Classification: TLP:CLEAR | Publication Date: 2026-10-15 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 25 Leak-Site Listings Including Port & Shipping Concentration — Sector Analysis & Detection Rules

Executive Summary

Leak-site monitoring via ransomware.live shows the ransomware group N0N has published 25 listings on its dark web leak site across a recent posting window. The group names organizations spanning professional services, healthcare, retail, financial services, manufacturing, and — most notably — a concentrated cluster of transportation/maritime entities including port operators, container terminals, and shipping companies across Brazil, Türkiye, Singapore, South Korea, Indonesia, and China.

Every listing in this bulletin is an unverified claim by a criminal actor. Inclusion on a leak site is not confirmation of a breach. Eight of the 25 listings were independently observed by a second leak-site crawler (confirming the gang made the claim); the remaining 17 — including the entire maritime cluster — appear on a single source only.

Enterprise defenders in maritime logistics, healthcare, and financial services should treat this as a sector-level exposure signal and apply the detection rules and hardening guidance below, regardless of whether any specific claim is ever substantiated.

Sourcing & Verification

• Corroboration tiers: 8 of 25 listings were independently observed by a second leak-site crawler (MULTI-SOURCE — confirming the gang posted the claim). 17 listings appear on ransomware.live only (SINGLE-SOURCE — no second-crawler confirmation that the posting even exists).
• Inclusion on a leak site reflects the threat actor's claim and is NOT confirmation of a breach. No tier in our data confirms a breach — only the affected organization or its regulator can do that.
• A named organization may dispute the listing. A denial is likewise not proof the claim is false — disclosure obligations vary by jurisdiction and not every incident is reportable, so neither silence nor denial settles the question.
• Security Arsenal will publish corrections to this briefing as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

Public reporting on N0N remains limited, and defenders should treat the profile below as a working assessment derived from leak-site behavior patterns rather than confirmed attribution. Where items are inferred rather than documented, we say so.

• Aliases: No widely documented aliases in public reporting at time of publication. The group operates under the "N0N" branding on its .onion leak infrastructure.
• Operating model: Assessment — consistent with a RaaS (Ransomware-as-a-Service) or affiliate-driven model. The rapid, high-volume posting cadence (25 listings in a short window) and sector breadth suggest multiple affiliate operators feeding a shared leak site rather than a single closed team with a narrow target set.
• Ransom demands: Not publicly documented for this group. Based on victim profile (mid-market to enterprise organizations across professional services, healthcare, and maritime logistics), demands are likely in the mid-six to low-seven figure USD range, consistent with comparable groups targeting this tier.
• Initial access methods (assessed, sector-level): Consistent with the current ransomware ecosystem, likely vectors include exploitation of internet-facing edge services (VPN, firewall management interfaces), exposed RDP, phishing with macro-enabled lures, and valid-account access purchased from initial access brokers. No specific vector has been tied to any specific listing in this dataset.
• Extortion model: Double extortion — the leak site itself is evidence of a name-and-shame model in which data theft and threatened publication accompany encryption.
• Dwell time: Not documented for N0N. Industry-wide, affiliate-driven operations typically stage data 3–14 days before detonation; defenders should assume pre-encryption staging is underway the moment lateral movement indicators appear.

Current Campaign Analysis

Sector targeting

The 25 listings span: Professional Services, Healthcare, Retail & E-Commerce, Financial Services, Transportation, and Manufacturing (plus listings with no sector attribution). The standout pattern is a maritime/transportation cluster posted on 2026-10-12: GlobalNet LCL (ID), Santos Brasil (BR), Asyaport (TR), Ocean Network Express (SG), MGNP (KR), Portonave (BR), Polaris Shipping (KR), and ZPMC (CN) — port agencies, container terminals, shipping lines, and port-machinery manufacturers.

Important: every maritime listing is SINGLE-SOURCE — unconfirmed even as a posting by a second crawler, let alone as a breach. A coordinated single-day claim against one sector can indicate a genuine campaign, an affiliate specializing in maritime, or deliberate inflation of a leak site with fabricated entries. We cannot distinguish between these from the data available.

MULTI-SOURCE listings (gang claim confirmed by two crawlers, breach still unconfirmed) include: Trieschmann Dumala Architectural Group, Company #65, Company #63, Company #64, Hunter Neurology, MarieBelle New York, and PG Group (Pure Options).

Geographic concentration

Listings span BR, US, ID, TR, SG, KR, CN, JP — a strong Asia-Pacific and Latin America tilt, with Brazil and South Korea each appearing multiple times. This is consistent with groups exploiting less-mature perimeter patch cadences outside North America/Western Europe, or affiliates with regional access-broker relationships.

Victim profile

Based on sectors only (we do not have revenue data): mid-market to enterprise organizations, including operationally critical infrastructure (ports, terminals, shipping). Maritime logistics entities are attractive extortion targets because operational downtime pressure is extreme and OT/IT convergence often creates detection blind spots.

Posting cadence

Observed pattern: a burst of transportation listings on 2026-10-12, followed by cross-sector listings on 2026-10-13 and a professional services listing on 2026-10-14. Burst-style posting against one sector in a single day, followed by diversification, is characteristic of affiliate handoffs or batch dumps from a single access vector.

CVE exposure (hypothesis only)

We have no evidence linking any specific CVE to any named listing. However, the following CISA KEV entries represent exactly the class of edge and infrastructure exposure a group like N0N is assessed to exploit, and organizations in targeted sectors should verify patch status:

• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1). Edge VPN/gateway auth bypass is the canonical ransomware initial-access vector.
• CVE-2026-20316 — Cisco Secure FMC hard-coded password. Management-plane compromise enables broad lateral access.
• CVE-2026-59310 — VMware vCenter path traversal. Hypervisor-level access enables mass VM encryption — the highest-impact detonation scenario.
• CVE-2026-63077 — JetBrains TeamCity deserialization. CI/CD compromise enables supply-chain pivoting and credential theft.
• CVE-2026-48027 — Nx Console embedded malicious code (supply chain).

Treat these as sector-level exposure hypotheses, not victim-specific attribution.

Detection Engineering

The following detections target TTPs common to double-extortion ransomware operations of this profile: edge/VPN exploitation, RDP brute force, PsExec/WMI lateral movement, data staging, and pre-encryption defense evasion (shadow copy deletion).

---
title: Pre-Ransomware Volume Shadow Copy Deletion
id: 9f2b1c7a-n0n1-4a2b-9c3d-000000000001
status: experimental
description: Detects vssadmin/wmic/bcdedit abuse to delete volume shadow copies or disable boot recovery — a near-universal pre-encryption step in double-extortion ransomware operations consistent with N0N leak-site activity.
author: Security Arsenal Threat Intelligence
references:
  - https://attack.mitre.org/techniques/T1490/
date: 2026/10/15
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
  selection_cmd:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
  condition: selection_img and selection_cmd
falsepositives:
  - Legitimate backup administration (rare; investigate host context)
level: high
tags:
  - attack.impact
  - attack.t1490
---
title: PsExec or WMI Remote Service Execution — Lateral Movement
id: 9f2b1c7a-n0n1-4a2b-9c3d-000000000002
status: experimental
description: Detects remote service creation via PsExec-style named pipes or WMI process execution, consistent with ransomware affiliate lateral movement before staging and encryption.
author: Security Arsenal Threat Intelligence
references:
  - https://attack.mitre.org/techniques/T1021/002/
  - https://attack.mitre.org/techniques/T1047/
date: 2026/10/15
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec:
    CommandLine|contains:
      - '-accepteula'
      - '\\'
      - ' -s '
    Image|endswith:
      - '\psexec.exe'
      - '\psexesvc.exe'
      - '\paexec.exe'
      - '\csexec.exe'
  selection_wmi:
    ParentImage|endswith: '\WmiPrvSE.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  condition: selection_psexec or selection_wmi
falsepositives:
  - Admin tooling (SCCM, PDQ). Baseline approved deployment parent processes and alert on deviations.
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1047
---
title: RDP Brute Force Followed by Successful Logon
id: 9f2b1c7a-n0n1-4a2b-9c3d-000000000003
status: experimental
description: Detects a burst of failed logons (Event 4625, logon type 3/10) from a single source followed by a successful logon (4624 type 10) within 15 minutes — pattern consistent with RDP brute force initial access used by ransomware affiliates.
author: Security Arsenal Threat Intelligence
references:
  - https://attack.mitre.org/techniques/T1110/
  - https://attack.mitre.org/techniques/T1078/
date: 2026/10/15
logsource:
  product: windows
  service: security
detection:
  selection_failed:
    EventID: 4625
    LogonType:
      - 3
      - 10
  selection_success:
    EventID: 4624
    LogonType: 10
  condition: selection_failed | count() > 20
  timeframe: 15m
falsepositives:
  - Service accounts with stale credentials; vulnerability scanners
level: medium
tags:
  - attack.credential_access
  - attack.t1110
  - attack.t1078

The following Microsoft Sentinel hunt query identifies pre-ransomware staging behavior: compression utilities spawned from unusual parents, mass file reads followed by outbound transfer, and new local admin creation — the affiliate toolkit pattern.

// N0N-style pre-ransomware staging hunt: compression tools + suspicious admin creation + shadow deletion
let lookback = 7d;
let compressionTools = dynamic(["7z.exe","rar.exe","winrar.exe","7za.exe","zip.exe"]);
let stagingProc =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName in~ (compressionTools)
    | where not(InitiatingProcessFileName in~ ("explorer.exe","winrar.exe","7zg.exe"))
    | project StagingTime=TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, ReportId;
let shadowDelete =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where ProcessCommandLine has_any ("delete shadows", "shadowcopy delete", "recoveryenabled no")
    | project ShadowTime=TimeGenerated, DeviceName, AccountName, ProcessCommandLine;
let adminAdds =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where ProcessCommandLine has_all ("net", "localgroup", "administrators", "add")
       or ProcessCommandLine has_all ("net", "user", "/add")
    | project AdminTime=TimeGenerated, DeviceName, AccountName, ProcessCommandLine;
let riskyHosts = union stagingProc, shadowDelete, adminAdds
    | summarize SignalCount=count(), FirstSeen=min(coalesce(StagingTime, ShadowTime, AdminTime)) by DeviceName
    | where SignalCount >= 2;
// Correlate with outbound exfil volume on the same hosts
DeviceNetworkEvents
| where TimeGenerated > ago(lookback)
| where DeviceName in (riskyHosts | project DeviceName)
| where RemoteIPType == "Public"
| summarize OutboundConnections=count(), UniqueRemoteIPs=dcount(RemoteIP), RemoteIPs=make_set(RemoteIP, 10) by DeviceName, InitiatingProcessFileName
| join kind=inner riskyHosts on DeviceName
| sort by SignalCount desc, UniqueRemoteIPs desc

The following rapid-response script checks a Windows host for the three highest-signal pre-detonation indicators: RDP exposure, recently created scheduled tasks, and shadow copy tampering.

# Security Arsenal — N0N Rapid Triage: RDP exposure, recent scheduled tasks, shadow copy status
# Run as Administrator on suspect hosts. Output: console + CSV to C:\IR-Triage\
$out = "C:\IR-Triage"; New-Item -ItemType Directory -Path $out -Force | Out-Null
$stamp = Get-Date -Format "yyyyMMdd-HHmmss"

Write-Host "[1] RDP exposure check..." -ForegroundColor Cyan
$rdpEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$nlaEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp').UserAuthentication -eq 1
$rdpListening = (Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue) -ne $null
[PSCustomObject]@{RdpEnabled=$rdpEnabled; NLA=$nlaEnabled; Listening3389=$rdpListening} |
    Export-Csv "$out\rdp-$stamp.csv" -NoTypeInformation
if ($rdpEnabled -and -not $nlaEnabled) { Write-Warning "RDP enabled WITHOUT NLA — high brute-force risk." }

Write-Host "[2] Scheduled tasks created/modified in last 7 days..." -ForegroundColor Cyan
Get-ScheduledTask | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    $taskPath = "$($_.TaskPath)$($_.TaskName)"
    $xml = (Export-ScheduledTask -TaskName $_.TaskName -TaskPath $_.TaskPath -ErrorAction SilentlyContinue)
    if ($xml -match '<Date>(.*?)</Date>') {
        $created = [datetime]$Matches[1]
        if ($created -gt (Get-Date).AddDays(-7)) {
            [PSCustomObject]@{Task=$taskPath; Created=$created; State=$_.State; Author=$_.Author}
        }
    }
} | Tee-Object -Variable recentTasks | Export-Csv "$out\tasks-$stamp.csv" -NoTypeInformation
if ($recentTasks) { Write-Warning "$($recentTasks.Count) recent task(s) — review for persistence." }

Write-Host "[3] Volume Shadow Copy status..." -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
$vssSvc = Get-Service VSS -ErrorAction SilentlyContinue
[PSCustomObject]@{ShadowCount=($shadows | Measure-Object).Count; VSSState=$vssSvc.Status; VSSStartType=$vssSvc.StartType} |
    Export-Csv "$out\vss-$stamp.csv" -NoTypeInformation
if (-not $shadows) { Write-Warning "NO shadow copies present — possible T1490 deletion or disabled protection." }

Write-Host "[4] Recent failed logons (brute-force indicator)..." -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddHours(-24)} -MaxEvents 5000 -ErrorAction SilentlyContinue |
    Group-Object { $_.Properties[19].Value } | Sort-Object Count -Descending | Select-Object -First 10 Name, Count |
    Export-Csv "$out\failed-logons-$stamp.csv" -NoTypeInformation

Write-Host "Triage complete. Results in $out" -ForegroundColor Green

Incident Response Priorities

T-minus detection checklist (before encryption fires)

• Edge authentication anomalies: VPN/SSO logons from impossible-travel geographies, TOR exits, or ASNs inconsistent with the user base — particularly against Check Point and Cisco FMC-managed environments pending CVE-2026-50751 / CVE-2026-20316 patch verification.
• Shadow copy tampering: any vssadmin delete shadows, wmic shadowcopy delete, or bcdedit recovery tampering — treat as a pre-detonation alarm, page the on-call IR lead immediately.
• Compression tool execution from non-interactive parents (the KQL above) — affiliates stage data with 7-Zip/WinRAR before exfil.
• New local/domain admin creation and GPO modification — encryption deployment typically rides Group Policy or PsExec sweeps.
• Cloud sync tooling installed by non-IT users (rclone, MEGAsync) — the standard exfil channel in double extortion.
• EDR tampering attempts: sensor service stops, driver unloads, or safe-mode boot configuration changes.

Assets this profile historically prioritizes for exfiltration

Based on the double-extortion model and sector targeting: finance/legal file shares, HR and PII repositories, email archives of executives, customer databases, and — for maritime/logistics environments — operational manifests, cargo records, and customs documentation (high leverage for extortion pressure). Healthcare listings (e.g., the Hunter Neurology claim) imply PHI repositories as leverage material.

Containment actions, ordered by urgency

1. Isolate, don't power off hosts showing shadow-deletion or mass-compression signals — preserve memory for forensics.
2. Disable compromised accounts and revoke active sessions/tokens (including VPN and SSO refresh tokens).
3. Block egress for known exfil tooling (rclone endpoints, MEGA, anonymous file shares) at the proxy and firewall.
4. Segment the affected VLAN/subnet from backup infrastructure and hypervisor management planes (vCenter) — CVE-2026-59310 makes vCenter a mass-encryption pivot.
5. Snapshot and verify offline/immutable backups before any remediation that could trigger detonation.
6. Engage IR retainers and legal/comms early — leak-site listing triggers regulatory-clock questions even where the claim is unverified.

Hardening Recommendations

Immediate (24 hours)

• Verify patch status on CISA KEV edge assets: CVE-2026-50751 (Check Point), CVE-2026-20316 (Cisco FMC), CVE-2026-59310 (vCenter), CVE-2026-63077 (TeamCity), CVE-2026-48027 (Nx Console). If unpatched and internet-facing, take offline or ACL-restrict immediately.
• Enforce NLA + MFA on all RDP; move RDP behind VPN or eliminate internet exposure entirely. Audit for port 3389 reachable from the internet using the triage script above.
• Deploy the Sigma shadow-copy deletion rule to all Windows endpoints and alert to a 24/7 queue.
• Verify backup immutability and test one restore — not next week, today.
• Block macro execution from internet-sourced Office files (Mark-of-the-Web policy) to blunt phishing-macro initial access.

Short-term (2 weeks)

• Segment OT/operational networks from IT, with brokered jump access — critical for maritime/port environments in this campaign's targeting pattern.
• Implement application control (WDAC/AppLocker) blocking PsExec-class remote execution tools and unsigned compression utilities outside approved paths.
• Deploy egress filtering with TLS inspection on server VLANs — exfil is the leverage; choke it.
• Establish deception: canary credentials and honey file shares to catch pre-detonation reconnaissance.
• Tabletop the double-extortion scenario with legal, comms, and executives — the leak-site listing itself is a crisis event regardless of technical confirmation.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub