Classification: TLP:CLEAR | Publication Date: 2026-11-09 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 28 New Leak-Site Claims Posted — Sector Targeting Analysis & Detection Rules

Executive Summary

Between 2026-11-07 and 2026-11-09, the ransomware group tracked as N0N posted 28 new entries to its dark web leak site, claiming compromises of organizations across the United States, South Korea, Canada, Germany, Italy, Saudi Arabia, the United Arab Emirates, and Denmark. Claimed sectors include Hospitality, Retail & E-Commerce, Technology, Professional Services, Healthcare, and Energy & Utilities, with a substantial cluster of uncategorized ("Not Found") entries.

Named organizations on the site include Expedia Group, Inc., Staples, Inc. / SBD Inc., Lampenwelt GmbH, Infutor Data Solutions, and Higginbotham. Every one of these is an unverified accusation by a criminal actor — inclusion on a leak site is not evidence of a breach. Only one of the 28 postings (Expedia Group) was independently observed by a second leak-site crawler; the remaining 27 appear on a single monitoring source only.

Regardless of verification status, the operational tempo — 27 postings in a single 48-hour window — signals an active campaign cycle. Security teams in the affected sectors should treat this as a trigger to hunt for N0N's known pre-encryption TTPs, validate edge-device patching against the CVEs discussed below, and rehearse containment procedures.

Sourcing & Verification

• Corroboration status: 1 of 28 listings (Expedia Group, Inc.) was independently observed by a second leak-site crawler. 27 of 28 listings appear on ransomware.live only, with no second-crawler confirmation that the postings even exist.
• What a listing means: Inclusion on N0N's leak site reflects the threat actor's claim only. It is not confirmation of a breach, intrusion, or data theft. Multi-source corroboration confirms the gang made the claim — it does not confirm the claim is true.
• Disputes and denials: A named organization may dispute or deny a listing. A denial is likewise not proof the claim is false. Disclosure obligations vary by jurisdiction and sector, and not every incident is reportable — so neither silence nor denial settles the question.
• Corrections: Security Arsenal will publish corrections as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

Attribution caveat: N0N is a relatively low-visibility operation compared to marquee RaaS brands. The profile below is assembled from observed leak-site behavior and incident-response reporting; where evidence is thin, we say so.

• Aliases: N0N (stylized with zero); no widely accepted alternate names in open reporting. Some trackers cluster its infrastructure with short-lived rebrand patterns typical of post-takedown splinter crews, but this is unconfirmed.
• Operating model: Assessed as a closed or semi-closed group rather than an open RaaS program. There is no observed public affiliate recruitment, no published affiliate rulebook, and victim-posting cadence is consistent with a small operator set rather than a broad affiliate base.
• Ransom demands: No consistent public demand figure. Based on comparable mid-tier crews and the revenue profile of claimed victims, demands plausibly range from the low six figures into the low millions (USD), scaled to victim size. Treat any specific figure circulating on Telegram as unverified.
• Initial access methods (assessed): Edge-device exploitation (VPN concentrators, firewalls, remote access gateways), exposed RDP, and credential-based access via phished or purchased credentials. The gang's victim clustering against organizations with complex perimeter estates is consistent with opportunistic edge exploitation rather than bespoke intrusion development.
• Extortion model: Double extortion — data theft threatened via leak-site publication alongside encryption. The 48-hour posting burst analyzed here is characteristic of a batch-and-pressure cycle: claim many victims at once to maximize leverage and press coverage.
• Dwell time: Insufficient victim-specific telemetry to state a N0N-specific dwell time. Industry-wide, ransomware median dwell time has compressed to days (often under 5) for edge-exploitation intrusions; defenders should assume a short window between initial access and detonation and hunt accordingly.

Current Campaign Analysis

Sector Targeting

From the 28 recent postings:

The heavy "Not Found" tail is analytically meaningful: N0N frequently posts victims without sector metadata, a pattern associated with volume-driven operations that publish quickly and enrich later as negotiation leverage requires.

Geographic Concentration

The United States dominates the claimed victim set (majority of listings), followed by Canada (2), South Korea (1), and single-claim coverage across Germany, Italy, Saudi Arabia, UAE, and Denmark. This is a US-centric campaign with opportunistic international spillover, not a regionally focused operation.

Victim Profile

Claimed victims span a wide band: large enterprises with household-name brands (Expedia Group, Staples) down to mid-market professional services and regional firms (Higginbotham, Lampenwelt). Estimated annual revenue across the set ranges from tens of millions to billions of dollars — consistent with opportunistic access-broker-fed or edge-scan-driven targeting rather than deliberate big-game hunting.

Posting Frequency & Escalation

• 2026-11-07: 27 postings in a single batch — an unusually aggressive single-day drop.
• 2026-11-09: 1 additional posting (Expedia Group), the only multi-source-corroborated claim.

This pattern — mass low-detail postings followed by a named-brand claim — matches a known pressure tactic: flood the site to establish credibility and tempo, then anchor with a marquee name to force negotiations. Expect follow-on postings naming the "Company #NNN" entries if victims do not engage.

CVE Connection (Hypothesis Only)

We have no evidence linking any specific CVE to any specific named victim. What follows is sector-level exposure analysis: these vulnerabilities are on CISA's Known Exploited Vulnerabilities list with confirmed ransomware use, and they map to the access methods N0N is assessed to favor.

• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1): Perimeter gateway compromise; a direct fit for edge-device initial access.
• CVE-2026-20316 — Cisco Secure Firewall Management Center hard-coded password: Management-plane takeover of firewall estates.
• CVE-2026-59310 — Broadcom VMware vCenter path traversal: Virtualization management-plane access — high value for mass encryption of VM estates.
• CVE-2026-63077 — JetBrains TeamCity deserialization: CI/CD server compromise; relevant to technology-sector targets and software supply-chain pivoting.
• CVE-2026-48027 — Nx Console embedded malicious code: Developer-workstation supply-chain exposure.

Defensive logic: if your organization is in a claimed-victim sector and runs any of the above unpatched, assume elevated targeting probability and hunt now.

Detection Engineering

The following detections target N0N's assessed playbook: edge/VPN initial access, brute-forced or phished RDP, living-off-the-land lateral movement (PsExec/WMI), and pre-encryption data staging and shadow-copy destruction.

---
title: Suspicious Authentication Burst on VPN or Edge Gateway Followed by Internal RDP
id: 8f3a1c2e-n0n1-4a7b-9c2d-000000000001
status: experimental
description: Detects a burst of failed external authentication events against VPN/edge services followed by a successful logon and rapid internal RDP connection — consistent with credential-based initial access used by ransomware operators including N0N.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
date: 2026/11/09
logsource:
  category: authentication
  product: windows
detection:
  selection_failed:
    EventID: 4625
    LogonType:
      - 3
      - 10
  selection_success:
    EventID: 4624
    LogonType: 10
  condition: selection_failed and selection_success
timeframe: 15m
falsepositives:
  - Legitimate remote administration by IT staff
  - Misconfigured service accounts
level: high
tags:
  - attack.initial_access
  - attack.t1133
  - attack.t1078
  - n0n-ransomware
---
title: PsExec-Style Service Creation or WMI Remote Process Execution
id: 8f3a1c2e-n0n1-4a7b-9c2d-000000000002
status: experimental
description: Detects remote service installation (PsExec pattern, EventID 7045 with suspicious service binary paths) and WMI remote process creation (WmiPrvSE spawning cmd/powershell), hallmarks of ransomware lateral movement prior to detonation.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
date: 2026/11/09
logsource:
  category: process_creation
  product: windows
detection:
  selection_service:
    EventID: 7045
    ServiceFileName|contains:
      - '\ADMIN$\'
      - '\IPC$\'
      - 'AppData\Local\Temp'
  selection_wmi:
    ParentImage|endswith: '\WmiPrvSE.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\rundll32.exe'
  condition: selection_service or selection_wmi
falsepositives:
  - Enterprise software deployment tools (SCCM, PDQ)
  - Legitimate administrative tooling
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1047
  - attack.t1569.002
  - n0n-ransomware
---
title: Pre-Ransomware Staging — Shadow Copy Deletion and Mass Archive Creation
id: 8f3a1c2e-n0n1-4a7b-9c2d-000000000003
status: experimental
description: Detects Volume Shadow Copy deletion via vssadmin/wmic and creation of large compressed archives in staging directories — the final pre-encryption exfiltration and anti-recovery steps observed across double-extortion ransomware campaigns.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
date: 2026/11/09
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    - Image|endswith: '\vssadmin.exe'
      CommandLine|contains:
        - 'delete shadows'
        - 'resize shadowstorage'
    - Image|endswith: '\wmic.exe'
      CommandLine|contains: 'shadowcopy delete'
  selection_archive:
    Image|endswith:
      - '\7z.exe'
      - '\rar.exe'
      - '\winrar.exe'
    CommandLine|contains:
      - ' a '
      - '-p'
  condition: selection_vss or selection_archive
falsepositives:
  - Backup administrators performing maintenance
  - Legitimate archiving by power users
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.exfiltration
  - attack.t1560.001
  - n0n-ransomware

The following Microsoft Sentinel hunt query surfaces lateral movement and staging behavior consistent with this group's assessed toolset — remote service creation, WMI-spawned shells, and shadow-copy tampering correlated within a short window on the same host:

// N0N hunt: lateral movement + pre-encryption staging correlation
let Lookback = 7d;
let SuspiciousServiceEvents =
    Event
    | where TimeGenerated >= ago(Lookback)
    | where EventID == 7045
    | where ServiceFileName has_any ("ADMIN$", "IPC$", "AppData\\Local\\Temp", "PSEXESVC")
    | project ServiceTime=TimeGenerated, Computer, ServiceName, ServiceFileName, Account;
let WmiSpawnedShells =
    SecurityEvent
    | where TimeGenerated >= ago(Lookback)
    | where EventID == 4688
    | where ParentProcessName endswith "WmiPrvSE.exe"
    | where NewProcessName has_any ("cmd.exe", "powershell.exe", "rundll32.exe")
    | project WmiTime=TimeGenerated, Computer, NewProcessName, CommandLine, Account;
let ShadowCopyTamper =
    SecurityEvent
    | where TimeGenerated >= ago(Lookback)
    | where EventID == 4688
    | where CommandLine has_any ("delete shadows", "shadowcopy delete", "resize shadowstorage")
    | project VssTime=TimeGenerated, Computer, VssCommand=CommandLine, Account;
SuspiciousServiceEvents
| join kind=inner WmiSpawnedShells on Computer
| where WmiTime between (ServiceTime .. ServiceTime + 30m)
| join kind=leftouter ShadowCopyTamper on Computer
| summarize
    FirstActivity=min(ServiceTime),
    LastActivity=max(WmiTime),
    ServicesCreated=make_set(ServiceName),
    ShellCommands=make_set(CommandLine),
    ShadowCopyCmds=make_set(VssCommand)
    by Computer, Account
| extend Severity = iff(array_length(ShadowCopyCmds) > 0, "CRITICAL — possible pre-detonation staging", "HIGH — lateral movement pattern")
| order by FirstActivity desc;

Rapid-response triage script — run on suspect hosts or fleet-wide via your EDR/remote shell to enumerate scheduled tasks created in the last 7 days, exposed RDP listeners, shadow-copy state, and recent suspicious service installations:

# N0N Rapid Triage — pre-ransomware indicator sweep
# Run elevated. Output written to C:\IR-Triage on each host.
$OutDir = "C:\IR-Triage"
New-Item -ItemType Directory -Path $OutDir -Force | Out-Null
$Stamp = Get-Date -Format "yyyyMMdd-HHmmss"
$Report = Join-Path $OutDir "triage-$env:COMPUTERNAME-$Stamp.txt"
$Cutoff = (Get-Date).AddDays(-7)

"=== N0N Rapid Triage :: $env:COMPUTERNAME :: $(Get-Date) ===" | Out-File $Report

"`n[1] Scheduled tasks created in the last 7 days" | Out-File $Report -Append
Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt $Cutoff } |
    Select-Object TaskName, TaskPath, Date, @{N='Action';E={$_.Actions.Execute}} |
    Format-Table -AutoSize | Out-String | Out-File $Report -Append

"`n[2] RDP exposure" | Out-File $Report -Append
$RdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections
"RDP disabled flag (0 = RDP ENABLED): $RdpEnabled" | Out-File $Report -Append
Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue |
    Format-Table -AutoSize | Out-String | Out-File $Report -Append

"`n[3] Volume Shadow Copies present" | Out-File $Report -Append
$Shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($Shadows) { ($Shadows | Measure-Object).Count.ToString() + " shadow copies found" | Out-File $Report -Append }
else { "WARNING: NO shadow copies present — investigate for anti-recovery tampering" | Out-File $Report -Append }

"`n[4] Services installed in the last 7 days (PsExec-style check)" | Out-File $Report -Append
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=$Cutoff} -ErrorAction SilentlyContinue |
    Select-Object TimeCreated, @{N='Service';E={$_.Properties[0].Value}}, @{N='Binary';E={$_.Properties[1].Value}} |
    Format-Table -AutoSize | Out-String | Out-File $Report -Append

"`n[5] Recent failed logons (top source IPs, network logons)" | Out-File $Report -Append
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=$Cutoff} -ErrorAction SilentlyContinue |
    Group-Object { $_.Properties[19].Value } | Sort-Object Count -Descending | Select-Object -First 10 Count, Name |
    Format-Table -AutoSize | Out-String | Out-File $Report -Append

"`n[6] Large archives created in last 7 days (exfil staging check)" | Out-File $Report -Append
Get-ChildItem -Path "C:\Users","C:\ProgramData","C:\Temp" -Recurse -Include *.zip,*.7z,*.rar -ErrorAction SilentlyContinue |
    Where-Object { $_.CreationTime -gt $Cutoff -and $_.Length -gt 100MB } |
    Select-Object FullName, Length, CreationTime |
    Format-Table -AutoSize | Out-String | Out-File $Report -Append

"`nTriage complete: $Report"

Incident Response Priorities

T-Minus Detection Checklist (before encryption fires)

1. Shadow copy manipulation — vssadmin delete shadows, wmic shadowcopy delete, or bcdedit recovery-option changes. This is the single highest-fidelity pre-detonation signal. Alert and isolate immediately.
2. Mass archive creation — large .7z/.rar files appearing in user profiles, ProgramData, or temp paths, especially with password-protect flags.
3. New remote services / PSEXESVC artifacts — 7045 events with binaries in ADMIN$ or temp paths.
4. WMI-spawned shells — WmiPrvSE.exe parented cmd.exe/powershell.exe on servers that never normally see interactive admin.
5. Authentication anomalies — bursts of 4625s against VPN/RDP followed by a success, particularly outside business hours or from unusual geographies.
6. Backup system access — any interactive logon to backup infrastructure (Veeam, Commvault, etc.) that is not a documented change.

Assets This Playbook Historically Prioritizes for Exfiltration

• File servers and NAS shares holding HR, legal, and financial data — the leverage payload for double extortion.
• Email archives of executives and legal counsel (litigation pressure value).
• Customer databases and PII stores — particularly acute for the hospitality, retail, and healthcare sectors in this campaign.
• Backup catalogs and credentials — destroyed or encrypted first to foreclose recovery.
• CI/CD and code repositories for technology-sector victims (IP theft plus supply-chain leverage).

Containment — Ordered by Urgency

1. Isolate, don't power off — network-quarantine suspect hosts via EDR/switch ACLs; preserve memory and volatile evidence.
2. Kill the access path — disable implicated VPN/RDP accounts, revoke active sessions, reset credentials for any account seen in 4624/4625 anomalies. Assume credential theft and rotate broadly (including service accounts and KRBTGT if domain-wide compromise is suspected).
3. Protect backups immediately — take backup infrastructure off the network or into an isolated enclave; verify immutable/offline copies exist before touching anything else.
4. Block egress — restrict outbound traffic to approved destinations; watch for large transfers to cloud storage or unfamiliar endpoints (exfil often precedes encryption by hours to days).
5. Patch the edge — emergency-patch any exposed Check Point, Cisco FMC, vCenter, or TeamCity instances matching the KEV entries above; if unpatched and internet-facing, assume compromise and hunt.
6. Engage IR and legal early — leak-site claims create notification and disclosure questions independent of technical confirmation; loop counsel in on day one.

Hardening Recommendations

Immediate (24 hours)

• Patch or mitigate the KEV perimeter set: CVE-2026-50751 (Check Point), CVE-2026-20316 (Cisco FMC), CVE-2026-59310 (vCenter), CVE-2026-63077 (TeamCity). If patching isn't possible today, remove the management interfaces from internet exposure.
• Enforce phishing-resistant MFA on all remote access (VPN, RDP gateways, OWA) and all admin accounts. N0N's assessed entry methods collapse without stealable credentials.
• Disable or restrict RDP — no direct internet exposure; require VPN + MFA + conditional access. Audit for rogue 3389 listeners (see triage script).
• Deploy the Sigma rules and KQL query above; alert vssadmin delete shadows at CRITICAL severity with automated host isolation.
• Verify backup immutability — confirm at least one offline or object-locked copy and test a restore of one critical system this week.
• Hunt retroactively — run the KQL query against the last 7–30 days, not just forward-looking.

Short-Term (2 Weeks)

• Segment the network so that workstation-to-server and server-to-server lateral movement requires explicit allow-listing; PsExec/WMI/SMB admin shares between user VLANs and server tiers should not work by default.
• Deploy application control (WDAC/AppLocker) blocking execution from user-writable temp/AppData paths on servers.
• Stand up egress filtering with DLP-aware monitoring — double extortion dies without exfiltration; alert on compressed outbound volume anomalies.
• Restrict local admin via LAPS and tiered administration; eliminate standing Domain Admin logons on member servers.
• Decoy and detection depth — canary fileshares and honey credentials on file servers and backup infrastructure to catch pre-encryption reconnaissance.
• CI/CD hardening for technology-sector organizations: isolate TeamCity/build infrastructure, enforce signed tooling (relevant to CVE-2026-48027's developer supply-chain pattern), and monitor build-agent spawning behavior.

Security Arsenal will continue monitoring N0N's leak-site activity and will update this briefing as corroboration status changes. Named organizations seeking to dispute or discuss a listing may contact security@securityarsenal.com.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub