Classification: TLP:CLEAR | Publication Date: 2026-10-18 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 29 New Leak-Site Listings in 72 Hours — US-Heavy Campaign Analysis, Detection Rules & Hunting Queries

Executive Summary

Between 2026-10-16 and 2026-10-18, the ransomware crew tracked as N0N published 29 new victim listings on its dark web leak site — a compressed posting tempo that suggests either a batch detonation cycle or an accelerated extortion schedule. The listings skew heavily toward the United States, with additional claims naming organizations in the Netherlands, Brazil, and Egypt. Named sectors include Energy & Utilities, Manufacturing, Professional Services, and Healthcare, alongside a large volume of unidentified entries ("Company #77–#91") that N0N appears to be holding anonymous pending negotiation — a known pressure tactic.

Named organizations in this batch include ECO USA (Energy & Utilities, US), Solid Trading B.V. (NL), Prafesta Ind. e Com. de Embalagens Ltda (Manufacturing, BR), and SQA Services Inc (Professional Services). N0N claims to have compromised these organizations; these are unverified threat-actor assertions, not confirmed breaches. Security teams in the listed sectors — particularly energy and manufacturing — should treat this as a sector-wide exposure signal and run the hunting content below regardless of whether their organization is named.

Sourcing & Verification

• Of the 29 listings in this dataset, 27 were independently observed by a second leak-site crawler (MULTI-SOURCE); 2 appear on a single source only. Multi-source corroboration confirms only that N0N posted the claim — it does not confirm any intrusion occurred.
• Inclusion in this briefing reflects the threat actor's claim, published on its own leak site. It is not confirmation of a breach of any named organization.
• A named organization may dispute the listing. A denial is likewise not proof the claim is false: disclosure obligations vary by jurisdiction and sector, and not every incident is reportable. Neither silence nor denial settles the question. Only the organization or its regulator can confirm an incident.
• Security Arsenal will publish corrections as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

Current Campaign Analysis

Sector Targeting

The 29-listing batch breaks down as follows: a dominant share of unidentified "Company #N" entries (US-heavy), plus named claims in Energy & Utilities (ECO USA), Manufacturing (Prafesta Ind. e Com. de Embalagens Ltda), Professional Services (SQA Services Inc), and Other (Solid Trading B.V.). Healthcare appears in N0N's aggregate sector profile over its last 100 postings, indicating sustained — not incidental — interest.

Geographic Concentration

US-dominant, consistent with N0N's historical pattern: US entities have the highest propensity to pay and the deepest cyber-insurance coverage. Secondary presence in NL, BR, EG suggests opportunistic edge-device exploitation rather than deliberate regional targeting.

Victim Profile

Based on the named claims, N0N favors mid-market organizations (roughly $10M–$500M revenue) — large enough to pay, small enough to lack 24/7 SOC coverage and mature segmentation. The anonymous "Company #N" batch pattern is consistent with victims in active negotiation whose sizes cannot be independently assessed.

Posting Frequency & Escalation

~29 listings in ~72 hours (Oct 16–18), with 6 on the 18th alone. This burst cadence typically means one of three things: (1) a batch of intrusions from a single successful access vector matured simultaneously; (2) negotiation deadlines expired en masse; or (3) the group is clearing backlog before a pause. The volume of anonymous placeholders points to (1) — a common exploited vector yielding parallel access.

CVE Exposure Hypothesis

No evidence links any specific named listing to a specific CVE. However, N0N's known tradecraft — edge-device and virtualization exploitation — aligns with several entries currently on CISA's Known Exploited Vulnerabilities catalog, all with confirmed ransomware use:

• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1) — edge VPN access vector; matches N0N's VPN-first access pattern.
• CVE-2026-20316 — Cisco Secure FMC hard-coded password — firewall management plane compromise.
• CVE-2026-59310 — VMware vCenter path traversal — hypervisor-level access enabling mass encryption of virtualized estates, N0N's preferred blast-radius tactic.
• CVE-2026-63077 — JetBrains TeamCity deserialization — unauthenticated RCE on build servers; pipeline access for lateral movement and supply-chain positioning.
• CVE-2026-48027 — Nx Console embedded malicious code — developer-workstation initial foothold.

Treat these as sector-level exposure hypotheses, not attribution. If any of these products sit in your perimeter or CI/CD stack, patch on KEV timelines regardless of N0N.

Detection Engineering

---
title: N0N Pre-Encryption Staging - VSS Deletion and Rclone Exfiltration
id: 8f3a1c2e-n0n1-4a5b-9c6d-20261018stg1
status: experimental
description: Detects Volume Shadow Copy deletion and Rclone/MEGA data exfiltration staging consistent with N0N pre-encryption playbook. Tune for backup-admin exclusions.
author: Security Arsenal Threat Intel
references:
    - https://securityarsenal.com/darkside
logsource:
    category: process_creation
    product: windows
detection:
    selection_vss:
        Image|endswith:
            - '\vssadmin.exe'
            - '\wmic.exe'
            - '\bcdedit.exe'
        CommandLine|contains:
            - 'delete shadows'
            - 'shadowcopy delete'
            - 'recoveryenabled no'
    selection_exfil:
        Image|endswith:
            - '\rclone.exe'
        CommandLine|contains:
            - 'copy'
            - 'sync'
            - '--config'
    condition: selection_vss or selection_exfil
falsepositives:
    - Legitimate backup maintenance windows
    - IT use of rclone for sanctioned cloud sync
level: high
tags:
    - attack.impact
    - attack.t1490
    - attack.t1567.002
---
title: N0N Lateral Movement - PsExec and Remote WMI Execution
id: 8f3a1c2e-n0n1-4a5b-9c6d-20261018lat1
status: experimental
description: Detects PsExec service installation and WMI remote process creation used by N0N affiliates for domain-wide payload deployment prior to encryption.
author: Security Arsenal Threat Intel
logsource:
    category: process_creation
    product: windows
detection:
    selection_psexec:
        Image|endswith:
            - '\PsExec.exe'
            - '\PsExec64.exe'
        CommandLine|contains:
            - '\\'
            - '-s'
    selection_wmi:
        ParentImage|endswith: '\WmiPrvSE.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\rundll32.exe'
    condition: selection_psexec or selection_wmi
falsepositives:
    - Admin tools in enterprise management (SCCM, PDQ)
    - Filter on known management hosts
level: high
tags:
    - attack.lateral-movement
    - attack.t1569.002
    - attack.t1047
---
title: N0N Initial Access - RDP Brute Force and Anomalous VPN Authentication
id: 8f3a1c2e-n0n1-4a5b-9c6d-20261018ia1
status: experimental
description: Detects RDP brute-force patterns (repeated 4625 logon failures followed by success) indicative of N0N edge-access tradecraft against exposed RDP and VPN gateways.
author: Security Arsenal Threat Intel
logsource:
    product: windows
    service: security
detection:
    selection_fail:
        EventID: 4625
        LogonType:
            - 3
            - 10
    selection_success:
        EventID: 4624
        LogonType: 10
    condition: selection_fail | selection_success
timeframe: 10m
falsepositives:
    - Misconfigured service accounts
    - Correlate by source IP; alert on >20 failures followed by success from same IP
level: medium
tags:
    - attack.credential-access
    - attack.t1110
    - attack.t1021.001

// N0N Pre-Ransomware Staging Hunt — Microsoft Sentinel
// Hunts for data staging + exfil tooling + shadow-copy tampering within a 7-day window
let Lookback = 7d;
let ExfilTools = dynamic(["rclone.exe", "megacmd.exe", "winscp.exe", "filezilla.exe", "curl.exe"]);
let Staging =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName in~ (ExfilTools)
       or (FileName =~ "7z.exe" and ProcessCommandLine has_any ("a -p", "-mx9"))
    | project StagingTime = TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine;
let VSSTamper =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where ProcessCommandLine has_any ("delete shadows", "shadowcopy delete", "recoveryenabled no", "wbadmin delete")
    | project VSSTime = TimeGenerated, DeviceName, AccountName, ProcessCommandLine;
let Lateral =
    DeviceEvents
    | where TimeGenerated > ago(Lookback)
    | where ActionType == "ServiceInstalled"
       and (AdditionalFields has "PSEXESVC" or AdditionalFields has "PAExec")
    | project PsexecTime = TimeGenerated, DeviceName;
Staging
| join kind=inner VSSTamper on DeviceName
| join kind=leftouter Lateral on DeviceName
| extend PreEncryptionScore = iif(isnotnull(PsexecTime), 3, 1)
| summarize arg_max(StagingTime, *) by DeviceName
| sort by PreEncryptionScore desc, StagingTime desc

# N0N Rapid Triage — run on suspect hosts; outputs to C:\IR\n0n_triage_<hostname>.txt
$out = "C:\IR"; New-Item -Path $out -ItemType Directory -Force | Out-Null
$report = "$out\n0n_triage_$env:COMPUTERNAME.txt"

"=== EXPOSED RDP CHECK ===" | Out-File $report
Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue |
  Select-Object LocalAddress,LocalPort,State | Out-File $report -Append

"=== SCHEDULED TASKS (last 7 days, non-Microsoft) ===" | Out-File $report -Append
Get-ScheduledTask | Where-Object {
  $_.Date -and ([datetime]$_.Date) -gt (Get-Date).AddDays(-7) -and
  $_.Author -notmatch 'Microsoft'
} | Select-Object TaskName,TaskPath,Author,Date | Out-File $report -Append

"=== VOLUME SHADOW COPIES (should be non-empty) ===" | Out-File $report -Append
vssadmin list shadows 2>&1 | Out-File $report -Append

"=== RECENT SUSPICIOUS PROCESSES / EXFIL TOOLING ===" | Out-File $report -Append
Get-Process | Where-Object {
  $_.ProcessName -match 'rclone|megacmd|psexec|winscp|7z|csrss_update'
} | Select-Object ProcessName,Id,Path,StartTime | Out-File $report -Append

"=== FAILED RDP LOGONS (last 24h, top source IPs) ===" | Out-File $report -Append
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)} -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'Logon Type:\s+(3|10)' } |
  Group-Object { ([regex]'Source Network Address:\s+(\S+)').Match($_.Message).Groups[1].Value } |
  Sort-Object Count -Descending | Select-Object -First 10 Count,Name | Out-File $report -Append

Write-Host "Triage complete: $report"

Incident Response Priorities

T-Minus Detection Checklist (before encryption fires)

• D-3 to D-1: Rclone/MEGA/7-Zip processes on file servers or DMZ hosts; large outbound transfers to consumer cloud storage
• D-1: vssadmin delete shadows, bcdedit recoveryenabled no, wbadmin delete catalog — treat as encryption imminent
• D-0 (hours): PSEXESVC service installs sweeping multiple hosts; mass WMI process creation from a single source; batch files dropping ransom-note templates

Assets N0N Prioritizes for Exfiltration

File shares containing financial records, HR/PII, contracts, and legal correspondence; for energy/manufacturing claims specifically, engineering drawings and OT-adjacent documentation — these maximize regulatory and competitive-pressure leverage. Backup infrastructure is targeted for destruction, not exfil.

Containment (ordered by urgency)

1. Isolate affected VLANs/hosts at the switch level — do not power off (preserve memory for beacon analysis)
2. Disable the compromised identity set: force password resets, revoke tokens, kill active sessions domain-wide
3. Block outbound to consumer cloud storage domains at the proxy/firewall; alert on TLS to rare TLDs
4. Snapshot hypervisors immediately if vCenter is reachable by attacker-controlled accounts
5. Engage IR retainer and counsel before any contact with the gang; do not access the negotiation portal from corporate infrastructure

Hardening Recommendations

Immediate (24 hours)

• Patch or mitigate CVE-2026-50751 (Check Point IKEv1), CVE-2026-20316 (Cisco FMC), CVE-2026-59310 (vCenter) per CISA KEV due dates — these are confirmed ransomware-exploited
• Disable RDP from the internet entirely; require VPN + MFA for all remote admin
• Block execution of rclone.exe, psexec.exe (renamed copies included — hash/path allowlisting) via WDAC/AppLocker for standard users
• Alert on any vssadmin delete shadows execution outside approved backup windows — page the on-call, don't email
• Enforce MFA on all VPN, OWA, and remote-access portals; audit for legacy IKEv1 tunnels

Short-Term (2 weeks)

• Segment backup infrastructure onto isolated management networks with immutable, offline copies (3-2-1-1-0)
• Deploy canary files on file shares with high-fidelity alerting on access
• Restrict WMI/PsExec lateral paths: enforce LAPS, disable PSRemoting where unused, tier admin accounts
• Stand up the KQL hunt above as a scheduled analytic rule with automated host-isolation playbook on VSS-tamper detections
• Review cyber-insurance and legal-notification playbooks against a double-extortion scenario — N0N's model means encryption is the second crisis, not the first

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub