N0N Ransomware Gang: 29 New Leak-Site Postings — Sector Targeting Analysis & Detection Engineering

---
title: N0N Ransomware - RDP Brute Force Followed by Successful Authentication
id: 8f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects patterns consistent with N0N initial access via RDP brute force — multiple failed logons followed by success from the same source IP
author: Security Arsenal Threat Intelligence
date: 2026/11/08
logsource:
  product: windows
  service: security
  category: authentication
detection:
  selection_failed:
    EventID: 4625
    LogonType: 10
    IpAddress|startswith:
      - '10.'
      - '172.'
      - '192.168.'
  selection_success:
    EventID: 4624
    LogonType: 10
  condition: selection_failed and selection_success
  timeframe: 10m
  aggregation:
    - field: IpAddress
      aggregation: count
      gte: 20
falsepositives:
  - Legitimate RDP administrators with fat-fingered credentials
  - Vulnerability scanners with authentication testing
level: high
tags:
  - attack.initial_access
  - attack.t1110
  - attack.t1133
---
title: N0N Ransomware - PsExec and WMI Lateral Movement
id: 9a4b3c2d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects PsExec service creation and WMI process execution patterns associated with N0N lateral movement
author: Security Arsenal Threat Intelligence
date: 2026/11/08
logsource:
  product: windows
  service: system
detection:
  selection_psexec:
    EventID: 7045
    ServiceName|contains:
      - 'PSEXESVC'
      - 'PAExec'
      - 'csexec'
  selection_wmi:
    EventID: 4688
    CommandLine|contains:
      - 'wmic.exe process call create'
      - 'wmic /node:'
      - 'powershell.exe -enc'
      - 'powershell.exe -e '
  condition: selection_psexec or selection_wmi
falsepositives:
  - Legitimate administrative tooling
  - SCCM or similar management platforms
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1047
  - attack.s0029
---
title: N0N Ransomware - Data Staging and Exfiltration Preparation
id: 0b5c4d3e-6f7a-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
description: Detects archive creation, cloud sync tool abuse, and suspicious network destinations consistent with N0N pre-encryption data staging
author: Security Arsenal Threat Intelligence
date: 2026/11/08
logsource:
  product: windows
  service: security
detection:
  selection_archive:
    EventID: 4688
    CommandLine|contains:
      - 'rar.exe a -r'
      - '7z.exe a -t7z'
      - 'tar.exe -czf'
      - 'Compress-Archive'
  selection_cloud:
    EventID: 4688
    CommandLine|contains:
      - 'rclone.exe'
      - 'rclone copy'
      - 'rclone sync'
      - 'megacmd'
      - 'filezilla'
  selection_network:
    EventID: 5156
    DestinationPort:
      - 443
      - 21
      - 22
    Application|contains:
      - 'rclone'
      - 'megacmd'
      - 'filezilla'
  condition: selection_archive or selection_cloud or (selection_network and selection_archive)
falsepositives:
  - Legitimate backup operations
  - Developers packaging releases
level: critical
tags:
  - attack.collection
  - attack.exfiltration
  - attack.t1560
  - attack.t1567

// N0N Ransomware Hunt — Lateral Movement and Pre-Ransomware Staging
// Focus: Cobalt Strike beaconing, WMI/PsExec execution, shadow copy deletion, data staging
// Timeframe: Last 7 days

let timeframe = 7d;

// Cobalt Strike default certificate and beaconing patterns
let CobaltStrikeC2 = (
    DeviceNetworkEvents
    | where TimeGenerated > ago(timeframe)
    | where RemotePort in (443, 8443, 8080)
    | where RemoteUrl contains "pixel" or RemoteUrl contains "jquery" or RemoteUrl contains "push"
    | where InitiatingProcessFileName in~ ("rundll32.exe", "regsvr32.exe", "powershell.exe", "svchost.exe")
    | summarize Count=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by DeviceName, RemoteIP, RemoteUrl, InitiatingProcessFileName
    | where Count > 10 and Count < 100
);

// WMI and PsExec lateral movement
let LateralMovement = (
    SecurityEvent
    | where TimeGenerated > ago(timeframe)
    | where EventID == 4688
    | where CommandLine has_any ("wmic process call create", "psexec", "paexec", "csexec")
    | where not(CommandLine has_any ("sccm", "smsagent", "health"))
    | project TimeGenerated, Computer, Account, CommandLine, ProcessName
);

// Volume Shadow Copy deletion — pre-encryption indicator
let ShadowCopyDelete = (
    SecurityEvent
    | where TimeGenerated > ago(timeframe)
    | where EventID == 4688
    | where CommandLine has_any ("vssadmin delete shadows", "vssadmin resize shadowstorage", "bcdedit", "wbadmin delete")
    | project TimeGenerated, Computer, Account, CommandLine
);

// Mass archive creation — data staging
let DataStaging = (
    DeviceProcessEvents
    | where TimeGenerated > ago(timeframe)
    | where ProcessCommandLine has_any ("rar.exe", "7z.exe", "Compress-Archive")
    | where ProcessCommandLine has_any ("-r", "-t7z", "-v")
    | summarize ArchiveCount=count(), Commands=make_set(ProcessCommandLine) by DeviceName, InitiatingProcessAccountName
    | where ArchiveCount > 5
);

// Scheduled task creation — persistence
let ScheduledTasks = (
    SecurityEvent
    | where TimeGenerated > ago(timeframe)
    | where EventID == 4698
    | where not(TaskName has_any ("Microsoft", "Windows", "OneDrive"))
    | project TimeGenerated, Computer, TaskName, TaskCommand, Account
);

// Union all findings
union CobaltStrikeC2, LateralMovement, ShadowCopyDelete, DataStaging, ScheduledTasks
| summarize by TimeGenerated, DeviceName, Computer, Account, CommandLine, RemoteIP, RemoteUrl, ArchiveCount, TaskName
| sort by TimeGenerated desc

#Requires -RunAsAdministrator
<#
.SYNOPSIS
    N0N Ransomware Rapid Response — Detection and Hardening Script
.DESCRIPTION
    Checks for exposed RDP, enumerates recent scheduled tasks, finds recently modified Volume Shadow Copies,
    and scans for common N0N staging indicators.
.NOTES
    Run on critical servers and domain controllers. Requires administrative privileges.
#>

param(
    [int]$DaysBack = 7,
    [switch]$Remediate = $false
)

$ReportPath = "$env:TEMP\N0N_RapidResponse_$(Get-Date -Format 'yyyyMMdd_HHmmss').txt"

function Write-Report {
    param([string]$Message, [string]$Level = "INFO")
    $timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    $line = "[$timestamp] [$Level] $Message"
    Add-Content -Path $ReportPath -Value $line
    if ($Level -eq "ALERT") { Write-Host $line -ForegroundColor Red }
    elseif ($Level -eq "WARN") { Write-Host $line -ForegroundColor Yellow }
    else { Write-Host $line -ForegroundColor Green }
}

Write-Report "=== N0N Ransomware Rapid Response Script ==="
Write-Report "Report: $ReportPath"
Write-Report "Days analyzed: $DaysBack"

# 1. Check for exposed RDP
Write-Report "`n--- RDP Exposure Check ---"
$RDPPort = Get-NetTCPConnection -LocalPort 3389 -ErrorAction SilentlyContinue | Where-Object { $_.State -eq "Listen" }
if ($RDPPort) {
    $RDPListeners = $RDPPort | Select-Object -ExpandProperty LocalAddress -Unique
    if ($RDPListeners -contains "0.0.0.0" -or $RDPListeners -contains "::") {
        Write-Report "ALERT: RDP is listening on all interfaces — potential brute force exposure" "ALERT"
    } else {
        Write-Report "RDP listening on: $($RDPListeners -join ', ')"
    }
    if ($Remediate) {
        Write-Report "REMEDIATION: Consider restricting RDP via Windows Firewall or disabling if not required" "WARN"
    }
} else {
    Write-Report "RDP not listening on port 3389"
}

# 2. Enumerate scheduled tasks created in last N days
Write-Report "`n--- Recent Scheduled Tasks (Last $DaysBack days) ---"
$RecentTasks = Get-ScheduledTask | Where-Object { $_.Date -gt (Get-Date).AddDays(-$DaysBack) } | Sort-Object Date -Descending
if ($RecentTasks) {
    foreach ($task in $RecentTasks) {
        Write-Report "Task: $($task.TaskName) | Path: $($task.TaskPath) | Created: $($task.Date)" "WARN"
        if ($task.Actions.Execute -match "powershell|cmd|rundll32|regsvr32|mshta") {
            Write-Report "  Suspicious action: $($task.Actions.Execute) $($task.Actions.Arguments)" "ALERT"
        }
    }
} else {
    Write-Report "No scheduled tasks created in the last $DaysBack days"
}

# 3. Check Volume Shadow Copies
Write-Report "`n--- Volume Shadow Copy Analysis ---"
$ShadowCopies = Get-WmiObject -Class Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($ShadowCopies) {
    $RecentShadows = $ShadowCopies | Where-Object { $_.InstallDate -gt (Get-Date).AddDays(-$DaysBack).ToString("yyyyMMddHHmmss.ffffff-000") }
    Write-Report "Total shadow copies: $($ShadowCopies.Count)"
    Write-Report "Created in last $DaysBack days: $($RecentShadows.Count)"
    if ($RecentShadows.Count -eq 0 -and $ShadowCopies.Count -eq 0) {
        Write-Report "ALERT: No shadow copies exist — possible anti-forensics or deletion by attacker" "ALERT"
    }
} else {
    Write-Report "No shadow copies found — verify VSS service is running" "WARN"
}

# 4. Check for suspicious processes and network connections
Write-Report "`n--- Suspicious Process and Network Indicators ---"
$SuspiciousProcesses = Get-Process | Where-Object { $_.ProcessName -match "rclone|megacmd|filezilla|7z|rar" }
if ($SuspiciousProcesses) {
    foreach ($proc in $SuspiciousProcesses) {
        Write-Report "Suspicious process: $($proc.ProcessName) (PID: $($proc.Id)) | Path: $($proc.Path)" "ALERT"
        $connections = Get-NetTCPConnection -OwningProcess $proc.Id -ErrorAction SilentlyContinue | Where-Object { $_.State -eq "Established" }
        foreach ($conn in $connections) {
            Write-Report "  Connection: $($conn.RemoteAddress):$($conn.RemotePort)" "ALERT"
        }
    }
} else {
    Write-Report "No suspicious exfiltration processes detected"
}

# 5. Check for Cobalt Strike default certificates
Write-Report "`n--- Cobalt Strike Certificate Check ---"
$CSIndicators = @(
    "OU=IT Department",
    "CN=.*\.com"
)
$RecentCerts = Get-ChildItem -Path Cert:\LocalMachine\My -ErrorAction SilentlyContinue | Where-Object { $_.NotAfter -gt (Get-Date).AddDays(-30) }
foreach ($cert in $RecentCerts) {
    if ($cert.Subject -match "CN=.*" -and $cert.Subject -notmatch "microsoft|windows") {
        Write-Report "Non-standard certificate: $($cert.Subject) | Thumbprint: $($cert.Thumbprint)" "WARN"
    }
}

# 6. Check recent security event logs for lateral movement
Write-Report "`n--- Lateral Movement Indicators ---"
$StartTime = (Get-Date).AddDays(-$DaysBack)
$WMIExecution = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=$StartTime} -ErrorAction SilentlyContinue | Where-Object { $_.Message -match "wmic.*process call create|powershell.*-enc" }
if ($WMIExecution) {
    Write-Report "WMI/encoded PowerShell executions detected: $($WMIExecution.Count)" "ALERT"
    $WMIExecution | Select-Object -First 5 | ForEach-Object {
        Write-Report "  $($_.TimeCreated): $($_.Message.Substring(0, [Math]::Min(200, $_.Message.Length)))" "ALERT"
    }
} else {
    Write-Report "No obvious WMI lateral movement detected"
}

# 7. Summary and recommendations
Write-Report "`n--- Summary ---"
Write-Report "Review the alerts above. Recommended immediate actions:"
Write-Report "1. Isolate any hosts with active suspicious processes"
Write-Report "2. Reset credentials for any accounts with recent scheduled task creation"
Write-Report "3. Verify backup integrity and ensure offline backups exist"
Write-Report "4. Review firewall logs for outbound connections on ports 443, 21, 22 from servers"
Write-Report "5. Patch perimeter devices — VPN concentrators, firewalls, remote access gateways"

Write-Report "`nScript completed. Report saved to: $ReportPath"

if ($Remediate) {
    Write-Report "`n--- REMEDIATION MODE ---" "WARN"
    Write-Report "Run with -Remediate to apply automatic hardening (not implemented in this version)" "WARN"
}