Classification: TLP:CLEAR | Publication Date: 2026-10-21 | Source: ransomware.live leak-site monitoring | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 29 Leak-Site Postings in 72 Hours — Claims Analysis, Sector Targeting & Detection Rules

Executive Summary

Between 2026-10-18 and 2026-10-20, the ransomware group tracked as N0N listed 29 organizations on its dark web leak site in a compressed posting burst. The published sample of 15 listings includes named organizations in the Technology, Retail & E-Commerce, Hospitality, Healthcare, Financial Services, and Professional Services sectors, with a heavy concentration of US-based organizations and additional claims spanning Ethiopia (ET), Tunisia (TN), Trinidad and Tobago (TT), Switzerland (CH), and South Korea (KR). A significant share of the listings are anonymized entries formatted as "Company #NN," a pattern consistent with victims posted during an active extortion negotiation window rather than after its collapse.

Every listing discussed in this briefing is an unverified claim by a criminal actor. Inclusion in this report means N0N publicly named the organization — nothing more. Defenders should use this intelligence to prioritize hunting and hardening against the TTPs associated with this campaign pattern, not to draw conclusions about any specific named organization.

Sourcing & Verification

• Corroboration status: 29 of 29 listings in this dataset were independently observed by a second leak-site crawler (MULTI-SOURCE); 0 listings appear on a single source only. Multi-source observation confirms that the gang published the claim on its leak site — it does not confirm that any breach occurred.
• Inclusion in this briefing reflects the threat actor's claim and is not confirmation of a breach, intrusion, or data theft at any named organization. No corroboration tier in our data confirms a breach; only the affected organization or its regulator can do that.
• A named organization may dispute a listing. A denial is likewise not proof that a claim is false — disclosure obligations vary by jurisdiction and sector, and not every incident is reportable. Neither silence nor denial settles the question.
• Security Arsenal will publish corrections as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

Public, verifiable reporting on N0N remains limited. The profile below reflects Security Arsenal's assessment derived from observed leak-site behavior and should be treated as analyst assessment, not established fact:

• Aliases: No confirmed aliases or rebrands identified to date. N0N does not currently map to a known successor brand of a shuttered operation in our tracking.
• Operating model: The sustained multi-victim posting cadence, templated anonymized entries ("Company #NN"), and cross-sector targeting are consistent with a RaaS (Ransomware-as-a-Service) or affiliate-driven model rather than a tightly closed group. This remains unconfirmed.
• Ransom demands: No publicly documented demand figures exist for N0N. Based on the sector mix (mid-market healthcare, hospitality, regional financial services, hosting/IT providers), demands are assessed as likely sized to mid-market payment capacity rather than big-game enterprise figures.
• Initial access methods (assessed): Consistent with peer groups exhibiting similar victimology, likely vectors include edge-device exploitation (VPN concentrators, firewalls, management planes), RDP brute force or purchased RDP access, and phishing-led credential theft. The sector-level exposure discussion in the CVE section below frames specific hypotheses.
• Extortion approach: The operation of a public leak site confirms a double extortion model — data theft threatened alongside encryption, with publication used as negotiation leverage.
• Dwell time: Unknown. The presence of anonymized negotiation-stage postings suggests the gang publishes names before detonation or full data release in at least some cases, meaning named organizations may still be inside an extortion window. Defenders hunting their own environments should treat pre-encryption staging indicators as the highest-value detection surface.

Current Campaign Analysis

Sectors Targeted (from leak-site listings)

The published sample shows deliberate sector diversity rather than vertical specialization:

• Technology: 51Ridge (Newark NJ hosting/IT, US); Amagi Media Labs (US)
• Healthcare: Kingwood Endoscopy (US)
• Financial Services: Finzly Corp (US)
• Hospitality: Hotel DuPont (US)
• Retail & E-Commerce: Froggys Fog (US)
• Other / Unclassified: The Akeeli Group (US); Vormittag Associates Inc (US)
• Anonymized ("Not Found"): Company #92 through #98, spanning ET, TN, TT, CH, KR, and US

Each of these is a claim by N0N on its leak site, not a confirmed intrusion.

Geographic Concentration

The US dominates the sample — 9 of 15 named listings — consistent with English-language extortion economics and higher cyber-insurance payout capacity. The single-claim spread across ET, TN, TT, CH, and KR suggests opportunistic affiliate access rather than a regional strategy: affiliates monetize whatever access they can obtain, and the operator posts it. Aggregate statistics for the last 100 postings also include EG and NL, though no named organizations from those countries appear in this sample.

Victim Profile

Named organizations skew toward small-to-mid-market enterprises: a regional hosting/IT provider, an ambulatory surgery center, a boutique hotel, a specialty retail brand, a fintech firm. This is the classic mid-market extortion sweet spot — organizations large enough to pay, often under-resourced in 24/7 detection coverage, and frequently carrying cyber insurance.

Posting Frequency & Escalation Pattern

The observed cadence is a burst: 2 listings on 2026-10-18, 8 on 2026-10-19, and 5 on 2026-10-20 in the published sample. Two features stand out:

1. Anonymized negotiation-stage entries. Seven of 15 listings are "Company #NN" placeholders. This format typically means the victim has been named but not yet fully identified publicly — a pressure tactic mid-negotiation. Defenders in the listed countries who match undisclosed-victim profiles should treat this as an active-threat window.
2. Compression. Roughly half of the last-100 sample posted within 72 hours, which may indicate either a batch of affiliate intrusions maturing simultaneously or a deliberate publicity push to establish brand credibility for a newer operation.

CVE Exposure Hypothesis — NOT Victim Attribution

We have no evidence linking any specific named listing to any specific vulnerability. The following is a sector-level exposure hypothesis based on CISA KEV entries with confirmed ransomware use, mapped to the types of organizations N0N is claiming:

• CVE-2026-59310 (Broadcom VMware vCenter path traversal, KEV 2026-08-18): Any organization running vCenter — which includes hosting/IT providers and most mid-market enterprises with virtualized estates — faces ransomware-grade exposure here. vCenter compromise historically enables mass hypervisor encryption, the highest-impact detonation path.
• CVE-2026-50751 (Check Point Security Gateway improper authentication, IKEv1, KEV 2026-06-08) and CVE-2026-20316 (Cisco Secure FMC hard-coded password, KEV 2026-07-29): Perimeter and management-plane exploitation — the most probable initial access class for a group with N0N's opportunistic cross-geography victimology.
• CVE-2026-63077 (JetBrains TeamCity deserialization, KEV 2026-08-05) and CVE-2026-48027 (Nx Console embedded malicious code, KEV 2026-05-27): Build-pipeline and developer-tooling compromise, relevant to the technology and media-software firms appearing in the listing sample. Supply-chain-adjacent access via CI/CD also explains how a single intrusion can yield downstream victim counts.

Actionable translation: if you operate vCenter, Check Point gateways, Cisco FMC, TeamCity, or Nx Console and have not patched to vendor-fixed versions, you are inside the exposure set this campaign pattern monetizes — regardless of whether N0N specifically exploits these CVEs.

Detection Engineering

The following detections target the TTP chain most consistent with this campaign pattern: edge/RDP initial access → credential access → PsExec/WMI lateral movement → data staging → shadow copy deletion and encryption. Deploy all three Sigma rules; tune false positives against your administrator tooling baselines.

---
title: N0N Campaign - RDP Brute Force Followed by Successful Logon
id: 8f3a1c2e-7b41-4e9a-b2c6-n0n0campaign01
status: experimental
description: Detects a burst of failed RDP/network logons (EventID 4625, LogonType 3 or 10) from a single source followed by a successful logon (4624) within 10 minutes — consistent with RDP brute force initial access patterns used by ransomware affiliates.
author: Security Arsenal Threat Intelligence
date: 2026/10/21
references:
  - https://securityarsenal.com/darkside
logsource:
  product: windows
  service: security
detection:
  selection_failed:
    EventID: 4625
    LogonType:
      - 3
      - 10
  selection_success:
    EventID: 4624
    LogonType:
      - 3
      - 10
  condition: selection_failed | count() by SourceNetworkAddress > 20
  timeframe: 10m
level: high
tags:
  - attack.initial_access
  - attack.t1110
  - attack.t1133
  - n0n-campaign
---
title: N0N Campaign - PsExec or Remote Service Creation Lateral Movement
id: 8f3a1c2e-7b41-4e9a-b2c6-n0n0campaign02
status: experimental
description: Detects new service installation (EventID 7045) with binary paths in ADMIN$, temp, or user-writable directories, or service names consistent with PsExec-style tooling — lateral movement TTP common to ransomware operators pre-detonation.
author: Security Arsenal Threat Intelligence
date: 2026/10/21
references:
  - https://securityarsenal.com/darkside
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 7045
  filter_paths:
    ImagePath|contains:
      - '\\ADMIN$\\'
      - '\\Windows\\Temp\\'
      - '\\Users\\Public\\'
      - '\\AppData\\Local\\Temp\\'
  filter_names:
    ServiceName|contains:
      - 'PSEXESVC'
      - 'PAExec'
      - 'RemCom'
  condition: selection and (filter_paths or filter_names)
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002
  - attack.t1543.003
  - n0n-campaign
---
title: N0N Campaign - Pre-Encryption Shadow Copy Deletion and Backup Sabotage
id: 8f3a1c2e-7b41-4e9a-b2c6-n0n0campaign03
status: experimental
description: Detects volume shadow copy deletion, boot configuration tampering, or backup catalog deletion via vssadmin, wmic, bcdedit, or wbadmin — near-universal ransomware pre-detonation behavior and a last-chance detection opportunity.
author: Security Arsenal Threat Intelligence
date: 2026/10/21
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\\vssadmin.exe'
      - '\\wmic.exe'
      - '\\bcdedit.exe'
      - '\\wbadmin.exe'
      - '\\powershell.exe'
  selection_cmd:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'delete catalog'
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
      - 'resize shadowstorage'
      - 'Get-WmiObject Win32_Shadowcopy'
      - 'Remove-Item * -Recurse -Force'
  condition: selection_img and selection_cmd
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.t1486
  - attack.defense_evasion
  - n0n-campaign

The KQL query below hunts the pre-encryption staging chain in Microsoft Sentinel — suspicious remote execution, mass file access consistent with staging, and shadow copy tampering correlated on the same device within a 24-hour window.

// N0N Campaign Hunt: Lateral movement -> staging -> backup sabotage correlation
// Surface: devices showing 2+ pre-ransomware behaviors within 24h
let lookback = 7d;
let LateralMovement =
    DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where FileName in~ ("psexec.exe", "psexesvc.exe", "wmic.exe", "wmiprvse.exe", "at.exe", "schtasks.exe")
    | where ProcessCommandLine has_any ("\\\\", "/node:", "\\ADMIN$", "/create", "/s ")
       or InitiatingProcessFileName =~ "wmiprvse.exe"
    | summarize LateralHits = count(), LateralCmds = make_set(ProcessCommandLine, 5) by DeviceName, bin(Timestamp, 1h);
let Staging =
    DeviceFileEvents
    | where Timestamp > ago(lookback)
    | where FolderPath has_any ("\\staging", "\\exfil", "\\loot", "\\backup\\", "AppData\\Local\\Temp")
    | where FileName endswith_any (".zip", ".7z", ".rar", ".tar", ".gz")
    | summarize ArchiveWrites = count(), StagingPaths = make_set(FolderPath, 5) by DeviceName, bin(Timestamp, 1h);
let BackupSabotage =
    DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where ProcessCommandLine has_any ("delete shadows", "shadowcopy delete", "delete catalog",
        "recoveryenabled no", "ignoreallfailures", "resize shadowstorage")
    | summarize SabotageHits = count(), SabotageCmds = make_set(ProcessCommandLine, 5) by DeviceName, bin(Timestamp, 1h);
let SuspiciousExfilProc =
    DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where FileName in~ ("rclone.exe", "megasync.exe", "winscp.exe", "filezilla.exe", "curl.exe")
    | summarize ExfilToolHits = count(), ExfilCmds = make_set(ProcessCommandLine, 5) by DeviceName, bin(Timestamp, 1h);
LateralMovement
| join kind=inner (Staging) on DeviceName
| join kind=leftouter (BackupSabotage) on DeviceName
| join kind=leftouter (SuspiciousExfilProc) on DeviceName
| extend RiskScore = (toreal(LateralHits) * 2) + toreal(ArchiveWrites) + (toreal(SabotageHits) * 5) + (toreal(ExfilToolHits) * 3)
| project DeviceName, RiskScore, LateralHits, ArchiveWrites, SabotageHits, ExfilToolHits, LateralCmds, StagingPaths, SabotageCmds, ExfilCmds
| order by RiskScore desc

The PowerShell script below is a rapid triage tool for a single host or, via remoting, an estate sweep. It checks the three fastest pre-encryption indicators: shadow copy integrity, scheduled tasks created in the last 7 days (persistence/detonation timers), RDP exposure, and unauthorized local administrators.

# Security Arsenal - N0N Campaign Rapid Triage Script
# Run elevated. Sweep remotely: Invoke-Command -ComputerName (Get-Content hosts.txt) -FilePath .\n0n-triage.ps1
$report = @{ Host = $env:COMPUTERNAME; Time = Get-Date; Findings = @() }

# 1. Shadow copy integrity - ransomware deletes these immediately before encryption
$shadows = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) {
    $report.Findings += '[CRITICAL] No Volume Shadow Copies present - possible pre-detonation sabotage or VSS disabled'
} else {
    $report.Findings += "[INFO] $($shadows.Count) shadow copies present, oldest: $(($shadows | Sort-Object InstallDate | Select-Object -First 1).InstallDate)"
}
$vss = Get-Service VSS -ErrorAction SilentlyContinue
if ($vss.Status -ne 'Running') { $report.Findings += "[WARN] VSS service state: $($vss.Status)" }

# 2. Scheduled tasks created or modified in the last 7 days
$cutoff = (Get-Date).AddDays(-7)
Get-ScheduledTask | ForEach-Object {
    $t = $_
    try {
        $info = Get-ScheduledTaskInfo -TaskName $t.TaskName -TaskPath $t.TaskPath -ErrorAction Stop
        if ($t.Date -and ([datetime]$t.Date) -gt $cutoff) {
            $action = ($t.Actions | Select-Object -First 1).Execute
            $report.Findings += "[HUNT] New scheduled task: $($t.TaskPath)$($t.TaskName) | Runs: $action"
        }
    } catch {}
}

# 3. RDP exposure check
$rdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue).fDenyTSConnections
if ($rdpEnabled -eq 0) {
    $report.Findings += '[EXPOSURE] RDP is ENABLED on this host'
    $nla = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue).UserAuthentication
    if ($nla -ne 1) { $report.Findings += '[CRITICAL] RDP enabled WITHOUT Network Level Authentication' }
    $rdpListen = Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue
    if ($rdpListen) { $report.Findings += '[EXPOSURE] Port 3389 listening and reachable' }
}

# 4. Local administrators added recently
$admins = Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue
foreach ($a in $admins) {
    if ($a.ObjectClass -eq 'User') {
        $u = Get-LocalUser -Name ($a.Name -split '\\')[-1] -ErrorAction SilentlyContinue
        if ($u -and $u.PasswordLastSet -gt $cutoff) {
            $report.Findings += "[HUNT] Local admin '$($a.Name)' password set within last 7 days"
        }
    }
}

# 5. Failed logon burst on this host (brute force indicator)
$failed = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=$cutoff} -MaxEvents 500 -ErrorAction SilentlyContinue
if ($failed.Count -gt 100) { $report.Findings += "[CRITICAL] $($failed.Count) failed logons in 7 days - brute force pattern" }

$report.Findings | ForEach-Object { Write-Host $_ }
$report | ConvertTo-Json -Depth 4 | Out-File "$env:TEMP\n0n-triage-$($env:COMPUTERNAME).json"

Incident Response Priorities

T-Minus Detection Checklist (Before Encryption Fires)

If you match this campaign's victim profile — mid-market, US-based, healthcare/financial/hospitality/technology — hunt these indicators in order:

1. New edge-device accounts or config changes on VPN concentrators, firewalls, and management planes in the last 30 days (Check Point, Cisco FMC, Fortinet, SonicWall).
2. RDP logon anomalies: 4625 bursts followed by 4624 successes from unfamiliar source IPs; logons outside business hours from accounts that never authenticate remotely.
3. PsExec/service-creation lateral movement: EventID 7045 with suspicious binary paths; wmiprvse.exe spawning cmd.exe or powershell.exe children.
4. Archive staging: bulk writes of .zip/.7z/.rar to temp or user-writable directories, especially on file servers, HR/finance shares, and database hosts.
5. Exfil tooling: rclone, MEGAsync, WinSCP, FileZilla, or high-volume outbound transfers to consumer cloud storage or unfamiliar ASNs.
6. Shadow copy deletion / backup sabotage: vssadmin delete shadows, bcdedit tampering, backup-agent service stops. This is your last detection chance before detonation — alert at CRITICAL and page the on-call.
7. EDR/AV tampering: attempts to disable, uninstall, or add broad exclusions to security tooling.

Assets This Campaign Pattern Prioritizes for Exfiltration

Based on the claimed sector mix, anticipate targeting of:

• Healthcare listings: PHI repositories, EHR exports, patient billing records — highest regulatory leverage for extortion.
• Financial services listings: customer PII, transaction data, wire/ACH records.
• Hospitality/retail listings: payment card data, reservation/loyalty databases.
• Hosting/IT providers: downstream customer data and management-plane access — a single provider compromise can cascade into the anonymized multi-victim posting pattern observed here.
• All sectors: finance department shares (banking details for payment-pressure), legal/contracts, executive mailboxes.

Containment Actions, Ordered by Urgency

1. Isolate, don't power off. Network-isolate hosts showing sabotage or staging indicators. Preserve volatile memory for forensic capture.
2. Disable compromised identity paths. Force-reset credentials for any account observed in anomalous logons; revoke sessions and tokens; assume domain-tier credentials are exposed if lateral movement is confirmed.
3. Block exfil egress. Emergency-deny outbound to consumer file-sharing and unfamiliar cloud ASNs at the perimeter; enable TLS inspection logging on egress if available.
4. Protect backups immediately. Take backup infrastructure offline or to immutable/air-gapped state before touching anything else — sabotage of backups typically precedes detonation by hours, not days.
5. Segment aggressively. Emergency ACLs isolating server VLANs, backup networks, and hypervisor management planes from general user segments.
6. Engage IR retainer and counsel early. Extortion-stage incidents have legal, regulatory, and notification clock implications even before encryption occurs.

Hardening Recommendations

Immediate (24 Hours)

• Patch the KEV set: vCenter (CVE-2026-59310), TeamCity (CVE-2026-63077), Cisco FMC (CVE-2026-20316), Check Point gateways (CVE-2026-50751). Audit developer workstations for the malicious Nx Console version (CVE-2026-48027). These are confirmed ransomware-exploited; treat as drop-everything priority.
• Kill exposed RDP: disable internet-facing RDP entirely; enforce NLA; restrict 3389 to VPN-only management subnets.
• MFA everywhere external: VPN, remote access gateways, webmail, SSO. Credential-only initial access is this campaign pattern's cheapest door.
• Deploy the Sigma rules and Sentinel query above; specifically ensure shadow-copy-deletion alerting pages a human.
• Verify backup immutability and test one restore — do not assume; verify.
• Block known exfil tools (rclone, MEGAsync) at EDR and egress unless business-approved.

Short-Term (2 Weeks)

• Tiered administration: separate admin tiers for workstations, servers, and identity/hypervisor planes; eliminate standing domain-admin logons to user endpoints.
• Hypervisor isolation: vCenter and hypervisor management interfaces on a dedicated, ACL'd management network with jump-host-only access — a vCenter compromise is a full-estate encryption event.
• Egress architecture: default-deny outbound for server segments; proxy-and-log all user egress; alert on volume anomalies.
• CI/CD hardening: isolate build servers (TeamCity-class), rotate pipeline secrets, and enforce signed/verified IDE extensions to blunt supply-chain-adjacent access.
• Detection-as-code pipeline: operationalize Sigma rule deployment through your SIEM with automated testing, so campaign-specific content like this brief's ships in hours, not weeks.
• Tabletop the extortion scenario: rehearse decision-making for a leak-site listing of your organization — legal, comms, regulator notification, and negotiation posture — before you need it.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub