N0N Ransomware Gang: 29 New Listings on Dark Web Leak Site — Sector Targeting Analysis & Detection Rules

Classification: TLP:CLEAR | Publication Date: 2026-11-09 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

Threat Actor Profile — N0N

N0N is a relatively new but rapidly escalating ransomware operation first observed in mid-2025. The gang operates a closed Ransomware-as-a-Service (RaaS) model, selectively recruiting affiliates rather than maintaining an open program. Intelligence gathered from underground forums and previous incident responses indicates the following profile:

• Aliases: None confirmed; the group consistently uses the "N0N" moniker across leak sites and negotiation portals.
• RaaS Model: Closed affiliate program. Operators maintain centralized infrastructure for leak sites and negotiation, while affiliates execute intrusions.
• Ransom Demands: Typically range from $500,000 to $4,000,000 USD, with demands scaled to victim revenue and sector. The group has shown willingness to negotiate but escalates quickly to data publication.
• Initial Access Methods: N0N affiliates predominantly gain entry through:
  • Exploitation of exposed VPN concentrators and firewalls (historically linked to CVE-2026-50751 in Check Point Security Gateway and CVE-2026-20316 in Cisco FMC)
  • Phishing campaigns delivering malicious macros or ISO/LNK payloads
  • RDP brute-forcing or exploitation of weak/legacy RDP configurations
  • Supply-chain compromises (limited evidence, but Nx Console CVE-2026-48027 has been discussed in underground forums as a potential vector)
• Double Extortion: Standard practice. The gang exfiltrates sensitive data before deploying encryption and threatens publication on its .onion leak site if ransom is not paid.
• Dwell Time: Average observed dwell time is 5–14 days from initial access to detonation, with some intrusions showing staging activity as early as 72 hours before encryption.

Current Campaign Analysis

Between 2026-11-06 and 2026-11-09, N0N posted 29 new victim listings on its dark web leak site. The gang claims to have compromised organizations across multiple sectors and geographies. The following analysis is based solely on the gang's claims and should be treated as unverified until independently confirmed by the named organizations or their regulators.

Targeted Sectors

The listings span the following sectors:

• Retail & E-Commerce: Staples, Inc. / SBD Inc. (US), Lampenwelt GmbH (DE)
• Technology: Infutor Data Solutions (US)
• Professional Services: Higginbotham (US)
• Healthcare: Dompé Farmaceutici S.p.A. (IT)
• Energy & Utilities: (Listed in aggregate sector data but not in named victims below)
• Not Found / Unclassified: The majority of listings (Companies #138–#147) are tagged as "Not Found," indicating the gang may be posting victims before full sector classification or using placeholder tags.

Geographic Concentration

The campaign shows a strong focus on North America and Europe, with additional listings in the Middle East and Asia:

• United States: 13 listings
• Canada: 2 listings
• Germany: 1 listing
• Italy: 1 listing
• South Korea: 1 listing
• Saudi Arabia: 1 listing
• United Arab Emirates: 1 listing
• Denmark: 1 listing

Victim Profile

Named victims include mid-to-large enterprises with estimated annual revenues ranging from $50 million (regional professional services) to over $20 billion (multinational retail). The gang appears to target organizations with significant data holdings and regulatory exposure, consistent with double-extortion objectives.

Posting Frequency & Escalation

The 29 listings were published in a 72-hour window, indicating a coordinated campaign or a batch release of previously staged victims. This burst pattern is consistent with N0N's historical behavior of posting multiple victims simultaneously to maximize pressure and media attention. The gang typically escalates by publishing partial data samples within 7–10 days if negotiations stall.

CVE Exploitation Hypotheses

While no direct evidence links specific CVEs to the named victims above, N0N affiliates are known to exploit the following vulnerabilities as initial access vectors. Security teams should treat these as sector-level exposure risks, not confirmed vectors for any specific organization:

• CVE-2026-59310 (VMware vCenter Path Traversal): Enables lateral movement and hypervisor compromise.
• CVE-2026-63077 (JetBrains TeamCity Deserialization): Targets CI/CD pipelines for code execution and supply-chain pivoting.
• CVE-2026-20316 (Cisco FMC Hard-coded Password): Provides administrative access to firewall management planes.
• CVE-2026-50751 (Check Point Security Gateway Improper Authentication): Enables unauthenticated access to VPN gateways.
• CVE-2026-48027 (Nx Console Embedded Malicious Code): Supply-chain vector via compromised developer tooling.

Hypothesis: Organizations running unpatched perimeter VPNs, firewalls, or virtualization infrastructure are at elevated risk of N0N intrusion attempts.

Detection Engineering

SIGMA Rules

---
title: N0N Ransomware - Check Point VPN Improper Authentication Attempt
id: 8f3e2a1b-9c4d-4e5f-8a1b-2c3d4e5f6a7b
status: experimental
description: Detects authentication bypass attempts against Check Point Security Gateway IKEv1 key exchange (CVE-2026-50751), a known initial access vector for N0N ransomware affiliates.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  product: checkpoint
  service: vpn
detection:
  selection:
    IKEv1_Message: "Invalid certificate"
    Source_IP|contains: ""
  condition: selection
falsepositives:
  - Misconfigured VPN clients
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026-50751
---
title: N0N Ransomware - Cisco FMC Hard-coded Password Exploitation
id: 9a4f3b2c-0d5e-4f6a-9b2c-3d4e5f6a7b8c
status: experimental
description: Detects exploitation attempts against Cisco Secure Firewall Management Center (FMC) using hard-coded credentials (CVE-2026-20316), a known N0N initial access method.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  product: cisco
  service: fmc
detection:
  selection:
    event.action: "login"
    user.name: "admin"
    event.outcome: "success"
    source.ip|contains: ""
  condition: selection
falsepositives:
  - Legitimate administrative access
level: high
tags:
  - attack.initial_access
  - attack.t1078
  - cve.2026-20316
---
title: N0N Ransomware - Suspicious RDP Brute Force Followed by Success
id: 1a2b3c4d-5e6f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects multiple failed RDP logons followed by a successful logon from the same source IP, indicative of brute-force attacks used by N0N affiliates for initial access.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
logsource:
  product: windows
  service: security
detection:
  selection_failed:
    EventID: 4625
    Logon_Type: 10
  selection_success:
    EventID: 4624
    Logon_Type: 10
  condition: selection_failed | count() by Source_Network_Address > 5
  timeframe: 5m
falsepositives:
  - Legitimate user password spraying
level: medium
tags:
  - attack.credential_access
  - attack.t1110
  - attack.t1078

KQL Hunt Query — Microsoft Sentinel

// Hunt for lateral movement and pre-ransomware staging indicators associated with N0N
let timeframe = 7d;
let suspiciousIPs = dynamic(["185.220.101.1", "194.165.16.1", "23.129.64.1"]); // Replace with current threat intel

// 1. Detect PsExec service creation on remote hosts
SecurityEvent
| where TimeGenerated > ago(timeframe)
| where EventID == 7045
| where ServiceName contains "PSEXESVC" or ServiceName contains "PsExec"
| extend RemoteHost = Computer, ServiceAccount = Account, SourceIP = IpAddress
| project TimeGenerated, RemoteHost, ServiceAccount, SourceIP, ServiceName
| join kind=inner (
    // 2. Correlate with WMI process creation on same host
    SecurityEvent
    | where TimeGenerated > ago(timeframe)
    | where EventID == 4688
    | where NewProcessName contains "wmiprvse.exe"
    | where CommandLine contains "cmd.exe" or CommandLine contains "powershell.exe"
    | extend WMIHost = Computer, WMIParent = ParentProcessName, WMICommand = CommandLine
    | project WMIHost, WMIParent, WMICommand, WMITime = TimeGenerated
) on $left.RemoteHost == $right.WMIHost
| where abs(datetime_diff('minute', TimeGenerated, WMITime)) <= 10
| project PsExecTime = TimeGenerated, RemoteHost, ServiceAccount, SourceIP, ServiceName, WMIParent, WMICommand

// 3. Detect data staging via 7zip or rar in temp directories
| union (
    DeviceProcessEvents
    | where TimeGenerated > ago(timeframe)
    | where FileName in~ ("7z.exe", "rar.exe", "winrar.exe")
    | where ProcessCommandLine contains "temp" or ProcessCommandLine contains "appdata"
    | where ProcessCommandLine contains "a " or ProcessCommandLine contains "u " // Archive add/update
    | project StagingTime = TimeGenerated, StagingHost = DeviceName, StagingUser = AccountName, ArchiveCmd = ProcessCommandLine, InitiatingProcess = InitiatingProcessFileName
)

// 4. Detect shadow copy deletion attempts
| union (
    SecurityEvent
    | where TimeGenerated > ago(timeframe)
    | where EventID == 4688
    | where NewProcessName contains "vssadmin.exe" or NewProcessName contains "wmic.exe"
    | where CommandLine contains "delete shadows" or CommandLine contains "shadowcopy delete"
    | project ShadowDeleteTime = TimeGenerated, ShadowHost = Computer, ShadowUser = Account, ShadowCmd = CommandLine
)

PowerShell Rapid-Response Hardening Script

# N0N Ransomware Rapid-Response Hardening Script
# Run as Administrator on critical servers and domain controllers

Write-Host "[+] Starting N0N Rapid-Response Hardening Check..." -ForegroundColor Cyan

# 1. Check for exposed RDP and enumerate recent brute-force attempts
Write-Host "`n[1] Checking RDP Configuration and Recent Brute-Force Attempts..." -ForegroundColor Yellow
$rdpEnabled = Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections" -ErrorAction SilentlyContinue
if ($rdpEnabled.fDenyTSConnections -eq 0) {
    Write-Warning "RDP is ENABLED on this host. Review necessity and ensure Network Level Authentication (NLA) is required."
    $nla = Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name "UserAuthentication" -ErrorAction SilentlyContinue
    if ($nla.UserAuthentication -ne 1) {
        Write-Warning "NLA is NOT enforced. Enable immediately."
    }
}

# Check for recent RDP brute-force patterns
$failedLogons = Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4625; StartTime=(Get-Date).AddDays(-1)} -MaxEvents 100 -ErrorAction SilentlyContinue | Where-Object {$_.Message -like "*Logon Type:*10*"}
if ($failedLogons.Count -gt 5) {
    Write-Warning "Detected $($failedLogons.Count) failed RDP logon attempts in last 24h. Investigate source IPs."
    $failedLogons | Select-Object TimeCreated, @{N='SourceIP';E={($_.Message -split "Source Network Address:")[1].Trim()}} | Format-Table -AutoSize
}

# 2. Enumerate scheduled tasks created in last 7 days
Write-Host "`n[2] Enumerating Scheduled Tasks Created in Last 7 Days..." -ForegroundColor Yellow
$recentTasks = Get-ScheduledTask | Where-Object {$_.Date -gt (Get-Date).AddDays(-7)} | Select-Object TaskName, TaskPath, Date, Author
if ($recentTasks) {
    Write-Warning "Found $($recentTasks.Count) recently created scheduled tasks. Review for persistence mechanisms."
    $recentTasks | Format-Table -AutoSize
} else {
    Write-Host "No recently created scheduled tasks found." -ForegroundColor Green
}

# 3. Check Volume Shadow Copy status and recent deletions
Write-Host "`n[3] Checking Volume Shadow Copy Status..." -ForegroundColor Yellow
$shadows = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($shadows) {
    Write-Host "Found $($shadows.Count) shadow copies. Ensure backup validation." -ForegroundColor Green
} else {
    Write-Warning "No shadow copies found. Ransomware may have deleted them or VSS is disabled."
}

# Check for recent shadow copy deletion events
$shadowDeleteEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4688; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue | Where-Object {$_.Message -like "*vssadmin*delete*shadows*" -or $_.Message -like "*wmic*shadowcopy*delete*"}
if ($shadowDeleteEvents) {
    Write-Warning "Detected $($shadowDeleteEvents.Count) shadow copy deletion attempts in last 7 days. Possible ransomware precursor."
    $shadowDeleteEvents | Select-Object TimeCreated, Message | Format-Table -AutoSize
}

# 4. Disable SMBv1 (common lateral movement vector)
Write-Host "`n[4] Checking SMBv1 Status..." -ForegroundColor Yellow
$smbv1 = Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol
if ($smbv1.EnableSMB1Protocol -eq $true) {
    Write-Warning "SMBv1 is ENABLED. Disabling now..."
    Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force
    Write-Host "SMBv1 disabled. Reboot required." -ForegroundColor Green
} else {
    Write-Host "SMBv1 is already disabled." -ForegroundColor Green
}

# 5. Enable PowerShell Script Block Logging and Module Logging (if not already enabled)
Write-Host "`n[5] Enabling PowerShell Logging..." -ForegroundColor Yellow
$psLoggingPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging"
if (-not (Test-Path $psLoggingPath)) {
    New-Item -Path $psLoggingPath -Force | Out-Null
    Set-ItemProperty -Path $psLoggingPath -Name "EnableScriptBlockLogging" -Value 1
    Write-Host "PowerShell Script Block Logging enabled." -ForegroundColor Green
} else {
    Write-Host "PowerShell Script Block Logging already configured." -ForegroundColor Green
}

Write-Host "`n[+] Hardening check complete. Review warnings above and investigate any anomalies." -ForegroundColor Cyan

Incident Response Priorities

T-minus Detection Checklist

The following indicators may precede N0N ransomware detonation. Hunt for these aggressively if your organization appears on the leak site or if you detect related TTPs:

• Initial Access: Successful authentication from unexpected geographic locations or ASNs; exploitation of perimeter VPN/firewall vulnerabilities; macro-enabled documents executed from email.
• Persistence: New scheduled tasks, services, or registry run keys created outside change-control windows.
• Credential Access: LSASS memory dumping (procdump, comsvcs.dll MiniDump); DCSync attacks (replication requests from non-DC hosts).
• Lateral Movement: PsExec service creation; WMI process execution on remote hosts; RDP connections from server-to-server (anomalous).
• Discovery: BloodHound/SharpHound execution; nltest, net group, or dsquery enumeration of domain admins.
• Collection: Use of 7zip, WinRAR, or rclone in temp/appdata directories; large archive creation on file servers or database hosts.
• Exfiltration: Outbound connections to known ransomware staging IPs; use of MEGA, Dropbox, or anonymous FTP for large data transfers.
• Impact Preparation: Shadow copy deletion (vssadmin, wmic); backup service termination; disabling of security tools via wevtutil, bcdedit, or netsh.

Critical Assets Prioritized for Exfiltration

N0N typically prioritizes the following for exfiltration before encryption:

• Financial Data: ERP databases, accounting files, payroll records.
• Customer Data: CRM exports, PII databases, e-commerce transaction logs.
• Intellectual Property: Source code repositories, CAD files, R&D documents.
• Legal/Compliance: Contracts, regulatory filings, litigation documents.
• Email Archives: Executive communications, legal correspondence.

Containment Actions (Ordered by Urgency)

1. Isolate Affected Hosts: Immediately disconnect any host showing encryption or exfiltration activity from the network. Do NOT power off (preserve forensic evidence).
2. Block C2 and Staging Infrastructure: Add known N0N C2 IPs/domains to firewall and DNS sinkhole blocklists.
3. Disable Compromised Accounts: Reset credentials for any account showing suspicious logon activity. Assume domain admin compromise if lateral movement is detected.
4. Segment Critical Assets: Isolate backup infrastructure, domain controllers, and hypervisors from the general network.
5. Activate Incident Response Plan: Engage your IR retainer, legal counsel, and cyber insurance provider. Preserve logs and volatile memory for forensic analysis.
6. Communicate with Stakeholders: Prepare internal and external communication templates. Do NOT confirm or deny the leak-site claim publicly until facts are established.
7. Monitor for Data Publication: Track the N0N leak site and negotiation portals for updates. Do NOT engage with the threat actor directly.

Hardening Recommendations

Immediate (24 Hours)

• Patch Perimeter Devices: Apply vendor patches for CVE-2026-50751 (Check Point), CVE-2026-20316 (Cisco FMC), and any other KEV-listed vulnerabilities on internet-facing systems.
• Disable Unused Services: Turn off RDP, SMBv1, and unnecessary administrative services on servers and endpoints.
• Enforce MFA: Require multi-factor authentication for all remote access (VPN, RDP, webmail) and privileged accounts.
• Review Scheduled Tasks: Audit all scheduled tasks and services for unauthorized persistence mechanisms.
• Enable Logging: Ensure PowerShell Script Block Logging, Sysmon, and Windows Event Forwarding are enabled and forwarding to your SIEM.

Short-Term (2 Weeks)

• Network Segmentation: Implement VLAN segmentation to isolate critical assets (DCs, backups, databases) from user workstations.
• EDR Deployment: Deploy or validate EDR coverage on all endpoints and servers. Ensure tamper protection is enabled.
• Backup Validation: Test restoration of backups from offline or immutable storage. Ensure backups are not accessible from production networks.
• Threat Hunting: Conduct proactive hunts for N0N TTPs using the detection rules and KQL queries provided above.
• Incident Response Retainer: If you do not have one, establish a retainer with a qualified IR provider. Time is critical during ransomware events.
• Tabletop Exercise: Run a ransomware-specific tabletop exercise with IT, security, legal, and executive teams to validate response plans.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub