Classification: TLP:CLEAR | Publication Date: 2026-10-22 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 27 New Leak-Site Listings in 48 Hours — Sector Targeting Analysis & Detection Rules

Executive Summary

The ransomware group tracked as N0N published 27 victim listings to its dark web leak site across 2026-10-21 and 2026-10-22 — an unusually compressed posting cadence that suggests either a bulk leak-site update following a wave of intrusions, or a deliberate pressure tactic to flood negotiations simultaneously.

Named organizations in the listing set include Performance Ford Inc (Retail & E-Commerce, US), Heritage Senior Living (Healthcare, US), Hanjin Information Systems & Telecommunication Co., Ltd. (Technology, KR), and TheHomeMag NorCal (Retail & E-Commerce, US). A large share of the remaining listings appear as anonymized placeholders ("Company #99"–"#109"), indicating victims mid-negotiation — a hallmark of double-extortion playbooks where naming is withheld pending ransom talks.

Important: These are claims published by a criminal group. N0N claims to have compromised these organizations; this briefing does not assert that any breach occurred. Sectors that should treat this as a priority signal: healthcare (PHI exposure risk), retail/e-commerce (POS and customer data), and technology/telecom (supply-chain downstream risk).

Sourcing & Verification

• Corroboration status: 21 of 27 listings were independently observed by a second leak-site crawler (MULTI-SOURCE tier); 6 listings appear on a single source only. MULTI-SOURCE confirms only that two independent crawlers saw the gang publish the claim — it does not confirm any intrusion took place.
• Nature of listings: Inclusion on a leak site reflects the threat actor's claim and is not confirmation of a breach. No corroboration tier in our collection pipeline confirms compromise — only the named organization or its regulator can do that.
• Disputes and denials: A named organization may dispute its listing. A denial is likewise not proof the claim is false — disclosure obligations vary by jurisdiction and sector, and not every incident is reportable. Neither silence nor denial settles the question.
• Corrections: Security Arsenal will publish corrections as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

Current Campaign Analysis

Sector Targeting

From the last 100 N0N postings, the sector mix is: Retail & E-Commerce, Healthcare, Technology, Hospitality, plus a large "Not Found" bucket — which in practice means SMBs and mid-market firms the gang cannot or will not categorize, often because they are still in negotiation.

The healthcare listing — Heritage Senior Living — is the highest-sensitivity claim in this batch. Senior living operators hold PHI, billing data, and often run thin security staffing. The technology listing — Hanjin Information Systems & Telecommunication Co., Ltd. — carries downstream supply-chain concern: if the claim has any substance, customers of that firm should review third-party access paths. Retail claims (Performance Ford Inc, TheHomeMag NorCal) follow the gang's observed preference for customer-data-rich mid-market businesses.

Geographic Concentration

US dominates the named listings; the placeholder set spans BG, KR, PT, ET, TN, TT, CH — a broad, opportunistic spread with no single-country focus. This is consistent with access-driven (not victimology-driven) targeting: the gang compromises what its initial-access tooling reaches, then monetizes.

Victim Profile

Based on sector mix, victims skew small-to-mid-market: regional auto retail, regional publishing, senior care, and a mid-size Korean telecom/IT firm. Estimated revenue band: roughly $5M–$500M, with the bulk likely under $100M — the classic ransomware sweet spot of "large enough to pay, small enough to lack mature detection."

Posting Frequency / Escalation

27 listings in ~48 hours, with heavy use of sequential anonymized placeholders (#99–#109), indicates a batch-dump event. Analysts should watch for: (1) placeholder listings resolving to named organizations over the next 7–14 days as negotiations fail, and (2) sample-data publications escalating pressure on named holdouts.

CVE Exposure Hypothesis (Sector-Level, Not Victim-Level)

We have no evidence linking any specific CVE to any specific named listing. However, N0N's observed access pattern — opportunistic exploitation of internet-facing infrastructure — makes the following actively exploited vulnerabilities (all on CISA KEV with confirmed ransomware use) relevant exposure for organizations in the targeted sectors:

• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1). Direct perimeter bypass; patch/verify immediately if Check Point gateways are internet-facing.
• CVE-2026-20316 — Cisco Secure FMC hard-coded password. Management-plane compromise enabling policy manipulation and lateral movement.
• CVE-2026-59310 — VMware vCenter path traversal. Virtualization control-plane access; pre-encryption hypervisor targeting is a known ransomware endgame.
• CVE-2026-63077 — JetBrains TeamCity deserialization. CI/CD compromise — particularly relevant given the technology-sector listing.
• CVE-2026-48027 — Nx Console embedded malicious code. Supply-chain/developer-toolchain vector.

Detection Engineering

The following detections target the TTP cluster consistent with N0N's observed playbook: perimeter/VPN exploitation, RDP brute force, phishing macro execution, PsExec/WMI lateral movement, and pre-encryption data staging and shadow-copy destruction.

---
title: RDP Brute Force Followed by Successful Logon - Potential Ransomware Initial Access
id: 8f3a1c2e-7b9d-4e5a-a1c3-n0n000000001
status: experimental
description: Detects burst of failed RDP logons followed by a successful logon from the same source, consistent with brute-force initial access used by opportunistic ransomware groups.
author: Security Arsenal Threat Intelligence
logsource:
  product: windows
  service: security
  category: null
detection:
  sel_failed:
    EventID: 4625
    LogonType: 10
  sel_success:
    EventID: 4624
    LogonType: 10
  condition: sel_failed | count() by SourceIp > 10 and sel_success
timeframe: 10m
falsepositives:
  - Legitimate user password mistyping
  - Misconfigured service accounts
level: high
tags:
  - attack.t1110
  - attack.t1133
---
title: Office Macro Spawning Scripting or LOLBin Child Process
id: 8f3a1c2e-7b9d-4e5a-a1c3-n0n000000002
status: experimental
description: Detects Office applications spawning script interpreters or living-off-the-land binaries, consistent with phishing macro execution leading to ransomware staging.
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate add-in behavior
level: high
tags:
  - attack.t1566.001
  - attack.t1204.002
  - attack.t1059
---
title: Pre-Encryption Staging - Shadow Copy Deletion and PsExec/WMI Remote Execution
id: 8f3a1c2e-7b9d-4e5a-a1c3-n0n000000003
status: experimental
description: Detects Volume Shadow Copy deletion commands and remote execution tooling (PsExec-style service creation, WMI process spawn) indicative of ransomware pre-detonation behavior and lateral movement.
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    CommandLine|contains:
      - 'vssadmin delete shadows'
      - 'vssadmin Delete Shadows'
      - 'wmic shadowcopy delete'
      - 'bcdedit'
      - 'diskshadow'
  selection_psexec:
    Image|endswith:
      - '\psexec.exe'
      - '\psexesvc.exe'
      - '\paexec.exe'
  selection_wmi:
    ParentImage|endswith: '\wmiprvse.exe'
    CommandLine|contains:
      - 'cmd.exe'
      - 'powershell'
  condition: 1 of selection_*
falsepositives:
  - Administrative maintenance scripts
  - Backup software reconfiguring shadow copies
level: critical
tags:
  - attack.t1490
  - attack.t1569.002
  - attack.t1047
  - attack.t1021.002

// Microsoft Sentinel: Pre-ransomware staging & lateral movement hunt
// Looks for: remote execution artifacts, shadow copy tampering, mass staging to archive tools,
// and anomalous SMB write volume within a 24h window per device.
let lookback = 7d;
let suspiciousProcs = dynamic(["psexec.exe","psexesvc.exe","paexec.exe","wmiprvse.exe","vssadmin.exe","bcdedit.exe","diskshadow.exe","rar.exe","7z.exe","winrar.exe","megacmd.exe","rclone.exe"]);
let stagingHosts =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName in~ (suspiciousProcs)
       or ProcessCommandLine has_any ("vssadmin delete shadows","shadowcopy delete","bcdedit","/copy","--transfers")
    | summarize CmdCount=count(), Commands=make_set(ProcessCommandLine, 20) by DeviceName, bin(TimeGenerated, 1h);
let smbWriteVolume =
    DeviceNetworkEvents
    | where TimeGenerated > ago(lookback)
    | where RemotePort == 445 and ActionType == "ConnectionSuccess"
    | summarize SmbConnections=count(), DistinctTargets=dcount(RemoteIP) by DeviceName, bin(TimeGenerated, 1h)
    | where DistinctTargets > 10; // fan-out behavior consistent with lateral movement
stagingHosts
| join kind=inner smbWriteVolume on DeviceName, TimeGenerated
| project TimeGenerated, DeviceName, CmdCount, SmbConnections, DistinctTargets, Commands
| order by TimeGenerated desc;

# Security Arsenal - Rapid Ransomware Triage & Hardening Check
# Run as Administrator on suspect hosts or via your RMM across the estate.
$report = @();

# 1. Exposed RDP: check if RDP is enabled and NLA status
$rdp = Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue;
$nla = Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue;
$report += [pscustomobject]@{Check='RDP Enabled'; Result=($rdp.fDenyTSConnections -eq 0); Detail="NLA=$($nla.UserAuthentication) (1=required)"};

# 2. Scheduled tasks created in the last 7 days (persistence check)
$recentTasks = Get-ScheduledTask | Where-Object {$_.Date -and ((New-TimeSpan -Start $_.Date -End (Get-Date)).Days -le 7)} | Select-Object TaskName, TaskPath, Date;
$report += [pscustomobject]@{Check='Scheduled Tasks (7d)'; Result=($recentTasks.Count -gt 0); Detail=($recentTasks.TaskName -join '; ')};

# 3. Shadow copy status - alert if zero shadows exist or recent deletions
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue;
$report += [pscustomobject]@{Check='Volume Shadow Copies'; Result=($shadows.Count -gt 0); Detail="Count=$($shadows.Count) — 0 on a server is a red flag"};

# 4. Recent vssadmin/bcdedit execution evidence in System event log (Event 7045 = new service, plus vssadmin events)
$svcEvents = Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue | Where-Object {$_.Message -match 'psexesvc|PAExec|random'} | Select-Object TimeCreated, Message;
$report += [pscustomobject]@{Check='Suspicious Services (7d)'; Result=($svcEvents.Count -gt 0); Detail="$($svcEvents.Count) suspicious service installs"};

# 5. Hardening: disable SMBv1 if present
$smb1 = Get-SmbServerConfiguration | Select-Object -ExpandProperty EnableSMB1Protocol;
if ($smb1) { Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force; }
$report += [pscustomobject]@{Check='SMBv1 Disabled'; Result=(-not $smb1); Detail='SMBv1 disabled if it was enabled'};

$report | Format-Table -AutoSize;

Incident Response Priorities

T-Minus Detection Checklist (before encryption fires)

• New service installs (Event 7045) matching PsExec-style patterns or random 8-character names.
• vssadmin / bcdedit / diskshadow execution anywhere outside a change window — treat as a sev-1 page.
• Archive tool staging (rar.exe, 7z.exe, winrar.exe) writing to temp or public folders on servers — especially in bulk.
• Unexpected outbound transfers to cloud storage (MEGA, rclone remotes) or high-volume egress from file servers.
• SMB fan-out: a single workstation initiating 445 connections to 10+ hosts in an hour.
• EDR/AV tampering: attempts to uninstall agents, disable real-time protection, or stop backup services.
• Failed-then-successful RDP logon bursts from unfamiliar source IPs, particularly on non-standard ports.

Assets This Playbook Historically Prioritizes for Exfiltration

• File servers and NAS shares containing customer/patient records (PHI for healthcare claims, customer PII for retail).
• Finance and HR document stores (used for negotiation leverage).
• Email archives of executives.
• Backup infrastructure credentials and repositories (to eliminate recovery options).
• For technology victims: source code repositories and CI/CD artifacts.

Containment Actions — Ordered by Urgency

1. Isolate affected hosts at the switch/EDR level — do not power off (preserve memory and ransom notes for attribution).
2. Disable suspect accounts and force credential resets for any account observed in lateral movement telemetry; revoke active sessions and tokens.
3. Block egress to known exfil destinations and suspend outbound internet from affected segments except IR tooling.
4. Freeze remote access: temporarily disable internet-facing RDP and require VPN+MFA re-enrollment.
5. Protect backups: take backup infrastructure offline or to immutable/segmented copies before touching anything else.
6. Preserve evidence: memory captures, prefetch, ShimCache, USN journal, VPN/firewall logs.
7. Engage counsel and review notification obligations — for healthcare entities, assess HIPAA posture even while the claim remains unverified.

Hardening Recommendations

Immediate (24 hours)

• Patch or mitigate the KEV set: CVE-2026-50751 (Check Point), CVE-2026-20316 (Cisco FMC), CVE-2026-59310 (vCenter), CVE-2026-63077 (TeamCity), CVE-2026-48027 (Nx Console). Confirm versions and internet exposure of each.
• Kill exposed RDP: no TCP/3389 on the internet, period. Enforce VPN + phishing-resistant MFA for all remote access.
• Block Office macro child processes via ASR rules (Office apps spawning child processes, Office creating executable content).
• Alert on shadow-copy tampering — deploy the Sigma rule above to your SIEM today.
• Audit scheduled tasks and services created in the last 7 days across servers using the triage script.
• Verify backup immutability and test one restore.

Short-Term (2 weeks)

• Segment healthcare/retail data stores from general workstation VLANs; enforce tiered admin so workstation compromise cannot reach backup or virtualization control planes.
• Deploy SMB fan-out analytics (the KQL query above) as a standing Sentinel analytic rule.
• MFA everywhere — VPN, email, RMM, backup consoles, hypervisor management. N0N-style opportunists thrive on single-factor remote access.
• RMM governance: inventory all remote management tools; block unapproved ones at the proxy (they are a favored ransomware delivery channel).
• Attack surface management: continuous external scanning for forgotten VPN concentrators, TeamCity instances, and vCenter interfaces.
• Tabletop the double-extortion scenario: decide now who owns leak-site monitoring, negotiation policy, and disclosure decisions.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub