Classification: TLP:CLEAR | Publication Date: 2026-10-17 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 26 Leak-Site Claims in Two Days

Executive Summary

Between 2026-10-16 and 2026-10-17, the ransomware group operating as N0N published 26 victim listings on its dark web leak site — a compressed, high-volume posting cadence that suggests either a bulk disclosure event following a wave of intrusions, a deliberate pressure tactic, or padding of the site with unverifiable claims. Security teams in manufacturing, healthcare, and technology, particularly those with US or Brazilian operations, should treat this as a sector-wide exposure signal and run the pre-detonation hunt content in this briefing now — not after a ransom note appears.

Critical caveat up front: these are claims by a criminal organization, not confirmed breaches. N0N has listed organizations including Prafesta Ind. e Com. de Embalagens Ltda (Manufacturing, BR), Xinos Construction Corp and its accounting group (Manufacturing), and BladeTech Inc (Manufacturing, US), along with 23 anonymized entries. Nothing in this data confirms any intrusion occurred. Only 18 of the 26 listings were independently observed by a second crawler; 8 exist on a single source and cannot even be confirmed as genuine gang postings.

Sourcing & Verification

• Corroboration status: Of 26 recent listings on N0N's leak site, 18 were independently observed by a second leak-site crawler (MULTI-SOURCE), meaning two independent monitoring systems saw the gang publish the claim. 8 listings appear on a single source only (SINGLE-SOURCE) and cannot be confirmed as actual postings.
• What inclusion means: A listing reflects the threat actor's claim and is NOT confirmation of a breach. MULTI-SOURCE corroboration confirms the gang made the claim; it does not confirm the underlying compromise. No tier in our data confirms a breach — only the named organization or its regulator can do that.
• Disputes and denials: A named organization may dispute a listing, and a denial is likewise not proof the claim is false. Disclosure obligations vary by jurisdiction and sector, and not every incident is reportable — so neither silence nor denial settles the question.
• Corrections: Security Arsenal will publish corrections as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

N0N is an emerging or recently rebranded ransomware operation with a thin public attribution record. Honest assessment of what we know versus what we don't:

• Aliases / attribution: No confirmed aliases or linkage to prior brands (e.g., LockBit, BlackCat/ALPHV successors) have been established at the time of publication. The name may represent a rebrand of a dissolved operation — a common pattern — but we do not assert that linkage without evidence.
• Operating model: Not yet confirmed. The burst-style posting cadence (23 listings on a single day) is consistent with both a RaaS affiliate model (multiple affiliates dumping victims simultaneously) and a closed group staging a bulk release. Treat as undetermined.
• Ransom demands: No verified demand amounts are available in our current collection. Do not rely on assumed figures for negotiation planning.
• Initial access methods: Not confirmed for this specific group. Given the sector profile (manufacturing, healthcare, technology) and current CISA KEV activity, the plausible exposure surface — framed explicitly as hypothesis, not attribution — includes perimeter devices (VPN/firewall), virtualization management planes, and CI/CD infrastructure (see CVE section below).
• Extortion model: The existence of a leak site indicates at least double extortion capability (encryption + data-leak threat). Whether N0N engages in triple extortion (DDoS, customer notification) is unknown.
• Dwell time: Unknown for this group. Industry median dwell time for ransomware operations in 2025–2026 runs from days to roughly two weeks; defenders should assume staging activity may be present in their environment now even if encryption has not fired.

Analyst note: Where a profile field reads "unknown," that is the intelligence. Inflating an emerging gang's profile with borrowed TTPs from other groups produces bad detection engineering. The detection content below therefore targets behavioral ransomware TTPs generic to the double-extortion playbook, prioritized against the sectors N0N claims to be targeting.

Current Campaign Analysis

Sector targeting

From the 26 most recent listings:

The heavy use of anonymized "Company #N" entries (13 of 15 in this pull) is a classic escalation ladder: the gang posts a placeholder first, then names the victim if payment stalls. Organizations that discover an intrusion in progress should assume they may already be an anonymous entry on this site.

Geographic concentration

US-domiciled organizations dominate the listings (at least 7 of 15 in this sample), followed by Brazil (BR), with Egypt (EG) and the Netherlands (NL) appearing in the aggregate targeting data. The US/BR pairing is consistent with Portuguese- and English-language phishing or access-broker supply chains, though this is inference, not confirmed tradecraft.

Victim profile

Named manufacturing victims span mid-market industrial/packaging firms (Prafesta) to construction and specialty manufacturing (Xinos, BladeTech). These are typically organizations with $10M–$500M revenue, lean IT security staffing, OT/IT convergence risk, and ERP/accounting data attractive for extortion — note that Xinos was listed together with its accounting group, suggesting the gang is deliberately naming downstream financial stakeholders to amplify pressure.

Posting frequency / escalation

23 listings published on 2026-10-16 alone, followed by at least 2 more on 2026-10-17. This is a burst cadence, not a drip. Two readings: (a) a genuine wave of simultaneous intrusions reaching the leak-threat stage together, or (b) site inflation to manufacture momentum — supported by the fact that 8 of 26 listings are single-source and unverifiable even as postings. Defenders should plan for (a) while analysts weight (b).

CVE exposure — hypothesis, not attribution

We have no evidence linking any specific N0N listing to a specific CVE. However, the following CISA KEV entries (all confirmed ransomware-exploited) map directly onto the exposure surface of the sectors N0N claims to target, and patching them is justified independently of any attribution:

• CVE-2026-59310 — VMware vCenter path traversal (KEV 2026-08-18): vCenter compromise is the single highest-impact pre-ransomware condition; it enables mass hypervisor-level encryption. Manufacturing and healthcare estates are disproportionately VMware-dense.
• CVE-2026-63077 — JetBrains TeamCity deserialization (KEV 2026-08-05): CI/CD compromise enables supply-chain-style payload delivery and credential harvesting. Directly relevant to technology-sector targets.
• CVE-2026-20316 — Cisco Secure FMC hard-coded password (KEV 2026-07-29) and CVE-2026-50751 — Check Point Security Gateway improper authentication (KEV 2026-06-08): perimeter management-plane and VPN-gateway exploitation are the dominant initial-access family across ransomware generally.
• CVE-2026-48027 — Nx Console embedded malicious code (KEV 2026-05-27): developer-toolchain supply chain; relevant to technology victims.

Treat unpatched instances of any of the above as active pre-conditions for a N0N-style intrusion, and hunt for staging behavior wherever they exist.

Detection Engineering

The following content targets the generic double-extortion kill chain — perimeter/VPN access, execution via phishing payloads, lateral movement via PsExec/WMI, and pre-encryption staging (shadow copy deletion, mass exfil prep) — which is the playbook any leak-site-driven group like N0N must execute to make good on its claims.

---
title: Volume Shadow Copy Deletion via Command-Line Tools
description: Detects deletion or resizing of Volume Shadow Copies, a hallmark pre-encryption staging behavior across ransomware operations including leak-site groups like N0N
logsource:
  category: process_creation
  product: windows
  definition: Sysmon or Windows Security 4688 with command-line auditing
detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'resize shadowstorage'
  selection_wmic:
    Image|endswith: '\wmic.exe'
    CommandLine|contains: 'shadowcopy'
  selection_powershell:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'Get-WmiObject Win32_Shadowcopy'
      - 'Remove-CimInstance'
  selection_diskshadow:
    Image|endswith: '\diskshadow.exe'
    CommandLine|contains: 'delete shadows'
  condition: 1 of selection_*
falsepositives:
  - Legitimate backup administration; baseline and whitelist known admin hosts
level: high
tags:
  - attack.impact
  - attack.t1490
author: Security Arsenal Detection Engineering
date: 2026/10/17
---
title: PsExec-Style Remote Service Creation for Lateral Movement
description: Detects remote service creation via admin shares consistent with PsExec and clone tools used for ransomware lateral movement and mass deployment
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 7045
    Service_File_Name|contains:
      - 'ADMIN$'
      - '\\PSEXESVC'
      - '\\RemComSvc'
      - '%SystemRoot%\\PSEXESVC.exe'
  condition: selection
falsepositives:
  - Legitimate administrative tooling; correlate with source host and account
level: high
tags:
  - attack.lateral-movement
  - attack.t1021.002
  - attack.t1569.002
author: Security Arsenal Detection Engineering
date: 2026/10/17
---
title: Office Application Spawning Scripting or Command Interpreter
description: Detects Microsoft Office processes spawning cmd, PowerShell, wscript, or mshta — consistent with macro-based phishing execution used for initial access
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
      - '\mspub.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; some legacy line-of-business integrations. Investigate all hits during active campaign windows.
level: high
tags:
  - attack.initial-access
  - attack.t1566.001
  - attack.t1059
author: Security Arsenal Detection Engineering
date: 2026/10/17

The following Sentinel hunt looks for the pre-ransomware staging sequence: shadow copy tampering followed by remote service creation from the same host within a short window — a high-signal composite for imminent detonation.

let window = 14d;
let shadow =
    DeviceProcessEvents
    | where Timestamp > ago(window)
    | where ProcessCommandLine has_any ("delete shadows", "shadowcopy delete", "resize shadowstorage", "delete shadows oldest")
    | project ShadowTime=Timestamp, DeviceName, AccountName, ShadowCmd=ProcessCommandLine;
let svc =
    DeviceEvents
    | where Timestamp > ago(window)
    | where ActionType == "ServiceInstalled"
    | extend ServiceName = tostring(parse_json(AdditionalFields).ServiceName)
    | where ServiceName has_any ("PSEXESVC", "RemComSvc") or tostring(AdditionalFields) has "ADMIN$"
    | project SvcTime=Timestamp, DeviceName, ServiceName;
shadow
| join kind=inner svc on DeviceName
| where abs(datetime_diff('minute', SvcTime, ShadowTime)) <= 30
| project DeviceName, AccountName, ShadowTime, ShadowCmd, SvcTime, ServiceName
| sort by ShadowTime desc;

The following script gives first responders a rapid triage snapshot: recently created scheduled tasks (a common persistence/staging mechanism), shadow copy inventory state, and externally exposed RDP listeners.

# N0N Pre-Detonation Rapid Triage — run elevated on suspect hosts
$cutoff = (Get-Date).AddDays(-7)

Write-Host "=== Scheduled tasks created/modified in last 7 days ===" -ForegroundColor Cyan
Get-ScheduledTask | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    $task = $_
    $xml = Export-ScheduledTask -TaskName $task.TaskName -TaskPath $task.TaskPath -ErrorAction SilentlyContinue
    if ($xml -and ([xml]$xml).Task.RegistrationInfo.Date) {
        $created = [datetime]([xml]$xml).Task.RegistrationInfo.Date
        if ($created -gt $cutoff) {
            [PSCustomObject]@{ Task=$task.TaskName; Path=$task.TaskPath; Created=$created; Author=([xml]$xml).Task.RegistrationInfo.Author }
        }
    }
} | Format-Table -AutoSize

Write-Host "=== Volume Shadow Copy inventory (should NOT be empty) ===" -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) { Write-Host "WARNING: NO shadow copies present — possible anti-recovery staging" -ForegroundColor Red }
else { $shadows | Select-Object DeviceObject, InstallDate, VolumeName | Format-Table -AutoSize }

Write-Host "=== RDP exposure check ===" -ForegroundColor Cyan
$rdp = Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue
if ($rdp) {
    Write-Host "RDP LISTENING on 3389" -ForegroundColor Yellow
    $rdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections
    Write-Host "fDenyTSConnections = $rdpEnabled (0 = RDP enabled)"
    $nla = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue).UserAuthentication
    if ($nla -ne 1) { Write-Host "WARNING: NLA not enforced — brute-force surface exposed" -ForegroundColor Red }
} else { Write-Host "No RDP listener on 3389" }

Write-Host "=== Recent failed logons (brute-force indicator) ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=$cutoff} -MaxEvents 2000 -ErrorAction SilentlyContinue |
  Group-Object { $_.Properties[19].Value } | Sort-Object Count -Descending | Select-Object -First 10 Count, Name | Format-Table -AutoSize

Incident Response Priorities

T-minus detection checklist — before encryption fires

Prioritize these in order; the first three indicate imminent detonation:

1. Shadow copy deletion or resize events (vssadmin, diskshadow, WMIC shadowcopy) — anti-recovery staging, typically hours before detonation.
2. Mass remote service creation across multiple hosts from a single source (PsExec-style deployment of the encryptor).
3. New scheduled tasks on servers/DCs within the last 7 days pointing to unknown binaries in C:\ProgramData, C:\Users\Public, or temp paths.
4. Credential dumping artifacts: lsass.exe memory access by non-system processes, ntds.dit access, presence of mimikatz-family strings in command lines.
5. Exfiltration staging: large archive creation (rar/7z) in bulk, sustained high-egress sessions to unfamiliar cloud storage or IPs, rclone.exe or megacmd presence.
6. Perimeter anomalies: VPN logons from unusual geographies/ASNs against accounts without MFA friction, especially for Cisco FMC / Check Point-managed environments pending CVE-2026-20316 / CVE-2026-50751 patching.

Assets this playbook prioritizes for exfiltration

Based on the double-extortion model and the sectors in this campaign:

• ERP, accounting, and payroll data — the Xinos listing explicitly naming its accounting group shows gangs leverage financial-stakeholder pressure; assume finance shares are targeted.
• File servers and NAS/SAN-backed shares with broad user access.
• Backup infrastructure — both as an exfil source and a destruction target (Veeam/backup admin consoles are priority-one to isolate).
• Email archives of executives and legal counsel (negotiation leverage).
• For healthcare exposure: patient data stores — note that a leak-site claim alone may trigger regulatory assessment obligations; involve counsel early.

Containment actions, ordered by urgency

1. Isolate, don't reimage. Network-quarantine any host showing staging indicators (EDR isolation); preserve memory and triage artifacts before remediation.
2. Kill the deployment path: disable SMBv1, temporarily restrict admin shares, and block inter-host RPC/WMI between workstation VLANs.
3. Force-reset credentials for any account observed in staging telemetry — including service accounts and KRBTGT if DC involvement is suspected.
4. Take backup infrastructure offline from the production network and verify at least one immutable/offline restore point before any encryption event.
5. Snapshot virtual infrastructure out-of-band (vCenter-level), especially where CVE-2026-59310 exposure is unresolved.
6. Engage IR retainer and legal/comms early — a leak-site listing, even unverified, has disclosure and reputational timelines attached to it.

Hardening Recommendations

Immediate (24 hours)

• Patch or isolate the KEV perimeter: CVE-2026-50751 (Check Point), CVE-2026-20316 (Cisco FMC), CVE-2026-59310 (vCenter), CVE-2026-63077 (TeamCity), CVE-2026-48027 (Nx Console). If patching isn't possible today, remove the management interfaces from any untrusted network path.
• Enforce phishing-resistant MFA (FIDO2 or at minimum number-matching) on all VPN, remote access, and admin portals. Disable NLA-less RDP; restrict 3389 to a jump host.
• Deploy the Sigma rules above and run the Sentinel hunt across the last 14 days.
• Verify shadow copies exist on critical servers and enable tamper protection on EDR to block vssadmin abuse.
• Block macro execution from internet-sourced Office documents (Mark of the Web policy) if not already enforced.

Short-term (2 weeks)

• Segment flat networks: workstations must not reach server management planes (hypervisors, backup consoles, vCenter) directly; enforce host-based firewalling on lateral ports (445, 135, 5985).
• Immutable backups: move at least one restore tier to object-lock/immutable storage with credentials isolated from production AD.
• Egress control: deny unsanctioned cloud storage and alert on rclone-class tooling and sustained >X GB outbound transfers from servers.
• CI/CD hardening: isolate TeamCity/build infrastructure, rotate all secrets material to build agents, and audit for CVE-2026-48027-related toolchain tampering.
• Deception: deploy canary files and honey credentials on file shares — ransomware staging touches them early and they generate near-zero false positives.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub