Classification: TLP:CLEAR | Publication Date: 2026-11-12 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

Executive Summary

Between 2026-11-09 and 2026-11-11, the ransomware group tracked as N0N posted 26 new victim listings to its dark web leak site — a concentrated burst of activity representing the entirety of the group's last 100 postings window. The listings span at least seven countries: Qatar (QA), Ethiopia (ET), United States (US), Netherlands (NL), Italy (IT), Canada (CA), and the United Kingdom (GB), with the United States accounting for the plurality of claims. Sector attribution for all 26 listings is Not Found in the source data, meaning N0N either withheld industry classification or the crawler could not resolve it — analysts should treat sector targeting as currently unknown rather than diversified.

Every listing in this dataset is a claim by a criminal actor. N0N asserts it has compromised these organizations; this briefing does not assert that any breach occurred. What is actionable regardless of claim veracity: a 26-listing burst in a 72-hour window is consistent with either (a) a batch-detonation campaign exploiting a common exposure, or (b) leak-site padding intended to inflate perceived operational tempo. Both scenarios warrant the same defensive response — proactive hunting against the intrusion-stage TTPs documented below.

Sourcing & Verification

• Corroboration status: 0 of 26 listings were independently observed by a second leak-site crawler. All 26 listings are single-source, appearing only via ransomware.live monitoring of N0N's .onion infrastructure. Single-source does not mean false — it means no independent crawler has confirmed the posting itself exists.
• Inclusion reflects the threat actor's claim. A leak-site listing is an accusation, not confirmation of a breach. No corroboration tier in this dataset — including multi-source — confirms that any organization was actually compromised. Only the organization itself or its regulator can confirm an incident.
• A named organization may dispute a listing, and a denial is likewise not proof the claim is false. Disclosure obligations vary by jurisdiction and sector, and not every incident is legally reportable. Neither silence nor denial settles the question; this briefing reports the claim, not its truth value.
• Corrections: Security Arsenal will publish corrections to this briefing if warranted. We welcome contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

Attribution caveat: Public reporting on N0N remains thin, and this section distinguishes confirmed observation from analytical inference.

• Aliases: None confirmed in our dataset. The stylized 'N0N' (zero) naming collides with unrelated handles in underground forums; analysts should avoid conflating forum personas with the leak-site operator without infrastructure overlap.
• Operating model: Unconfirmed. The burst-posting pattern (26 listings in 72 hours) is more consistent with a closed group or small affiliate cluster executing a single access vector at scale than with a mature RaaS program, whose postings typically arrive in a steady drip from disparate affiliates. This is a hypothesis, not an established fact.
• Ransom demands: Not disclosed in the source data. No demand figures accompanied the listings.
• Initial access methods (sector-level hypothesis): No victim-specific intrusion vector is confirmed. However, the current CISA KEV catalog shows active ransomware exploitation of edge and management-plane vulnerabilities relevant to any mass-compromise campaign: CVE-2026-50751 (Check Point Security Gateway improper authentication in IKEv1 key exchange), CVE-2026-20316 (Cisco Secure FMC hard-coded password), and CVE-2026-59310 (VMware vCenter path traversal). A batch campaign of this size classically follows mass exploitation of exactly this category of exposure — perimeter VPN/firewall appliances and virtualization management planes. Treat these CVEs as exposure hypotheses to hunt against, not as confirmed N0N vectors.
• Double extortion: The existence of a leak site with named (if anonymized in our feed) listings indicates N0N operates an extortion model that threatens data publication. Whether encryption accompanies exfiltration in current operations is unconfirmed.
• Dwell time: Unknown for this group. Industry median for ransomware dwell time in batch campaigns exploiting edge devices runs days to two weeks; the compressed posting schedule here suggests access may have been obtained in a narrow window, possibly via a single exploited vulnerability class.

Current Campaign Analysis

Sectors targeted: Not Found across all 26 listings. This is itself analytically significant: gangs running sector-focused campaigns (healthcare, legal, manufacturing) typically advertise the sector to maximize pressure. Blank sector fields suggest either opportunistic scanning-driven compromise or deliberate obfuscation. Do not brief leadership that any specific industry is 'targeted' — the data does not support it.

Geographic concentration: US-domiciled organizations dominate the listing set (at least 9 of 15 shown, and the majority of the full 26-listing window), with secondary presence in NL, IT, CA, GB, QA, and ET. Two listings carry unknown country attribution. The spread across NATO-member states plus Qatar and Ethiopia is consistent with opportunistic, exposure-driven victim selection rather than geopolitical targeting.

Victim profile: Company size and revenue data are not available in the source feed. With sectors unresolved, revenue estimation would be fabrication — we decline to provide it.

Posting frequency / escalation: 15 listings on 2026-11-09, then a two-day gap, then 2 listings on 2026-11-11. The front-loaded burst followed by a taper is characteristic of batch detonation from a single access wave, with residual postings as stragglers are processed. Watch for a second burst within 7–14 days, which would indicate an ongoing exploitation pipeline rather than a one-time event.

CVE connection (hypothesis only): Given the burst pattern, prioritize validating patch posture on the edge devices implicated by current KEV entries: Check Point gateways (CVE-2026-50751), Cisco FMC (CVE-2026-20316), vCenter (CVE-2026-59310), and TeamCity build servers (CVE-2026-63077 — a historically ransomware-favored target for supply-chain pivoting). No evidence links any specific listing to any specific CVE; this is exposure-driven prioritization.

Detection Engineering

The following detections target the intrusion lifecycle stages that must occur before any leak-site claim becomes real: edge exploitation follow-on activity, lateral movement, and pre-encryption staging. They are vector-agnostic because N0N's specific vector is unconfirmed.

---
title: Suspicious Process Spawned by VPN/Firewall Management Service
description: Detects shell or scripting interpreters spawned by edge appliance management processes, consistent with post-exploitation of perimeter devices (e.g., Check Point, Cisco FMC compromise follow-on)
status: experimental
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\cpms.exe'
      - '\fmcdaemon.exe'
      - '\httpd.exe'
      - '\tomcat9.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\bash.exe'
      - '\sh.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate management plane scripts during upgrades
level: high
date: 2026/11/12
---
title: Pre-Ransomware Data Staging via Archiving Tools
description: Detects mass archive creation or use of rclone/7z/WinRAR with exfiltration-adjacent flags, a hallmark of double-extortion staging before encryption
status: experimental
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\rclone.exe'
      - '\7z.exe'
      - '\winrar.exe'
      - '\rar.exe'
  selection_flags:
    CommandLine|contains:
      - ' a '
      - 'copy '
      - 'sync '
      - ' -v '
      - '--transfers'
      - '\ProgramData\'
      - '\Temp\'
  condition: selection_img and selection_flags
falsepositives:
  - Backup administrators using rclone for sanctioned cloud sync
level: high
date: 2026/11/12
---
title: Volume Shadow Copy Deletion via WMIC or Vssadmin
description: Detects shadow copy deletion and boot recovery tampering, a near-universal pre-encryption action across ransomware families
status: tested
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    CommandLine|contains:
      - 'shadowcopy delete'
      - 'delete shadows'
      - 'resize shadowstorage'
  selection_bcd:
    CommandLine|contains:
      - 'bcdedit'
      - 'recoveryenabled no'
      - 'ignoreallfailures'
  condition: 1 of selection_*
falsepositives:
  - Storage administrators resizing shadowstorage (rare, alert anyway)
level: critical
date: 2026/11/12

The KQL query below hunts for the lateral-movement-to-staging transition: a host that received inbound administrative authentication (WMI/PsExec-style 4624 type 3 with admin share access) followed by spawning of archiving or enumeration tooling within 30 minutes.

let lookback = 7d;
let staging_tools = dynamic(["rclone.exe", "7z.exe", "winrar.exe", "rar.exe", "psexec.exe", "paexec.exe", "adfind.exe", "nltest.exe", "netscan.exe"]);
let lateral_sources =
    SecurityEvent
    | where TimeGenerated > ago(lookback)
    | where EventID == 4624 and LogonType == 3
    | where IpAddress !startswith "10." == false or Account !endswith "$"
    | summarize FirstLogon = min(TimeGenerated) by Computer, Account, IpAddress;
DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where FileName in~ (staging_tools)
| extend ProcessTime = TimeGenerated
| join kind=inner lateral_sources on Computer
| where ProcessTime between (FirstLogon .. FirstLogon + 30m)
| project Computer, Account, IpAddress, FirstLogon, ProcessTime, FileName, ProcessCommandLine
| sort by FirstLogon asc

The rapid-response script below enumerates the three highest-signal artifacts for an unconfirmed claim: scheduled tasks created in the last 7 days (persistence), shadow copy state (tampering), and exposed RDP listeners reachable on non-standard config (initial access surface).

# Security Arsenal — N0N Campaign Rapid Triage (run elevated)
$cutoff = (Get-Date).AddDays(-7)

Write-Host "=== Scheduled Tasks Created in Last 7 Days ===" -ForegroundColor Cyan
Get-ScheduledTask | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo
    [PSCustomObject]@{ TaskName=$_.TaskName; Path=$_.TaskPath; Author=$_.Author }
} | Where-Object { $_.Author -notmatch 'Microsoft' } | Format-Table -AutoSize

Write-Host "=== Volume Shadow Copy State ===" -ForegroundColor Cyan
$shadows = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) { Write-Host "WARNING: No shadow copies present — verify against backup baseline (possible tampering)" -ForegroundColor Red }
else { $shadows | Select-Object DeviceObject, InstallDate | Format-Table -AutoSize }

Write-Host "=== RDP Exposure Check ===" -ForegroundColor Cyan
$rdpEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$nla = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp').UserAuthentication
Write-Host "RDP Enabled: $rdpEnabled | NLA Required: $($nla -eq 1)"
if ($rdpEnabled -and $nla -ne 1) { Write-Host "CRITICAL: RDP exposed without NLA — restrict or disable immediately" -ForegroundColor Red }

Write-Host "=== Recent Logon Type 10 (RDP) Failures — Brute Force Indicator ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=$cutoff} -MaxEvents 5000 -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'Logon Type:\s+10' } |
  Group-Object { ($_.Message -split "\n") -match 'Source Network Address' } |
  Sort-Object Count -Descending | Select-Object -First 10 Count, Name | Format-Table -AutoSize

Incident Response Priorities

T-minus detection checklist (before encryption fires):

1. New local or domain accounts created outside change control, especially with admin group membership
2. Archive files >1GB appearing in user-writable staging directories (\ProgramData\, \Perflogs\, user temp paths)
3. Outbound TLS sessions to file-sharing or bulletproof hosting ASNs from servers that never previously made external connections
4. vssadmin, bcdedit, or wbadmin execution on any server — page the on-call responder, do not wait for correlation
5. EDR/AV tampering events: service stops, exclusion additions, sensor uninstalls
6. AdFind/SharpHound/nltest execution — domain reconnaissance precedes enterprise-wide detonation by hours to days

Assets this threat class historically prioritizes for exfiltration: With N0N's specific exfiltration preferences unconfirmed, apply the double-extortion baseline: finance and HR databases, legal/contracts repositories, email archives of executives, and anything covered by data-protection regulation (the leak threat is only as strong as the regulatory pain it inflicts). Identify where your regulated data lives now, because that is what a leak listing threatens to publish.

Containment actions, ordered by urgency:

1. Isolate affected hosts at the network layer (EDR isolate or switch ACL) — do not power off; volatile memory holds key material and session artifacts
2. Disable compromised accounts enterprise-wide, including service accounts showing anomalous logons
3. Block identified exfiltration destinations at the egress proxy; enable TLS inspection on server VLANs if not already present
4. Snapshot forensic images of domain controllers and any host showing staging indicators before remediation
5. Rotate KRBTGT twice if domain controller compromise is suspected; assume all Kerberos material is burned
6. Engage external IR before negotiating or acknowledging any listing — a response to the gang's claim confirms the mailbox is monitored

Hardening Recommendations

Immediate (24 hours):

• Audit and patch all perimeter devices against the active KEV set: Check Point gateways (CVE-2026-50751), Cisco FMC (CVE-2026-20316), vCenter (CVE-2026-59310), and any internet-reachable TeamCity instance (CVE-2026-63077). These are confirmed ransomware-exploited; whether or not N0N uses them, they are open doors.
• Disable or ACL-restrict RDP at the perimeter; enforce NLA; alert on any type-10 logon from an unexpected ASN
• Deploy the Volume Shadow Copy deletion Sigma rule above as a page-worthy (not ticket-worthy) alert
• Verify backup immutability and test one restore — today, not this quarter

Short-term (2 weeks):

• Segment management planes: vCenter, FMC, and firewall management interfaces must not be reachable from general user VLANs
• Implement egress filtering that denies server-initiated connections to uncategorized destinations by default
• Deploy canary files in high-value shares with alerting on read access — the cheapest pre-exfiltration tripwire available
• Roll out LAPS and remove standing local admin rights to collapse lateral movement paths
• Establish a leak-site monitoring watch on your organization's name and domains so a claim — verified or not — reaches you through your SOC rather than through a journalist

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub