabletop the leak-site scenario: decide now who speaks, who decides, and what counsel needs if your organization's name appears on a site like N0N's — true or not.

All victim listings referenced in this briefing are unverified claims published by the N0N ransomware operation on its dark web leak site. Inclusion reflects the threat actor's claim only. Security Arsenal will update or correct this briefing as verification develops. Named organizations may contact security@securityarsenal.com.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub