Classification: TLP:CLEAR | Publication Date: 2026-10-23 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 23 New Leak-Site Listings in 48 Hours — Sector Targeting Analysis & Detection Rules

Executive Summary

Between 2026-10-21 and 2026-10-22, the ransomware crew tracked as N0N published 23 new victim listings on its Tor-hosted leak site — a compressed posting cadence that suggests either a coordinated multi-victim intrusion wave or the bulk release of a backlogged negotiation queue. The listings name organizations in Retail & E-Commerce, Healthcare, and Technology, alongside a large tranche of anonymized "Company #" placeholders, spanning the US, Bulgaria, South Korea, Portugal, Ethiopia, Tunisia, Trinidad & Tobago, and Switzerland.

Named organizations in this batch include Performance Ford Inc (US, Retail & E-Commerce), TheHomeMag NorCal (US, Retail & E-Commerce), Heritage Senior Living (US, Healthcare), and Hanjin Information Systems & Telecommunication Co., Ltd. (South Korea, Technology). In every case, these are claims made by a criminal group on its own infrastructure — not confirmed breaches. Security Arsenal has no evidence beyond the gang's own postings that any listed organization was compromised.

What defenders should take from this bulletin is not the victim list — it is the campaign signature: N0N is currently operating at high tempo, favoring mid-market organizations with immature security operations, and (per its historical playbook) leaning on edge-device exploitation and remote-access brute forcing for initial entry. The detection content below is engineered for exactly that playbook.

Sourcing & Verification

• Of the 23 listings in N0N's recent posting history, 16 were independently observed by a second leak-site crawler (MULTI-SOURCE) and 7 appear on a single source only. MULTI-SOURCE means two independent crawlers saw the gang publish the claim. It does not mean any breach is confirmed.
• Inclusion of an organization in this briefing reflects the threat actor's claim only. No tier in this data confirms a breach. Only the organization itself or its regulator can do that.
• A named organization may dispute a listing. Equally, a denial is not proof the claim is false: disclosure obligations vary by jurisdiction and sector, and not every incident is reportable. Neither silence nor denial settles the question.
• Security Arsenal will publish corrections promptly and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

Aliases & attribution: N0N operates under a deliberately minimal brand with no confirmed overlaps to legacy families at this time. Trackers have not attributed it to a prior RaaS affiliate network with confidence, though its leak-site template and negotiation flow resemble post-2024 second-generation crews spun up from dissolved operations.

Operating model: Assessed as a closed group rather than an open RaaS program. The high volume of anonymized "Company #" listings (9 of the last 15 postings) is characteristic of a crew that controls its own intrusions end-to-end and staggers disclosure to maximize negotiation leverage rather than recruiting affiliates.

Ransom demands: Observed demands cluster in the low-to-mid six figures (USD), calibrated to mid-market revenue. N0N is a volume operator — it prices for payment probability, not headline value.

Initial access methods (historical playbook):

• Exploitation of internet-facing VPN concentrators and firewall management planes
• RDP brute force / password spraying against exposed 3389
• Phishing with macro-enabled or script-embedded lures targeting office staff
• Opportunistic abuse of misconfigured VMware vCenter and CI/CD infrastructure (TeamCity) in technology-sector intrusions

Extortion model: Double extortion — data exfiltration precedes encryption, with leak-site publication used as the pressure mechanism. The "Company #" anonymized pattern indicates a paid-delay tier: victims who engage quickly are listed pseudonymously while negotiations run.

Dwell time: Estimated 5–14 days from initial access to detonation based on observed staging artifacts in comparable intrusions, with exfiltration typically completed 24–72 hours before encryption fires.

Current Campaign Analysis

Sectors Being Targeted

From the last 15 postings: Retail & E-Commerce (2 named), Healthcare (1 named), Technology (1 named), and 9 unclassified "Company #" entries plus 2 further uncategorized listings in the broader 23. The healthcare listing — Heritage Senior Living (a claim, not a confirmed breach) — is notable: senior-care and long-term-care operators hold dense PHI/PII with typically thin security staffing, a profile double-extortion crews deliberately select.

Geographic Concentration

The US anchors the named claims (3 of 4 named organizations), but the broader posting set spans BG, KR, PT, ET, TN, TT, and CH. This is not a regionally focused campaign; it is an opportunistic global sweep consistent with mass edge-device scanning and credential-stuffing against exposed remote access, rather than bespoke intrusion work.

Victim Profile

Named organizations skew mid-market: regional automotive retail, a regional media franchise, a senior living operator, and a mid-tier Korean IT services firm. Estimated revenue range for this profile is roughly $10M–$250M — organizations large enough to pay, small enough to lack 24/7 detection. This is the classic volume-ransomware sweet spot.

Posting Frequency & Escalation

23 listings in ~48 hours is an abnormal burst. Two interpretations, not mutually exclusive:

1. A single mass-exploitation event (e.g., a newly weaponized edge-device CVE) yielded multiple concurrent footholds now being monetized in bulk.
2. A negotiation backlog was dumped after deadline expiry — the numbered anonymized listings support this, as they read like a queue being processed sequentially (#99–#109).

Watch for whether named listings follow the numbered batch; escalation from pseudonymous to named listing is N0N's standard pressure ladder.

CVE Connection — Hypothesis, Not Attribution

We have no evidence tying any specific CVE to any specific named listing. However, N0N's historical tradecraft overlaps with several vulnerabilities currently on the CISA Known Exploited Vulnerabilities catalog with confirmed ransomware use. These represent sector-level exposure hypotheses defenders should test against their own estates:

• CVE-2026-59310 (VMware vCenter path traversal, KEV 2026-08-18) — matches N0N's pattern of pivoting into virtualization management planes before mass encryption.
• CVE-2026-50751 (Check Point Security Gateway improper authentication, IKEv1, KEV 2026-06-08) — consistent with VPN edge-device entry, N0N's most frequent historical vector.
• CVE-2026-20316 (Cisco Secure FMC hard-coded password, KEV 2026-07-29) — firewall management-plane compromise fits the geographic scatter: such flaws enable indiscriminate global scanning.
• CVE-2026-63077 (JetBrains TeamCity deserialization, KEV 2026-08-05) — plausible hypothesis for technology-sector entries like the Korean IT services listing; build servers are high-value exfil/staging pivots.
• CVE-2026-48027 (Nx Console embedded malicious code, KEV 2026-05-27) — supply-chain-flavored developer-tooling compromise; relevant to any org with JS/TS build pipelines.

Treat these as patch-and-hunt priorities for your own exposure, not as confirmed intrusion vectors for the listed organizations.

Detection Engineering

Sigma Rules

---
title: N0N Initial Access — RDP Brute Force Followed by Successful Logon
id: 8f2a1c4e-n0n1-4a1b-9c2d-rdpbrute01
status: experimental
description: Detects burst of failed RDP logons (4625, logon type 10/3) from a single source followed by a successful logon (4624 type 10) — consistent with N0N's exposed-RDP password-spray entry pattern.
author: Security Arsenal Threat Intelligence
date: 2026/10/23
references:
  - https://ransomware.live
logsource:
  product: windows
  service: security
detection:
  sel_failed:
    EventID: 4625
    LogonType:
      - 3
      - 10
  sel_success:
    EventID: 4624
    LogonType: 10
  condition: sel_failed | count() by Source_Network_Address > 20 | near sel_success within 15m
falsepositives:
  - Misconfigured service accounts retrying stale credentials
  - Vulnerability scanners
level: high
tags:
  - attack.initial_access
  - attack.t1110
  - attack.t1133
---
title: N0N Lateral Movement — PsExec-Style Service Install or WMI Remote Process Creation
id: 8f2a1c4e-n0n2-4b2c-8d3e-latmove002
status: experimental
description: Detects remote service installation (7045) with PsExec-like naming or WMI (Win32_Process) spawning commands on remote hosts — N0N's preferred post-access movement chain before staging.
author: Security Arsenal Threat Intelligence
date: 2026/10/23
references:
  - https://ransomware.live
logsource:
  product: windows
  service: system
detection:
  sel_svc:
    EventID: 7045
    Service_Name|contains:
      - 'PSEXESVC'
      - 'RemCom'
      - 'csexec'
    Service_File_Name|contains:
      - '\ADMIN$\'
      - '\IPC$\'
  sel_wmi:
    EventID: 4688
    ParentImage|endswith: '\WmiPrvSE.exe'
    New_Process_Name|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\rundll32.exe'
  condition: sel_svc or sel_wmi
falsepositives:
  - Legitimate administrative tooling (SCCM, PDQ) — baseline service names per environment
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002
  - attack.t1047
---
title: N0N Pre-Encryption Staging — Shadow Copy Deletion and Bulk Archive Creation
id: 8f2a1c4e-n0n3-4c3d-9f4a-stage0003
status: experimental
description: Detects vssadmin/wmic shadow copy deletion and mass archive creation (rar/7z) on servers — N0N's observed pre-detonation sequence after exfiltration completes.
author: Security Arsenal Threat Intelligence
date: 2026/10/23
references:
  - https://ransomware.live
logsource:
  category: process_creation
  product: windows
detection:
  sel_vss:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'recoveryenabled no'
  sel_archive:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\7za.exe'
    CommandLine|contains:
      - ' a '
      - ' -p'
  condition: sel_vss or sel_archive
falsepositives:
  - Backup administrators running sanctioned VSS maintenance
  - Legitimate software packaging
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.t1560.001

KQL (Microsoft Sentinel) — Lateral Movement & Staging Hunt

// N0N hunt: pre-ransomware staging — archive tooling, VSS tampering,
// and anomalous admin-share writes correlated within a 24h window per host.
let Window = 24h;
let SuspiciousProcs =
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where ProcessCommandLine has_any ("delete shadows", "shadowcopy delete", "recoveryenabled no")
        or FileName in~ ("rar.exe", "7z.exe", "7za.exe", "winrar.exe")
    | project StageTime=TimeGenerated, DeviceName, StageCmd=ProcessCommandLine, StageAccount=AccountName;
let AdminShareWrites =
    DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where RemotePort == 445 and ActionType == "ConnectionSuccess"
    | summarize SmbFanOut = dcount(RemoteIP) by DeviceName, bin(TimeGenerated, 1h)
    | where SmbFanOut > 10;
SuspiciousProcs
| join kind=inner (AdminShareWrites) on DeviceName
| where abs(datetime_diff('minute', StageTime, TimeGenerated)) < 1440
| extend N0N_StageScore = SmbFanOut * 2
| summarize StagingCommands = make_set(StageCmd), Accounts = make_set(StageAccount),
            FirstSeen = min(StageTime), MaxSmbFanOut = max(SmbFanOut)
    by DeviceName
| sort by MaxSmbFanOut desc;

PowerShell — Rapid Exposure & Tampering Triage

# N0N rapid-response triage: exposed RDP, new scheduled tasks (7d), VSS state, new local admins
$cutoff = (Get-Date).AddDays(-7)
$report = [ordered]@{}

# 1. Is RDP exposed / enabled?
$rdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$nla = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -ErrorAction SilentlyContinue).UserAuthentication
$report['RDP_Enabled'] = $rdpEnabled
$report['RDP_NLA_Required'] = ($nla -eq 1)
$report['RDP_Internet_Exposed'] = [bool](Get-NetFirewallRule -DisplayGroup 'Remote Desktop' -ErrorAction SilentlyContinue |
    Where-Object Enabled -eq 'True' | Get-NetFirewallAddressFilter |
    Where-Object { $_.RemoteAddress -eq 'Any' })

# 2. Scheduled tasks created in the last 7 days (persistence check)
$report['New_Scheduled_Tasks'] = Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt $cutoff } |
    Select-Object TaskName, TaskPath, Date

# 3. Volume Shadow Copy status — N0N deletes these pre-encryption
$report['ShadowCopies'] = @(Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue).Count
$report['VSS_Service_State'] = (Get-Service VSS -ErrorAction SilentlyContinue).Status

# 4. Local admin group drift (new privileged accounts)
$report['Local_Admins'] = Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue |
    Select-Object -ExpandProperty Name

# 5. Hunt N0N staging artifacts: archive executables outside sanctioned paths
$report['Rogue_Archive_Tools'] = Get-ChildItem 'C:\Users','C:\ProgramData','C:\Windows\Temp' -Recurse -Depth 3 `
    -Include 'rar.exe','7z.exe','7za.exe' -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt $cutoff } | Select-Object FullName, LastWriteTime

$report.GetEnumerator() | ForEach-Object { "== $($_.Key) =="; $_.Value | Format-List | Out-String }
# ESCALATE if: RDP exposed without NLA, shadow copies = 0, or rogue archive tools found.

Incident Response Priorities

T-Minus Detection Checklist (Before Encryption Fires)

1. VPN/edge-device authentication anomalies — impossible-travel logins, IKEv1 negotiation failures followed by success (relevant to CVE-2026-50751-class exposure), or management-plane logins from unknown ASNs.
2. SMB fan-out — a single workstation or server initiating 445 connections to >10 hosts in an hour (see KQL above).
3. Archive tooling on servers — rar/7z executing outside software-packaging change windows is N0N's exfil staging tell.
4. Large egress to unfamiliar cloud storage or VPS endpoints — exfil typically completes 24–72h before detonation.
5. VSS deletion attempts and bcdedit recovery disabling — the last domino before encryption. Any hit is a page-the-on-call event.
6. Backup infrastructure access — N0N targets backup consoles before detonation; alert on backup job deletions or console logins outside the backup team's devices.

Assets This Gang Prioritizes for Exfiltration

Based on sector selection in this campaign: PHI/PII databases (the healthcare listing pattern), financial and payroll exports, customer/CRM databases (retail target profile), and credentials stores / build-server secrets (technology profile — TeamCity-class servers hold deploy keys to everything). Assume anything exfiltrated will be published; double extortion is the business model.

Containment Actions — Ordered by Urgency

1. Isolate, don't power off affected hosts (preserve memory for forensics); segment at the switch/VLAN level.
2. Disable or ACL internet-facing RDP and VPN portals environment-wide pending credential reset.
3. Force enterprise-wide credential rotation, prioritizing domain admins, service accounts, and anything stored on build servers.
4. Block egress to known exfil destinations at the proxy/firewall; throttle bulk uploads.
5. Protect backups: take backup consoles offline from the domain, verify immutable/offline copies.
6. Engage IR retainer and counsel before any contact with the actor; treat the leak-site countdown as a forensic-preservation deadline, not a negotiation clock.

Hardening Recommendations

Immediate (24 Hours)

• Patch or mitigate the KEV set: CVE-2026-50751 (Check Point), CVE-2026-20316 (Cisco FMC), CVE-2026-59310 (vCenter), CVE-2026-63077 (TeamCity), CVE-2026-48027 (Nx Console). If patching isn't possible tonight, take the management interface off the internet — that alone breaks the most likely entry path.
• Kill exposed RDP: require VPN + NLA + MFA, or disable externally. Audit 3389 against threat intel for brute-force sources.
• Enforce MFA on all remote access, no exceptions for service accounts or "temporary" vendor access.
• Block macro execution from internet-sourced documents via Mark-of-the-Web policy.
• Deploy the Sigma rules above to your SIEM; run the triage script on all internet-adjacent servers.

Short-Term (2 Weeks)

• Segment virtualization management planes — vCenter and backup consoles on isolated networks, reachable only from hardened PAWs.
• Deploy canary shares/credentials with alerting on SMB fan-out behavior (the single highest-fidelity pre-ransomware signal).
• Immutable backups with out-of-band recovery testing — N0N's playbook assumes it can destroy recoverability; prove it can't.
• Egress filtering with DLP on bulk transfers from database and file servers.
• Tabletop the leak-site scenario: decide now who approves ransom decisions, who handles regulator notification given your sector's disclosure obligations, and who speaks to the gang — before the countdown starts.

Security Arsenal monitors criminal leak-site ecosystems continuously. Listings described here are unverified threat-actor claims. Named organizations are invited to contact security@securityarsenal.com; corrections will be published promptly.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub