Classification: TLP:CLEAR | Publication Date: 2026-10-18 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 28 Leak-Site Listings in Current Campaign — Sector Targeting Analysis & Detection Rules

Executive Summary

Dark web monitoring of the N0N ransomware operation's .onion leak site shows 28 claimed victim postings in the most recent 100-posting window, with a sharp burst of activity between 2026-10-16 and 2026-10-17. N0N has listed organizations across the United States, Brazil, Egypt, and the Netherlands, with declared sectors spanning manufacturing, healthcare, and technology — though the majority of current listings carry no sector classification ("Not Found"), which itself is an analytical signal discussed below.

Every listing is an accusation by a criminal actor. None of the organizations named on N0N's leak site have been confirmed breached by this data, by Security Arsenal, or — to our knowledge — by the organizations themselves. This briefing translates the gang's claims into defensive intelligence: who they say they are targeting, how gangs of this profile typically operate, and what your SOC should be hunting for right now.

Key observations:

• Tempo: At least 15 listings published in a 48-hour window (2026-10-16 through 2026-10-17), indicating either a batch-dump of accumulated access or an escalation in affiliate throughput.
• Geography: Heavy US concentration, with outlier claims in Brazil (including one named manufacturing firm), Egypt, and the Netherlands.
• Named exposure: N0N has listed Prafesta Ind. e Com. de Embalagens Ltda (Manufacturing, BR), published 2026-10-16. This claim is corroborated by a second independent crawler — meaning the gang demonstrably posted it — but the underlying breach remains unconfirmed.

Sourcing & Verification

This briefing is built exclusively from ransomware.live leak-site monitoring data. Readers must understand the corroboration model before acting on any named organization:

• 22 of 28 listings were independently observed by a second leak-site crawler ([MULTI-SOURCE]). This confirms the gang made the claim — that the posting exists on their infrastructure.
• 6 of 28 listings appear on a single crawler only ([SINGLE-SOURCE]). We cannot yet confirm the posting itself exists; it may be a parsing artifact, a deleted post, or a transient page.
• No tier in this data confirms a breach. Inclusion on a leak site reflects the threat actor's claim and nothing more. Only the organization itself or its regulator can confirm an incident.
• A named organization may dispute a listing. A denial is likewise not proof the claim is false — disclosure obligations vary by jurisdiction and sector, and not every incident is legally reportable. Neither silence nor denial settles the question.
• Security Arsenal will publish corrections to this briefing as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Of the current listing set, only Company #88 (US, published 2026-10-17) falls in the single-source tier among the most recent posts; the remaining 14 visible listings from 2026-10-16/17 are multi-source. One named organization appears in the set: Prafesta Ind. e Com. de Embalagens Ltda, which N0N claims to have compromised. We make no assertion that this claim is true.

Threat Actor Profile — N0N

Attribution caveat: Publicly documented, high-fidelity reporting on N0N's internal structure is limited. The profile below combines observable leak-site behavior with TTP patterns consistent with mid-tier ransomware operations of this posting cadence. Treat structural details as assessed, not confirmed.

• Aliases: No widely corroborated aliases are published in our dataset; the operation brands itself as "N0N" on its onion infrastructure. Monitor for rebranding — groups at this maturity level frequently dissolve and re-emerge under new names after infrastructure seizure or affiliate disputes.
• Operating model: Posting cadence (28 claims in a 100-post window, batch-dumped over 48 hours) is consistent with a Ransomware-as-a-Service (RaaS) or semi-open affiliate model, where multiple access holders feed victims into a shared leak site. Closed groups typically post at steadier, lower volume.
• Ransom demands: Not disclosed on the observed listings. For comparable operations targeting SMB-to-mid-market manufacturing and healthcare, demands typically range from low six figures to low seven figures USD, scaled to perceived victim revenue.
• Initial access methods (assessed): Groups at this tier overwhelmingly rely on (1) exploitation of internet-facing edge devices and remote access services (VPN concentrators, firewalls, RDP), (2) phishing with malicious attachments or links leading to credential theft or loader deployment, and (3) purchased access from initial access brokers (IABs). The batch-posting pattern is consistent with IAB-sourced access being operationalized in bulk.
• Extortion model: Double extortion — data theft threatened alongside encryption. Leak-site listing is itself the pressure mechanism; the 48-hour batch suggests a "publish everything unpaid" escalation event.
• Dwell time: Not observable from leak-site data alone. Industry median for comparable groups runs days-to-weeks between initial access and detonation, with exfiltration typically completed before encryption.

Current Campaign Analysis

Sector targeting

Declared sectors in the current window: Manufacturing, Healthcare, Technology — plus a dominant "Not Found" category (13 of 15 visible recent listings). Two interpretations:

1. The gang is posting victims faster than it is classifying them — consistent with a bulk-dump escalation.
2. The victims are small enough that automated sector enrichment failed, implying an SMB-heavy victim pool.

The one sector-tagged named claim, Prafesta Ind. e Com. de Embalagens Ltda (Manufacturing, BR), fits the classic mid-tier ransomware profile: industrial/manufacturing firms in regions with variable disclosure regimes, where operational downtime pressure is extreme and security maturity is often lower than in financial services.

Geographic concentration

• US: Dominant (at least 8 of 15 visible recent listings).
• Brazil: 1 named manufacturing claim.
• Egypt, Netherlands: Listed in aggregate targeting data but not visible in the recent posting slice.
• Unknown country (?): 5 recent listings — again consistent with bulk posting ahead of enrichment.

Victim profile

The prevalence of anonymized "Company #NN" listings with no sector and no country data suggests smaller organizations — likely sub-1,000-employee firms in the USD $10M–$500M revenue band typical for groups at this tier. Healthcare and manufacturing presence implies N0N affiliates are not observing sector exclusions, so no industry should assume itself off-target.

Posting frequency / escalation

15 postings across 2026-10-16 and 2026-10-17 represents an abnormal burst. Historically, bursts like this correlate with: (a) affiliate onboarding events, (b) deadline expirations on a backlog of negotiated victims, or (c) a deliberate intimidation cadence ahead of a rebrand or infrastructure move. Watch the next 7 days: if posting volume collapses, this was a backlog dump; if it sustains, affiliate capacity has grown.

CVE exposure hypothesis (sector-level, NOT victim-linked)

We have no evidence tying any specific listed organization to any specific CVE. However, the following CISA KEV entries — all confirmed exploited by ransomware actors — describe exactly the edge-device and management-plane exposure that gangs of N0N's profile typically monetize. Defenders in manufacturing, healthcare, and technology should treat these as priority patch/verify items:

• CVE-2026-59310 — Broadcom VMware vCenter path traversal (KEV 2026-08-18). vCenter compromise is a force multiplier: hypervisor-level access enables mass VM encryption, the highest-impact ransomware outcome.
• CVE-2026-50751 — Check Point Security Gateway improper authentication in IKEv1 (KEV 2026-06-08). VPN gateway compromise is the archetypal initial access vector for this class of actor.
• CVE-2026-20316 — Cisco Secure FMC hard-coded password (KEV 2026-07-29). Firewall management plane exposure.
• CVE-2026-63077 — JetBrains TeamCity deserialization (KEV 2026-08-05). Build-server compromise enables supply-chain-style payload distribution — particularly relevant for technology-sector targets.
• CVE-2026-48027 — Nx Console embedded malicious code (KEV 2026-05-27). Developer-tooling supply chain exposure, again technology-sector relevant.

Framing: These are sector-level exposure hypotheses. If your organization runs any of the above, verify patch state regardless of whether you appear on any leak site.

Detection Engineering

The following detections target TTPs characteristic of ransomware operations at N0N's profile tier: edge/RDP initial access, PsExec/WMI lateral movement, and pre-encryption staging (shadow copy deletion, mass archiving).

---
title: RDP Brute Force Followed By Successful Logon - Potential Ransomware Initial Access
id: 8f3a1c2e-n0n1-4a5b-9c6d-202610180001
status: experimental
description: Detects a burst of failed RDP logons (Event 4625, logon type 3/10) from a single source followed by a successful logon (4624 type 10) within 10 minutes. Consistent with RDP brute-force initial access used by ransomware affiliates.
author: Security Arsenal Threat Intelligence
 date: 2026/10/18
references:
  - https://securityarsenal.com/darkside
logsource:
  product: windows
  service: security
detection:
  selection_failed:
    EventID: 4625
    LogonType:
      - 3
      - 10
  selection_success:
    EventID: 4624
    LogonType: 10
  condition: selection_failed | selection_success
  timeframe: 10m
level: high
tags:
  - attack.initial_access
  - attack.t1133
  - attack.t1110
falsepositives:
  - Legitimate password-spray misconfigurations, vulnerability scanners
---
title: PsExec Or WMI Remote Service Execution - Ransomware Lateral Movement
id: 8f3a1c2e-n0n1-4a5b-9c6d-202610180002
status: experimental
description: Detects remote service creation (7045) with PsExec-style service names or WMI process creation of common ransomware staging tools. Ransomware operators use PsExec/WMI to push encryptors and exfil tooling across hosts.
author: Security Arsenal Threat Intelligence
date: 2026/10/18
references:
  - https://securityarsenal.com/darkside
logsource:
  product: windows
  service: system
detection:
  selection_service:
    EventID: 7045
    ServiceFileName|contains:
      - 'PSEXESVC'
      - '\\ADMIN$\\'
      - 'paexec'
      - 'csexec'
  selection_suspicious_names:
    EventID: 7045
    ServiceName|re: '^[A-Za-z0-9]{8}$'
  condition: 1 of selection_*
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002
falsepositives:
  - Legitimate admin tooling, SCCM, some EDR deployment agents
---
title: Pre-Encryption Staging - Shadow Copy Deletion And Mass Archive Creation
id: 8f3a1c2e-n0n1-4a5b-9c6d-202610180003
status: experimental
description: Detects Volume Shadow Copy deletion via vssadmin/wmic/bcdedit, or creation of large archives via 7z/rar in non-standard directories — classic pre-encryption and pre-exfiltration behavior observed across ransomware families.
author: Security Arsenal Threat Intelligence
date: 2026/10/18
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    CommandLine|contains:
      - 'vssadmin delete shadows'
      - 'vssadmin Delete Shadows'
      - 'wmic shadowcopy delete'
      - 'bcdedit'
      - 'wbadmin delete catalog'
      - 'resize shadowstorage'
  selection_archive:
    Image|endswith:
      - '\7z.exe'
      - '\rar.exe'
      - '\winrar.exe'
    CommandLine|contains:
      - ' a '
      - ' -p'
  condition: selection_vss or selection_archive
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.exfiltration
  - attack.t1560.001
falsepositives:
  - Backup administrators, legitimate archiving workflows — tune by parent process and user context

The Sentinel hunt below looks for the pre-ransomware kill chain: suspicious archive utility execution, shadow copy tampering, and anomalous remote logons converging on the same host within a short window — the pattern that typically precedes detonation.

// Pre-Ransomware Staging Hunt: shadow copy tampering + mass archiving + anomalous lateral movement
// Security Arsenal — N0N campaign hunt, 2026-10-18
let Lookback = 7d;
let SuspiciousProcs = dynamic(["vssadmin.exe","wmic.exe","bcdedit.exe","wbadmin.exe","7z.exe","rar.exe","winrar.exe","psexec.exe","paexec.exe"]);
let ProcEvents =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName in~ (SuspiciousProcs)
    | project DeviceName, TimeGenerated, FileName, ProcessCommandLine, AccountName, InitiatingProcessFileName;
let RemoteLogons =
    DeviceLogonEvents
    | where TimeGenerated > ago(Lookback)
    | where LogonType in ("RemoteInteractive","Network")
    | where RemoteIP !startswith "10." and RemoteIP !startswith "192.168." == false or RemoteIP == "-"
    | summarize LogonCount = count(), DistinctSources = dcount(RemoteIP) by DeviceName, AccountName, bin(TimeGenerated, 1h);
ProcEvents
| summarize StagingEvents = count(), Tools = make_set(FileName), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by DeviceName, AccountName
| join kind=leftouter (RemoteLogons) on DeviceName, AccountName
| extend RiskScore = StagingEvents * 10 + iff(LogonCount > 5, 25, 0) + iff(Tools has "vssadmin.exe", 40, 0)
| order by RiskScore desc
| project DeviceName, AccountName, StagingEvents, Tools, FirstSeen, LastSeen, LogonCount, RiskScore;

Rapid-response triage script — run on any host flagged by the above detections, or as a fleet-wide sweep if your organization operates in a currently targeted sector:

# Security Arsenal — Rapid Ransomware Pre-Detonation Triage (2026-10-18)
# Run elevated. Checks: RDP exposure, shadow copies, recent scheduled tasks, suspicious services.

Write-Host "=== [1] RDP Exposure Check ===" -ForegroundColor Cyan
$rdp = Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue
if ($rdp.fDenyTSConnections -eq 0) { Write-Host "[!] RDP ENABLED — verify NLA & restrict to VPN allowlist" -ForegroundColor Red }
Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue | Select-Object LocalAddress,LocalPort,State

Write-Host "=== [2] Volume Shadow Copies ===" -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) { Write-Host "[!] NO shadow copies present — possible anti-recovery tampering" -ForegroundColor Red }
else { $shadows | Select-Object ID, InstallDate, DeviceObject | Format-Table }

Write-Host "=== [3] Scheduled Tasks Created/Modified in Last 7 Days ===" -ForegroundColor Cyan
Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt (Get-Date).AddDays(-7) } |
  Select-Object TaskName, TaskPath, Date, @{N='Action';E={$_.Actions.Execute}} | Format-List

Write-Host "=== [4] Suspicious Recently-Installed Services ===" -ForegroundColor Cyan
Get-CimInstance Win32_Service | Where-Object {
  $_.PathName -match 'PSEXESVC|ADMIN\$|AppData|Temp' -or $_.Name -match '^[A-Za-z0-9]{8}$'
} | Select-Object Name, State, PathName, StartName | Format-List

Write-Host "=== [5] Recent Failed RDP/Network Logons (last 24h) ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)} -MaxEvents 200 -ErrorAction SilentlyContinue |
  Group-Object { $_.Properties[19].Value } | Sort-Object Count -Descending |
  Select-Object Count, Name -First 10 | Format-Table

Write-Host "Triage complete. Any red flags: isolate host from network BEFORE powering down (preserve volatile memory)." -ForegroundColor Yellow

Incident Response Priorities

T-minus detection checklist (before encryption fires)

1. vssadmin / bcdedit / wbadmin execution outside of backup windows — the single highest-fidelity pre-detonation signal.
2. Bulk archive creation (7z/rar with password flags) on file servers, especially in user-writable directories.
3. Unexpected egress volume to cloud storage or unfamiliar IPs from server VLANs — exfiltration precedes encryption.
4. New local admin accounts or group membership changes on domain controllers and hypervisor management planes.
5. EDR/AV tampering events — attempts to uninstall, disable, or add exclusions to security tooling.
6. PsExec-style service creation (7045) fanning out from a single workstation — the lateral movement pivot.
7. RDP logons at unusual hours from accounts that don't normally use RDP.

Assets this gang profile typically prioritizes for exfiltration

• File servers and NAS containing HR records, contracts, financials (extortion leverage).
• Healthcare-sector listings risk: patient data repositories, EHR exports — regulatory pressure multiplier.
• Manufacturing: ERP databases, CAD/IP repositories, OT-adjacent jump boxes.
• Hypervisor management (vCenter/ESXi) — not for exfil but for mass encryption leverage; CVE-2026-59310 exposure makes this urgent.

Containment actions, ordered by urgency

1. Isolate suspected hosts at the switch/EDR level — do NOT power off (preserve RAM for forensic artifacts and potential key material).
2. Disable compromised accounts and force credential resets for any account observed in lateral movement telemetry; revoke active sessions/tokens.
3. Block egress at the perimeter for identified exfil destinations; enable SSL inspection logging if not already active.
4. Verify backup integrity and isolation — confirm offline/immutable copies before declaring containment.
5. Snapshot vCenter/ESXi state and audit hypervisor-level accounts if virtualization is in scope.
6. Engage IR retainer / legal counsel early — leak-site listing starts a disclosure-obligation clock analysis even before breach confirmation.

Hardening Recommendations

Immediate (24 hours)

• Patch or mitigate the five KEV entries above (vCenter CVE-2026-59310, Check Point CVE-2026-50751, Cisco FMC CVE-2026-20316, TeamCity CVE-2026-63077, Nx Console CVE-2026-48027) or take the affected service off the internet.
• Disable internet-exposed RDP entirely; if required, gate behind VPN + MFA and restrict source IPs.
• Enforce MFA on all remote access — VPN, VDI, webmail, and especially hypervisor/firewall management interfaces.
• Block vssadmin/bcdedit/wbadmin for non-administrative accounts via AppLocker/WDAC and alert on any execution.
• Enable tamper protection on all EDR/AV deployments.
• Deploy the Sigma rules and KQL hunt above and run the triage script against any host that fires.

Short-term (2 weeks)

• Segment the network: isolate OT/ICS-adjacent systems (manufacturing), EHR environments (healthcare), and CI/CD infrastructure (technology) from general user VLANs.
• Immutable/offline backups with tested restore procedures — assume online backups will be targeted for deletion.
• Tiered administration model: dedicated privileged access workstations; no domain admin logon to workstations or member servers.
• Egress filtering and DLP on server VLANs to catch bulk exfiltration before the leak-site post appears.
• Attack surface monitoring: continuous enumeration of your internet-facing edge devices so KEV additions trigger same-day risk assessments.
• Tabletop the double-extortion scenario: legal, comms, and IR should rehearse a leak-site listing of your organization as an unverified claim — response posture differs from a confirmed breach.

Security Arsenal monitors ransomware leak sites continuously. If your organization appears in any gang's listing — verified or not — contact our incident response team at security@securityarsenal.com.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub