Classification: TLP:CLEAR | Publication Date: 2026-10-17 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 27 Leak-Site Postings Tracked — Sector Targeting Analysis, Detection Rules & IR Playbook

Executive Summary

Security Arsenal's dark web monitoring has tracked a sustained posting cadence on the N0N ransomware gang's .onion leak site, with 27 victim claims observed across the group's most recent 100 postings and 15 distinct listings published on 2026-10-16 and 2026-10-17 alone. N0N has listed organizations in the manufacturing, healthcare, and technology sectors, with claimed victims concentrated in the United States and additional listings tagged to Brazil, Egypt, and the Netherlands. Named claims include Prafesta Ind. e Com. de Embalagens Ltda (Manufacturing, BR) and Xinos Construction Corp and its accounting group (Manufacturing), alongside numerous anonymized "Company #NN" placeholder entries — a pattern that typically indicates victims still under active extortion negotiation whose identities the gang has not yet chosen to expose.

It is critical to understand what this data is: these are claims made by a criminal organization on its own infrastructure. None of these listings confirm that any organization was breached. What the data does confirm — with multi-source corroboration on 22 of 27 listings — is that N0N is operationally active, posting at an elevated tempo, and running a double-extortion playbook that enterprise defenders in manufacturing, healthcare, and technology should treat as an imminent threat-model input. This briefing provides sector-level exposure analysis tied to currently exploited CISA KEV vulnerabilities, Sigma and KQL detection content targeting pre-encryption behaviors, and an incident response playbook sequenced to this gang's observed extortion pattern.

Sourcing & Verification

• Corroboration breakdown: 22 of the 27 listings analyzed were independently observed by a second leak-site crawler (tagged MULTI-SOURCE); 5 listings appear on a single source only. Multi-source corroboration confirms that the gang made the claim — it does not confirm the underlying intrusion.
• Claims, not confirmations: Inclusion in this briefing reflects the threat actor's claim published on N0N's leak site. It is not confirmation that any named organization was breached, attacked, or is managing an active incident. Only the organization itself or its regulator can confirm an incident.
• Disputes and denials: A named organization may dispute a listing, and a denial is likewise not proof that the claim is false. Disclosure obligations vary by jurisdiction, sector, and data type, and not every incident is legally reportable — so neither silence nor denial settles the question. We present the actor's claims as claims, nothing more.
• Corrections: Security Arsenal will publish corrections to this briefing as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

Analyst note: Attribution-level detail on N0N remains limited in open sources. The profile below reflects Security Arsenal's assessment based on leak-site telemetry and observed campaign behavior; items marked (assessed) carry moderate confidence and should be treated as working hypotheses, not established fact.

• Aliases: None reliably established at time of publication. The group brands itself consistently as "N0N" on its leak infrastructure.
• Operating model: (Assessed) Closed or semi-closed ransomware operation. The heavy use of anonymized "Company #NN" placeholder listings — rather than fully branded victim reveals — is consistent with a small core team managing negotiations directly rather than a broad affiliate-driven RaaS, where affiliates typically maximize naming speed to pressure victims.
• Extortion model: Double extortion. Listings follow the standard name-and-shame pattern: initial claim, negotiation window (anonymized placeholder), then escalation toward full identity disclosure and data publication if payment is not forthcoming.
• Ransom demands: (Assessed) Demand scale is inferred from the victim profile — small-to-midsize enterprises and regional manufacturers — suggesting demands calibrated to mid-market payment capacity rather than eight-figure enterprise asks. No verified demand figures are available for this campaign.
• Initial access methods: (Assessed) Consistent with the 2026 ransomware baseline for groups targeting manufacturing and mid-market healthcare: exploitation of exposed remote access services (VPN gateways, RDP), phishing with macro- or script-based payloads, and abuse of internet-facing management plane vulnerabilities. See the CVE exposure analysis below — no specific CVE has been linked to any specific named listing.
• Dwell time: (Assessed) The 15 listings published across just two days (2026-10-16 to 2026-10-17) suggest batch processing of intrusions, which is characteristic of dwell times in the days-to-weeks range with staged data exfiltration completed before detonation or disclosure.

Current Campaign Analysis

Sector Targeting

From the 27 recent postings, N0N's claimed targeting spans:

• Manufacturing — the clearest named signal in the data, including Prafesta Ind. e Com. de Embalagens Ltda (Brazil) and Xinos Construction Corp and its accounting group. Manufacturing remains the highest-value ransomware vertical due to operational downtime sensitivity and historically weaker segmentation between IT and OT environments.
• Healthcare — tagged as a targeted sector across the recent posting set. Healthcare listings elevate the regulatory stakes for claimed victims (HIPAA in the US, LGPD in Brazil) and typically increase extortion pressure.
• Technology — present in the sector tags; technology victims are frequently targeted as pivot points into downstream customers.
• "Not Found" — the plurality of listings carry no sector classification, reflecting the anonymized placeholder strategy discussed above.

Geographic Concentration

Claimed victims concentrate in the United States, with secondary presence in Brazil, Egypt, and the Netherlands. The US/BR pairing is notable — it is a common footprint for crews monetizing both North American payment capacity and Latin American organizations with comparatively less mature incident response retainer coverage.

Victim Profile

The named organizations and the sector mix indicate a small-to-midsize enterprise focus: regional manufacturers, construction firms, and mid-market services organizations — likely revenue range roughly $10M–$500M. These organizations typically carry cyber insurance, cannot sustain extended operational outages, and often lack 24/7 detection capability — the precise pressure profile double-extortion crews optimize for. The listing of "Xinos Construction Corp and its accounting group" is a notable escalation tactic: naming a victim's financial services provider signals intent to expose financial records, amplifying reputational and client-trust pressure.

Posting Frequency & Escalation

• 2026-10-16: 12 listings published (batch pattern).
• 2026-10-17: 3 additional listings.

Batch publication of anonymized placeholders followed by staggered reveals is a negotiation-leverage pattern: the gang demonstrates volume to the market while keeping named exposure in reserve for non-payers. Defenders should expect identity escalation on current "Company #NN" entries over the coming 1–3 weeks if negotiations fail.

CVE Exposure — Hypothesis Only

No CVE below has been linked to any specific N0N listing. These are sector-level exposures actively exploited by ransomware operators per CISA KEV, presented as hypothesis for prioritization of patching in the sectors N0N is claiming to target:

Action: If your organization operates any of these products, treat patching as incident-priority regardless of whether you are in N0N's claimed victim set.

Detection Engineering

The following detections target pre-encryption behaviors common to double-extortion operations matching N0N's assessed playbook: VPN/edge-device initial access, macro-driven phishing execution, RDP brute force, PsExec/WMI lateral movement, data staging, and shadow copy destruction. Deploy the Sigma rules to your SIEM and run the KQL hunt weekly.

---
title: RDP Brute Force Followed by Successful Logon — Pre-Ransomware Access Pattern
id: 7f3a2c11-9b4d-4e8a-a1c2-n0nrdp000001
status: experimental
description: Detects password-spray or brute-force bursts against RDP (Event ID 4625) followed by a successful logon (4624 LogonType 10) from the same source — consistent with ransomware initial access against exposed RDP.
author: Security Arsenal Threat Intel
date: 2026/10/17
references:
  - https://securityarsenal.com/darkside
logsource:
  product: windows
  service: security
detection:
  sel_failed:
    EventID: 4625
    LogonType: 10
  sel_success:
    EventID: 4624
    LogonType: 10
  condition: sel_failed and sel_success
timeframe: 15m
falsepositives:
  - Legitimate user mistyping credentials from a remote site
level: high
tags:
  - attack.initial_access
  - attack.t1110
  - attack.t1133
---
title: PsExec or WMI Remote Service Creation — Lateral Movement
id: 8a4b3d22-0c5e-5f9b-b2d3-n0nwmi000002
status: experimental
description: Detects remote service installation (Event ID 7045) with service binaries executed from ADMIN$ or named pipes consistent with PsExec-style tooling, and WMI process creation — pre-encryption staging indicators.
author: Security Arsenal Threat Intel
date: 2026/10/17
logsource:
  product: windows
  service: system
detection:
  sel_service:
    EventID: 7045
    ServiceFileName|contains:
      - 'ADMIN$'
      - 'PSEXESVC'
      - '\\pipe\\'
      - '%SystemRoot%\\PSEXESVC.exe'
  sel_wmi_cmdline:
    Image|endswith: '\\wmiprvse.exe'
    CommandLine|contains:
      - 'cmd.exe'
      - 'powershell'
      - 'rundll32'
  condition: 1 of sel_*
falsepositives:
  - Legitimate administrative software deployment (SCCM, PDQ)
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002
  - attack.t1047
---
title: Shadow Copy Deletion and Backup Tampering — Ransomware Detonation Precursor
id: 9c5d4e33-1d6f-6a0c-c3e4-n0nvss000003
status: experimental
description: Detects Volume Shadow Copy deletion, backup catalog tampering, and recovery-mode disabling via vssadmin, wmic, or bcdedit — high-fidelity precursor to encryption detonation.
author: Security Arsenal Threat Intel
date: 2026/10/17
logsource:
  category: process_creation
  product: windows
detection:
  sel_vss:
    CommandLine|contains:
      - 'vssadmin delete shadows'
      - 'vssadmin Delete Shadows'
      - 'wmic shadowcopy delete'
      - 'wbadmin delete catalog'
      - 'wbadmin delete systemstatebackup'
  sel_bcd:
    CommandLine|contains:
      - 'bcdedit'
    CommandLine|contains|all:
      - 'recoveryenabled'
      - 'no'
  condition: sel_vss or sel_bcd
falsepositives:
  - Rare; legitimate backup maintenance windows should be allow-listed by account and host
level: critical
tags:
  - attack.impact
  - attack.t1490

// N0N-style pre-ransomware staging hunt — Microsoft Sentinel
// Hunts: data staging (archive tools), mass outbound transfer indicators,
// suspicious scheduled task creation, and LOLBin-driven discovery —
// correlated per host within a 7-day window.
let lookback = 7d;
let SuspiciousProcs = dynamic(["rclone.exe","7z.exe","winrar.exe","rar.exe","megacmd.exe","pscp.exe","filezilla.exe","restic.exe"];
let Staging =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName in~ (SuspiciousProcs)
    | project StagingTime=TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName;
let TaskCreate =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName =~ "schtasks.exe" and ProcessCommandLine has "/create"
    | project TaskTime=TimeGenerated, DeviceName, TaskCmd=ProcessCommandLine, TaskAccount=AccountName;
let Discovery =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName in~ ("net.exe","nltest.exe","adfind.exe","sharpadfind.exe")
       or ProcessCommandLine has_any ("net group \"domain admins\"","/domain_trusts","dclist")
    | project DiscTime=TimeGenerated, DeviceName, DiscCmd=ProcessCommandLine, DiscAccount=AccountName;
Staging
| join kind=inner Discovery on DeviceName
| join kind=leftouter TaskCreate on DeviceName
| summarize
    StagingTools = make_set(FileName),
    FirstStaging = min(StagingTime),
    DiscoveryCmds = make_set(DiscCmd),
    ScheduledTasks = make_set(TaskCmd)
  by DeviceName
| extend RiskScore = array_length(StagingTools) + array_length(DiscoveryCmds)
| sort by RiskScore desc;

# N0N Rapid Triage — run elevated on suspect hosts or via remote tooling
# Checks: exposed RDP, scheduled tasks created in last 7 days, shadow copy state, recent suspicious services
$ErrorActionPreference = 'SilentlyContinue'
$report = @()

Write-Host "=== [1] RDP Exposure Check ===" -ForegroundColor Cyan
$rdpEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$nlaEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp').UserAuthentication -eq 1
$rdpPort = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp').PortNumber
$report += "RDP Enabled: $rdpEnabled | NLA: $nlaEnabled | Port: $rdpPort"
if ($rdpEnabled -and -not $nlaEnabled) { $report += "!! RISK: RDP enabled WITHOUT Network Level Authentication" }

Write-Host "=== [2] Scheduled Tasks Created in Last 7 Days ===" -ForegroundColor Cyan
$cutoff = (Get-Date).AddDays(-7)
Get-ScheduledTask | Where-Object { $_.Date -gt $cutoff -and $_.TaskPath -notlike '\Microsoft*' } |
  ForEach-Object {
    $actions = ($_.Actions | ForEach-Object { "$($_.Execute) $($_.Arguments)" }) -join '; '
    $report += "TASK: $($_.TaskName) | Created: $($_.Date) | Runs: $actions"
  }

Write-Host "=== [3] Volume Shadow Copy State ===" -ForegroundColor Cyan
$shadows = Get-WmiObject Win32_ShadowCopy
if (-not $shadows) { $report += "!! WARNING: NO shadow copies present — possible vssadmin deletion (T1490)" }
else { $report += "Shadow copies present: $($shadows.Count) (oldest: $(($shadows | Sort-Object InstallDate | Select-Object -First 1).InstallDate))" }

Write-Host "=== [4] Recently Installed Services (7 days) ===" -ForegroundColor Cyan
Get-CimInstance Win32_Service | Where-Object { $_.PathName -match 'ADMIN\$|PSEXESVC|\\Temp\\|\\Users\\Public\\' } |
  ForEach-Object { $report += "SERVICE: $($_.Name) | Path: $($_.PathName) | State: $($_.State)" }

Write-Host "=== [5] Failed Logon Bursts (Event 4625, last 24h, remote) ===" -ForegroundColor Cyan
$failCount = (Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddHours(-24)} |
  Where-Object { $_.Message -match 'Logon Type:\s+(3|10)' }).Count
$report += "Remote failed logons (24h): $failCount"
if ($failCount -gt 100) { $report += "!! RISK: brute-force-volume failures detected" }

$report | Out-File "$env:TEMP\n0n_triage_$(Get-Date -Format yyyyMMdd_HHmm).txt"
$report

Incident Response Priorities

T-Minus Detection Checklist — Before Encryption Fires

If your organization appears on N0N's leak site — or you detect the behaviors above — assume staging is underway and hunt these, in order:

1. Shadow copy / backup tampering (T1490): vssadmin delete shadows, bcdedit recoveryenabled no, wbadmin delete catalog — the closest signal to imminent detonation.
2. Archive-tool execution at scale (T1560.001): rclone, 7z, WinRAR runs against file servers — staging for exfiltration.
3. Anomalous outbound volume: GB-scale transfers from servers to unfamiliar IPs or cloud storage endpoints in the prior 72 hours.
4. New scheduled tasks / services on servers, especially running from C:\Users\Public\, C:\ProgramData\, or temp paths.
5. PsExec-style service installs (7045) sweeping multiple hosts from a single source — the deployment wave typically precedes detonation by hours.
6. EDR/av tampering: service stops, exclusions added, agent uninstall events.

Assets This Playbook Prioritizes for Exfiltration

Based on the observed double-extortion pattern and the "accounting group" escalation tactic:

• Financial records — ledgers, payroll, banking data (the Xinos listing explicitly names the accounting function).
• File servers and NAS — the primary staging target in manufacturing environments.
• HR/PII repositories — amplified pressure in healthcare-tagged listings (HIPAA/LGPD exposure).
• Email archives of executives and finance staff — used for negotiation leverage and secondary fraud.
• Backup infrastructure itself — both as an exfil source and a destruction target.

Containment Actions — Ordered by Urgency

1. Isolate, don't power off suspected staging hosts (preserve memory for forensics; capture volatile data first if resourced).
2. Block egress for archive/exfil tools and restrict outbound to known-good destinations at the firewall; disable outbound internet from servers that don't require it.
3. Rotate credentials domain-wide — prioritize Tier-0 (DA, service accounts, backup accounts); assume credential theft (LSASS dumping) has occurred.
4. Disable legacy/internet-facing remote access — lock down RDP to VPN-only, enforce NLA, and take any unpatched Check Point/Cisco FMC/vCenter/TeamCity instances off the internet path until patched.
5. Protect backups: take backup consoles offline from the domain, verify offline/immutable copies, and confirm restore capability before you need it.
6. Engage counsel and IR retainer early — leak-site listing status, negotiation posture, and disclosure obligations (which vary by jurisdiction and sector) are legal decisions, not purely technical ones.

Hardening Recommendations

Immediate (24 hours)

• Patch the five KEV entries listed above wherever present — CVE-2026-59310 (vCenter), CVE-2026-20316 (Cisco FMC), CVE-2026-50751 (Check Point), CVE-2026-63077 (TeamCity), CVE-2026-48027 (Nx Console). Treat as incident-priority, not change-window work.
• Kill exposed RDP: VPN-only access, NLA enforced, and account lockout policies tuned to detect brute force (the Sigma rule above gives you detection while you remediate).
• Block macro execution from internet-sourced Office files (Mark-of-the-Web enforcement) — phishing remains the most probable access vector for this victim profile.
• Deploy the detection content above and alert on shadow-copy deletion at CRITICAL severity — it is your last high-fidelity warning.
• Audit outbound traffic for rclone/MEGA/personal cloud-storage endpoints from server VLANs.

Short-Term (2 weeks)

• Segment the network: isolate OT from IT in manufacturing environments; restrict server-to-server SMB/WMI/WinRM to defined admin paths; deploy tiered administration with dedicated privileged access workstations.
• Immutable, offline backups with a tested restore runbook — 3-2-1 minimum, with at least one copy unreachable from production credentials.
• EDR coverage on all servers including backup and virtualization infrastructure; vCenter and hypervisor hosts are detonation force-multipliers and are chronically under-monitored.
• Identity hardening: phishing-resistant MFA (FIDO2) on all remote access and privileged accounts; LAPS for local admin; disable legacy IKEv1 where feasible (relevant to the Check Point exposure).
• Data egress controls: DLP or proxy-level blocking of unsanctioned archive/exfil destinations, with alerting on volume anomalies — exfiltration, not encryption, is the leverage in double extortion.
• Dark web monitoring: subscribe to leak-site monitoring (or engage a provider) so a listing against your organization or your suppliers is detected within hours, not discovered via journalist inquiry.

All victim references in this briefing reflect unverified claims published by the N0N ransomware group on its own leak infrastructure. Security Arsenal presents this data for defensive purposes and will update or correct this briefing as new information becomes available.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub