Classification: TLP:CLEAR | Publication Date: 2026-10-22 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

Executive Summary

Between 2026-10-19 and 2026-10-22, the ransomware group tracked as N0N posted 24 victim listings to its dark web leak site, including a concentrated burst of at least nine listings on 2026-10-21 alone. The listings span Healthcare, Technology, Retail & E-Commerce, Hospitality, and Financial Services, with the United States the most frequently tagged country, alongside South Korea, Portugal, Ethiopia, Tunisia, Trinidad & Tobago, and Switzerland.

Named listings include Heritage Senior Living (Healthcare, US), Hanjin Information Systems & Telecommunication Co., Ltd. (Technology, KR), TheHomeMag NorCal (Retail & E-Commerce, US), 51Ridge (Newark NJ hosting/IT) (Technology, US), and Vormittag Associates Inc (US). A large share of the recent postings are anonymized as numbered entries ("Company #95" through "Company #103") — a pattern consistent with a gang stockpiling victims and releasing them in batches to sustain negotiation pressure.

Every listing on this page is an accusation by a criminal actor, not a confirmed breach. None of the organizations named above has been confirmed as breached based on this data. Security teams in the affected sectors should treat this briefing as a prompt to hunt, not as confirmation that any specific incident occurred.

Sourcing & Verification

• Corroboration status: 14 of the 24 listings discussed in this briefing were independently observed by a second leak-site crawler ([MULTI-SOURCE]). 10 listings appear on a single source (ransomware.live) only, with no second-crawler confirmation that the posting even exists ([SINGLE-SOURCE]).
• What corroboration means: A MULTI-SOURCE tag means two independent crawlers observed the gang publish the claim. It does not confirm a breach occurred. No tier in our data confirms a breach — only the organization itself or its regulator can do that.
• What inclusion means: Inclusion in this briefing reflects the threat actor's claim, nothing more. N0N, like all extortion groups, has an incentive to exaggerate, misattribute, or fabricate listings to build reputational pressure.
• Disputes and denials: A named organization may dispute a listing, and a denial is likewise not proof the claim is false. Disclosure obligations vary by jurisdiction and sector, and not every incident is legally reportable — so neither silence nor denial settles the question. We report the claim and its corroboration tier, and let readers weigh both.
• Corrections: Security Arsenal will publish corrections promptly. We welcome contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

The following profile reflects Security Arsenal's current assessment of N0N based on leak-site telemetry and sector-level reporting. Where attribution or tradecraft detail is uncertain, we say so.

Current Campaign Analysis

Sector Targeting

From the 24 most recent listings (with "Not Found" denoting unclassified entries):

• Healthcare — Heritage Senior Living (US). Senior living and long-term care operators hold dense PHI/PII with historically thin security budgets, making them preferred extortion targets.
• Technology / IT services — Hanjin Information Systems & Telecommunication Co., Ltd. (KR); 51Ridge, a hosting/IT provider in Newark, NJ (US). IT and hosting targets carry outsized downstream risk: a single compromise claim against a provider implies potential access to many tenant environments.
• Retail & E-Commerce / Hospitality — TheHomeMag NorCal (US) and additional hospitality-tagged entries.
• Financial Services and Other — present in the last-100-postings aggregate but not in the named sample above.
• Unclassified ("Not Found") — the majority of the recent burst: Company #95–#103, Xylanpicks, and Vormittag Associates Inc. The heavy use of anonymized listings is itself an escalation indicator.

Geographic Concentration

The United States dominates the named and tagged listings, followed by South Korea, Portugal, Ethiopia, Tunisia, Trinidad & Tobago, and Switzerland. This is consistent with US-centric extortion economics (higher perceived payment capacity, stronger disclosure-driven pressure) while the spread across ET, TN, TT, and CH suggests opportunistic rather than regionally focused access acquisition — i.e., the gang is monetizing whatever access it can obtain or purchase.

Victim Profile

Based on the named sample, N0N's current victims skew toward SMB-to-midmarket organizations — regional publishers, senior living operators, a local hosting provider — with estimated revenues typically in the $5M–$250M range. These are organizations large enough to pay meaningful ransoms but often lacking 24/7 detection capability. The presence of a larger technology firm (Hanjin) indicates the gang will take enterprise-scale access when available.

Posting Frequency & Escalation Patterns

The campaign shows a burst cadence: at least 9 listings on 2026-10-21, 5 on 2026-10-20, and 1 on 2026-10-19. Two escalation signals stand out:

1. Batch anonymized postings (Company #95–#103) — consistent with a victim backlog being published to demonstrate volume and intimidate organizations currently in negotiation.
2. Single-source drift — 10 of 24 listings lack second-crawler corroboration. This can indicate rapid posting/deletion cycles (listings removed when negotiations resolve) or site instability. Treat single-source entries with additional skepticism.

CVE Exposure Context (Hypothesis — Not Victim Attribution)

We have no evidence tying any specific named listing above to a specific CVE. However, several vulnerabilities currently on the CISA Known Exploited Vulnerabilities catalog with confirmed ransomware use map directly to the infrastructure typical of N0N's target profile, and represent plausible sector-level exposure:

• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1): perimeter VPN/firewall exploitation is the highest-probability initial access path for SMB-focused crews. Patch or mitigate immediately.
• CVE-2026-20316 — Cisco Secure Firewall Management Center hard-coded password: management-plane compromise enables both access and defense-blinding.
• CVE-2026-59310 — VMware vCenter path traversal: virtualization-layer compromise enables mass encryption of guest workloads — the classic pre-detonation endgame.
• CVE-2026-63077 — JetBrains TeamCity deserialization: build-server compromise enables supply-chain leverage, directly relevant given the IT/hosting targeting observed.
• CVE-2026-48027 — Nx Console embedded malicious code: developer-workstation supply-chain exposure; relevant to technology-sector targets.

Treat these as a prioritized patch-and-hunt list for the sectors N0N is listing, not as confirmed initial access for any named organization.

Detection Engineering

The following detections target the TTP cluster most relevant to this campaign profile: perimeter/remote-access exploitation, phishing-driven execution, lateral movement via PsExec/WMI, Cobalt Strike-style beaconing, and pre-encryption staging (shadow copy deletion, mass file access, archive staging).

---
title: N0N Campaign - Pre-Ransomware Volume Shadow Copy Deletion
id: 7f3a1c2e-9b4d-4e5a-8c1f-n0nshadow001
status: experimental
description: Detects deletion or resizing of Volume Shadow Copies, a near-universal pre-encryption step in ransomware campaigns including double-extortion crews like N0N. High fidelity when correlated with unusual parent processes.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
date: 2026/10/22
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
      - '\diskshadow.exe'
      - '\wbadmin.exe'
  selection_args:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'resize shadowstorage'
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
      - 'delete catalog'
  filter_backup_admins:
    User|contains:
      - 'SVC_VEEAM'
      - 'SVC_BACKUP'
  condition: selection_tool and selection_args and not filter_backup_admins
falsepositives:
  - Legitimate backup administration; validate against change windows
level: high
tags:
  - attack.impact
  - attack.t1490
---
title: N0N Campaign - Remote Access Exploitation Followed by Suspicious Logon
id: 8a4b2d3f-1c5e-4f6b-9d2a-n0nrdpvpn002
status: experimental
description: Detects RDP or VPN-authenticated logons followed within a short window by execution of reconnaissance or lateral movement tooling, consistent with access gained via exploited perimeter services (e.g., IKEv1 auth bypass, exposed RDP).
author: Security Arsenal Threat Intelligence
date: 2026/10/22
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\nltest.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\quser.exe'
      - '\qwinsta.exe'
      - '\arp.exe'
      - '\ipconfig.exe'
      - '\systeminfo.exe'
      - '\whoami.exe'
    CommandLine|contains:
      - '/domain'
      - 'domain_trusts'
      - 'group "domain admins"'
      - 'localgroup administrators'
  filter_software_deployment:
    ParentImage|endswith:
      - '\sccm\ccmexec.exe'
      - '\taniumclient.exe'
  condition: selection and not filter_software_deployment
falsepositives:
  - IT administration; tune against known admin jump hosts and service accounts
level: medium
tags:
  - attack.discovery
  - attack.t1033
  - attack.t1087
  - attack.t1482
---
title: N0N Campaign - PsExec or WMI Lateral Movement with Staging Artifact
id: 9c5e3f4a-2d6f-4a7c-8e3b-n0nlateral003
status: experimental
description: Detects service-based lateral movement (PsExec-style service creation, WMIC remote process call) combined with archive staging indicators, matching pre-exfiltration behavior observed across double-extortion operations.
author: Security Arsenal Threat Intelligence
date: 2026/10/22
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec:
    Image|endswith:
      - '\psexec.exe'
      - '\psexesvc.exe'
      - '\paexec.exe'
      - '\csexec.exe'
  selection_wmi:
    Image|endswith: '\wmic.exe'
    CommandLine|contains:
      - 'process call create'
      - '/node:'
  selection_staging:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\7za.exe'
      - '\winrar.exe'
    CommandLine|contains:
      - ' a '
      - '-hp'
      - '-p'
  condition: 1 of selection_*
falsepositives:
  - Software packaging and admin archiving; focus alerting on servers and non-IT workstations
level: high
tags:
  - attack.lateral_movement
  - attack.t1021
  - attack.t1569.002
  - attack.collection
  - attack.t1560.001

The Sentinel hunt below looks for the pre-encryption kill chain: shadow copy tampering plus mass staging plus lateral service creation within a 6-hour window on the same host.

// N0N Campaign Hunt: Pre-encryption staging + lateral movement correlation
// Lookback: 14 days | Tune allowlists for your environment before production use
let Lookback = 14d;
let AdminHosts = dynamic(["JUMPBOX01", "MGMT01"]); // <- tune
let ShadowTamper =
    DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where FileName in~ ("vssadmin.exe","wmic.exe","bcdedit.exe","wbadmin.exe","diskshadow.exe")
    | where ProcessCommandLine has_any ("delete shadows","shadowcopy delete","resize shadowstorage","recoveryenabled no","delete catalog")
    | project TamperTime=Timestamp, DeviceName, TamperCmd=ProcessCommandLine, AccountName;
let Staging =
    DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where FileName in~ ("rar.exe","7z.exe","7za.exe","winrar.exe","robocopy.exe")
    | where ProcessCommandLine has_any (" a ","-hp","/mir","\\ADMIN$","\\C$")
    | project StageTime=Timestamp, DeviceName, StageCmd=ProcessCommandLine;
let LateralSvc =
    DeviceEvents
    | where Timestamp > ago(Lookback)
    | where ActionType == "ServiceInstalled"
    | extend ServiceName = tostring(parse_json(AdditionalFields).ServiceName)
    | where ServiceName has_any ("PSEXESVC","PAExec","rundll") or ServiceName matches regex "^[A-Za-z0-9]{6,8}$"
    | where DeviceName !in~ (AdminHosts)
    | project SvcTime=Timestamp, DeviceName, ServiceName;
ShadowTamper
| join kind=inner (Staging) on DeviceName
| join kind=inner (LateralSvc) on DeviceName
| where StageTime between (TamperTime .. TamperTime + 6h)
   or SvcTime between (TamperTime .. TamperTime + 6h)
| summarize FirstSeen=min(TamperTime), LastSeen=max(StageTime),
    TamperCommands=make_set(TamperCmd), StageCommands=make_set(StageCmd),
    Services=make_set(ServiceName)
  by DeviceName, AccountName
| extend RiskNote = "Shadow tampering correlated with staging and suspicious service creation within 6h - investigate for active pre-ransomware staging"
| order by FirstSeen desc;

Run this PowerShell as a rapid triage on any host flagged by the detections above — it surfaces the exact artifacts N0N-style intrusions leave before detonation.

# N0N Rapid Triage - run elevated on suspected hosts
# Surfaces: recent scheduled tasks, exposed RDP state, shadow copy health, new local admins
Write-Host "=== N0N Rapid Triage: $env:COMPUTERNAME $(Get-Date -Format o) ===" -ForegroundColor Cyan

Write-Host "`n[1] Scheduled tasks created in last 7 days:" -ForegroundColor Yellow
Get-ScheduledTask | Where-Object {
    ($_.Date -as [datetime]) -gt (Get-Date).AddDays(-7)
} | Select-Object TaskName, TaskPath, Date, @{N='Action';E={$_.Actions.Execute}} |
    Format-Table -AutoSize

Write-Host "`n[2] RDP exposure check:" -ForegroundColor Yellow
$rdpEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$nla = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp').UserAuthentication
Write-Host ("    RDP Enabled: {0} | NLA Required: {1}" -f $rdpEnabled, ($nla -eq 1))
Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue |
    Select-Object LocalAddress, LocalPort, State | Format-Table -AutoSize

Write-Host "`n[3] Volume Shadow Copy health (deletion = pre-encryption red flag):" -ForegroundColor Yellow
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) { Write-Host "    WARNING: Zero shadow copies present. Investigate vssadmin/wmic deletion." -ForegroundColor Red }
else { $shadows | Select-Object ID, InstallDate, VolumeName | Format-Table -AutoSize }

Write-Host "`n[4] Local Administrators modified in last 14 days:" -ForegroundColor Yellow
Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue |
    Select-Object Name, ObjectClass, PrincipalSource | Format-Table -AutoSize
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4732,4728,4756; StartTime=(Get-Date).AddDays(-14)} -ErrorAction SilentlyContinue |
    Select-Object TimeCreated, Id, Message | Format-List

Write-Host "`n[5] Suspicious services (PsExec-style, random names) installed in last 7 days:" -ForegroundColor Yellow
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'PSEXESVC|PAExec|ADMIN\$' -or $_.Message -match '\\\\[^\\]+\\[^\\]{1,3}\.(exe|dll)' } |
    Select-Object TimeCreated, Message | Format-List

Write-Host "`n=== Triage complete. Escalate any [1]/[3]/[5] hits to IR immediately. ===" -ForegroundColor Cyan

Incident Response Priorities

T-Minus Detection Checklist (Before Encryption Fires)

N0N's batch-posting pattern implies victims often discover the intrusion via the leak site — meaning the pre-detonation window is being missed. Hunt for, in order of signal value:

1. Shadow copy tampering — vssadmin delete shadows, bcdedit recoveryenabled no, wbadmin delete catalog. This is the final warning bell.
2. Archive staging — RAR/7z creation against file shares, especially to C:\ProgramData, C:\Users\Public, or temp paths with password flags (-hp).
3. Mass egress — unusual outbound volume to MEGA, Rclone remotes, or unfamiliar cloud storage from servers that never normally upload.
4. Lateral service creation — 7045 events with random 6–8 character service names, PSEXESVC, or WMIC process call create against remote nodes.
5. EDR/AV tampering — defense-blinding attempts often precede detonation by hours.
6. New local/domain admin additions outside change windows.

Assets Historically Prioritized for Exfiltration

For double-extortion crews operating in N0N's target sectors, expect prioritization of:

• PHI/PII databases (EHR exports, resident records for senior living; customer databases for retail)
• Financial records — payroll, tax filings, banking details
• Legal/contractual documents and HR records (highest extortion leverage)
• Email archives of executive and legal mailboxes
• For IT/hosting targets: tenant credentials, VPN configs, and client data — assume downstream extortion attempts against the provider's customers

Containment Actions Ordered by Urgency

1. Isolate affected hosts at the switch/EDR level — do not power off (preserve memory).
2. Disable compromised accounts and force enterprise-wide credential resets, prioritizing privileged and service accounts.
3. Block egress to known exfil destinations (Rclone/MEGA/unknown cloud storage) at the proxy and firewall.
4. Sever remote access paths — disable exposed RDP, force VPN re-enrollment, rotate IKE/VPN pre-shared keys if Check Point or Cisco FMC exposure exists.
5. Protect backups — verify immutability/offline status before doing anything else; assume the intruder knows where they are.
6. Preserve evidence — memory capture and log export from patient zero before remediation wipes artifacts.
7. Engage counsel and IR retainer before any communication with the actor; do not confirm the leak-site listing publicly without legal review.

Hardening Recommendations

Immediate (24 Hours)

• Patch or mitigate the KEV perimeter set: CVE-2026-50751 (Check Point IKEv1), CVE-2026-20316 (Cisco FMC), CVE-2026-59310 (vCenter). These are confirmed ransomware-exploited and map directly to this campaign's likely access paths.
• Disable or tunnel RDP — no direct 3389 exposure to the internet; require VPN + MFA.
• Enforce MFA on all remote access, including legacy IKEv1 VPN profiles (migrate to IKEv2 or retire).
• Block macro execution from internet-sourced Office files via GPO (Mark-of-the-Web enforcement).
• Deploy the Sigma rules and Sentinel query above and backfill 14 days.
• Verify shadow copy presence on file servers and domain controllers; alert on deletion via the detections above.

Short-Term (2 Weeks)

• Segment backup infrastructure onto a separate domain/credential plane with immutable or air-gapped copies; test a restore.
• Implement egress filtering with explicit allowlists for server VLANs; alert on any server-initiated upload to consumer cloud storage.
• Deploy honey credentials and decoy file shares — double-extortion crews touch them during enumeration.
• Attack surface reduction rules (Microsoft Defender ASR or equivalent): block Office child processes, PsExec/WMI process creation from non-admin hosts, and credential theft from LSASS.
• For healthcare and IT/hosting organizations specifically: assume elevated targeting this quarter. Review third-party/MSP access paths — N0N's listing of a hosting provider means provider compromise is a live hypothesis for downstream tenants.
• Stand up leak-site monitoring for your organization and key suppliers so a listing becomes a detection event, not a surprise.

This briefing reflects threat-actor claims observed on criminal infrastructure. Security Arsenal assesses the postings are genuine gang publications at the corroboration tiers stated, but makes no representation that any listed organization has suffered a breach. Named organizations may contact security@securityarsenal.com regarding any listing.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub