N0N Ransomware Gang: 3 Leak-Site Listings Across Technology and Retail — Detection Rules & Sector Exposure

Classification: TLP:CLEAR | Publication Date: 2026-09-25 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

Executive Summary

N0N has listed three organizations on its dark web leak site in the current monitoring window: TapClicks, AFRICA-TECH, and FinSoft. The listings span Technology and Retail & E-Commerce and the country codes US, ML, and UZ as coded in the source feed. These are criminal claims, not confirmed intrusions. The defensive value is in the pattern: externally reachable remote access, exposed management planes, SaaS and back-office data concentration, and pre-encryption staging remain the highest-yield hunting surfaces for organizations that resemble the listed profiles.

All three listings are single-source in the provided dataset, so defenders should treat the campaign signal as an unverified threat-actor narrative that still justifies proactive hunting. No CVE below is asserted as the initial access vector for any named organization. The KEV items are included because they are actively exploited, ransomware-associated exposure classes that align with the kinds of perimeter and management-plane weaknesses enterprise teams should close while investigating any similar claim.

Sourcing & Verification

0 of 3 listings were independently observed by a second leak-site crawler; 3 of 3 appear on a single source only. Inclusion in this briefing reflects the threat actor's claim and is not confirmation of a breach, compromise, data theft, encryption event, or active incident at any named organization.

A named organization may dispute a listing. A denial is likewise not proof that the claim is false, and silence is not proof that it is true. Disclosure obligations vary by jurisdiction, contract, regulator, materiality, and incident type, and not every incident is reportable. Neither confirmation, denial, nor silence settles the question by itself.

Security Arsenal will publish corrections when warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

Attribution-grade profile details for N0N are not present in the leak-site feed provided for this briefing. To avoid inventing actor history, the fields below are marked as observed, not observed, or defensive assumption.

• Known aliases: Not observed in the provided dataset. Treat any alias mapping as unvalidated until independent infrastructure, cryptographic, or victim-communication evidence is available.
• Operating model: Not established. The leak-site behavior is consistent with a name-and-shame extortion workflow, but the feed does not prove whether N0N is a RaaS program, a closed crew, or a rebrand.
• Typical ransom demand: Not observed. Do not benchmark negotiations from this dataset alone.
• Likely initial access methods to prioritize defensively: Defensive assumption only. For organizations resembling the listed profiles, prioritize phishing with macro or loader execution, VPN and firewall edge exploitation, RDP brute force or exposed RDP, abused remote monitoring and management tooling, and vulnerable CI/CD or virtualization management planes.
• Extortion approach: The leak-site posting pattern indicates claim-based public pressure. Double extortion is a common ransomware-ecosystem model, but theft volume, encryption success, and data authenticity are not confirmed by this feed.
• Average dwell time before detonation: Not observed. Hunt as if dwell time can range from hours for edge-device exploitation to weeks for hands-on-keyboard staging.

Current Campaign Analysis

Listed organizations and targeting pattern

• TapClicks, described in the source as a marketing analytics platform, sector Technology, country US, published 2026-09-25.
• AFRICA-TECH, described in the source as IT services and document processing, sector Technology, country ML, published 2026-09-22.
• FinSoft, described in the source as Kolibri retail back-office software, sector Retail & E-Commerce, country UZ, published 2026-09-22.

The recent victim count in the last 100 postings is 3, which is a low posting volume and should not be inflated into a large-wave claim. The useful signal is sector adjacency: analytics and marketing data platforms, IT services and document workflows, and retail back-office software all concentrate identity data, customer records, operational documents, integrations, credentials, and third-party trust relationships.

Geographic concentration

The listed country codes are US, ML, and UZ as provided. There is no defensible basis in this dataset to claim regional focus beyond those codes. Treat geography as a lead for localized credential phishing, language-specific lure review, and supplier-risk outreach rather than as proof of a regional campaign.

Victim profile and revenue estimate caution

The dataset does not provide company size, revenue, employee count, or ransom amount. Any revenue estimate would be speculative and is not included. The practical profile is mid-market to enterprise organizations with high-value data stores, customer-facing platforms, back-office dependencies, or service-provider trust relationships.

Posting frequency and escalation

Two listings were published on 2026-09-22 and one on 2026-09-25. That is a short burst rather than a sustained tempo. Escalation indicators to watch on the leak site are countdown timers, sample-data claims, proof-pack claims, repeated edits, reposting after denial, threats to contact customers, and claims involving downstream clients. None of those escalation states should be assumed unless observed.

CVE exposure relevant to sector-level hunting

The following CISA KEV items are actively exploited and have confirmed ransomware use at the ecosystem level. There is no evidence in this dataset tying any of them to TapClicks, AFRICA-TECH, FinSoft, or N0N. Treat them as sector-level exposure hypotheses and urgent patch validation targets.

• CVE-2026-59310, Broadcom VMware vCenter path traversal, added to CISA KEV 2026-08-18. Relevance: virtualization management-plane compromise can enable rapid access to many workloads and backups.
• CVE-2026-63077, JetBrains TeamCity deserialization of untrusted data, added to CISA KEV 2026-08-05. Relevance: CI/CD compromise can expose build secrets, signing keys, deployment pipelines, and downstream software trust.
• CVE-2026-20316, Cisco Secure Firewall Management Center use of hard-coded password, added to CISA KEV 2026-07-29. Relevance: firewall management-plane access can weaken perimeter enforcement and enable policy tampering.
• CVE-2026-50751, Check Point Security Gateway improper authentication in IKEv1 key exchange, added to CISA KEV 2026-06-08. Relevance: edge VPN exploitation remains a high-probability ransomware entry path.
• CVE-2026-48027, Nx Console embedded malicious code, added to CISA KEV 2026-05-27. Relevance: developer-tool supply-chain exposure can bridge build systems, workstations, and production credentials.

Detection Engineering

The detections below are behavioral controls for ransomware intrusion paths relevant to the listed sectors. They are not proof of N0N activity and should not be used to declare that any named organization was breached.

---
title: RDP Brute Force Followed By Successful Interactive Logon
id: 7f0c2f58-8fd4-4a0c-9f68-n0nrdp000001
status: experimental
description: Detects repeated failed RDP logons followed by a successful remote interactive logon from the same source. Behavioral rule for ransomware initial access hunting; not attribution to N0N.
author: Security Arsenal
date: 2026/09/25
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  product: windows
  service: security
  category: authentication
detection:
  failed_rdp:
    EventID: 4625
    LogonType: 10
    FailureReason|contains:
      - 'unknown user name'
      - 'bad password'
  successful_rdp:
    EventID: 4624
    LogonType:
      - 10
      - 7
  condition: failed_rdp and successful_rdp
falsepositives:
  - Legitimate password spray from misconfigured scanners followed by admin logon
  - Vulnerability management validation
level: high
tags:
  - attack.initial-access
  - attack.t1110
  - attack.t1021.001
---
title: Office Macro Spawns Scripting Or Download Cradle
id: 2d7f6d5a-ef30-4c58-b6ac-n0nmacro0002
status: experimental
description: Detects Office processes spawning script engines, command shells, or download-capable utilities after document execution. Behavioral rule for phishing and loader activity; not attribution to N0N.
author: Security Arsenal
date: 2026/09/25
references:
  - https://attack.mitre.org/techniques/T1204/002/
logsource:
  category: process_creation
  product: windows
detection:
  parent_office:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
  child_script:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  suspicious_cmd:
    CommandLine|contains:
      - 'http'
      - 'https'
      - 'encodedcommand'
      - 'downloadstring'
      - 'invoke-expression'
      - 'iex'
      - 'bypass'
      - 'hidden'
  condition: parent_office and child_script and suspicious_cmd
falsepositives:
  - Rare document automation in finance or marketing operations
level: high
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1059
---
title: Pre-Encryption Staging With Shadow Copy Tampering And Remote Service Execution
id: 5a1a0d65-4489-4f8e-8e8f-n0nstage0003
status: experimental
description: Detects remote execution tooling combined with backup or shadow-copy tampering and archive utility use. Behavioral rule for pre-ransomware staging; not attribution to N0N.
author: Security Arsenal
date: 2026/09/25
references:
  - https://attack.mitre.org/techniques/T1490/
logsource:
  category: process_creation
  product: windows
detection:
  remote_exec:
    Image|endswith:
      - '\psexec.exe'
      - '\wmic.exe'
      - '\wmiprvse.exe'
    CommandLine|contains:
      - 'node'
      - 'process call create'
      - '\\'
  impact_cmds:
    CommandLine|contains:
      - 'vssadmin delete shadows'
      - 'vssadmin resize shadowstorage'
      - 'bcdedit'
      - 'wbadmin delete catalog'
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
  archive_stage:
    Image|endswith:
      - '\7z.exe'
      - '\rar.exe'
      - '\tar.exe'
      - '\robocopy.exe'
      - '\rclone.exe'
      - '\megacmd.exe'
  condition: remote_exec and (impact_cmds or archive_stage)
falsepositives:
  - Backup administrators running maintenance
  - Software distribution with legitimate archive steps
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.lateral-movement
  - attack.t1021.002
  - attack.exfiltration

Hunt for lateral movement and pre-ransomware staging in Microsoft Sentinel with this query.

let lookback = 14d;
let suspicious_hosts =
  DeviceProcessEvents
  | where Timestamp >= ago(lookback)
  | where ProcessCommandLine has_any ('vssadmin delete shadows','wbadmin delete catalog','bcdedit','recoveryenabled no','bootstatuspolicy ignoreallfailures','rclone','megacmd','7z a','rar a','psexec','wmic process call create')
  | summarize StagingCommands=make_set(ProcessCommandLine, 25), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, InitiatingProcessAccountName;
let remote_logons =
  SecurityEvent
  | where TimeGenerated >= ago(lookback)
  | where EventID == 4624 and LogonType in (3,10)
  | summarize RemoteLogons=count(), Sources=make_set(IpAddress, 25) by Computer, Account;
let service_installs =
  union (
    SecurityEvent
    | where TimeGenerated >= ago(lookback)
    | where EventID in (4697,7045)
    | project TimeGenerated, Computer, Account, ServiceName=tostring(split(EventData, 'ServiceName:')[1]), Raw=EventData
  ), (
    DeviceEvents
    | where TimeGenerated >= ago(lookback)
    | where ActionType has 'ServiceInstalled'
    | project TimeGenerated, Computer=DeviceName, Account=InitiatingProcessAccountName, ServiceName=AdditionalFields, Raw=AdditionalFields
  );
suspicious_hosts
| join kind=leftouter remote_logons on $left.DeviceName == $right.Computer
| join kind=leftouter service_installs on $left.DeviceName == $right.Computer
| project DeviceName, InitiatingProcessAccountName, FirstSeen, LastSeen, StagingCommands, RemoteLogons, Sources, ServiceName, Raw
| order by LastSeen desc;

Run this read-only PowerShell triage on suspected Windows hosts and management servers. It checks RDP exposure, recent scheduled tasks, shadow-copy posture, new services, and common staging binaries without changing system state.

$ErrorActionPreference = 'SilentlyContinue'
$since = (Get-Date).AddDays(-7)
Write-Output '=== RDP exposure ==='
Get-NetTCPConnection -LocalPort 3389 -State Listen | Select-Object LocalAddress,LocalPort,State,OwningProcess | Format-Table -AutoSize
Get-CimInstance Win32_TerminalServiceSetting -Namespace root\cimv2\TerminalServices | Select-Object AllowTSConnections,SecurityLayer,UserAuthentication | Format-List

Write-Output '=== Scheduled tasks created or modified in last 7 days ==='
Get-ScheduledTask | ForEach-Object {
  $taskPath = $_.TaskPath + $_.TaskName
  $info = Get-ScheduledTaskInfo -TaskName $_.TaskName -TaskPath $_.TaskPath
  [pscustomobject]@{
    Task = $taskPath
    State = $_.State
    LastRunTime = $info.LastRunTime
    NextRunTime = $info.NextRunTime
    Author = $_.Author
    Actions = ($_.Actions | ForEach-Object { $_.Execute + ' ' + $_.Arguments }) -join ' | '
  }
} | Where-Object { $_.Actions -match 'powershell|cmd|wscript|cscript|mshta|rundll32|regsvr32|psexec|7z|rar|rclone|curl' } | Format-List

Write-Output '=== Volume Shadow Copies ==='
vssadmin list shadows
Get-CimInstance Win32_ShadowCopy | Select-Object ID,DeviceObject,InstallDate,Count | Format-Table -AutoSize

Write-Output '=== Services created in last 7 days ==='
Get-CimInstance Win32_Service | Where-Object { $_.InstallDate -and ([datetime]$_.InstallDate) -ge $since } | Select-Object Name,DisplayName,State,StartMode,PathName,InstallDate | Format-List
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=$since} | Select-Object TimeCreated,Id,Message | Format-List

Write-Output '=== Common staging and exfil utilities ==='
$paths = @('7z.exe','rar.exe','rclone.exe','megacmd.exe','psexec.exe','winscp.exe','filezilla.exe','curl.exe')
foreach ($p in $paths) { Get-Command $p | Select-Object Name,Source,Version | Format-Table -AutoSize }

Write-Output '=== Recent security log clears or tamper indicators ==='
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=1102; StartTime=$since} | Select-Object TimeCreated,Id,Message | Format-List
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Windows Defender/Operational'; StartTime=$since} | Where-Object { $_.Id -in 5001,5007,5013 } | Select-Object TimeCreated,Id,Message | Format-List

Incident Response Priorities

T-minus detection checklist: before encryption fires

• Validate all perimeter and management-plane alerts for VPN, firewall, vCenter, firewall management, CI/CD, and developer-tool estates, especially where KEV exposure exists.
• Look for password spraying against VPN and RDP, followed by a single successful logon from an unusual ASN, geography, or time window.
• Review new local administrators, new domain admins, modified GPOs, and sudden changes to backup service accounts.
• Search for Office documents spawning script engines, unsigned binaries in user-writable directories, and newly registered scheduled tasks that run as SYSTEM.
• Identify archive creation spikes, use of rclone or cloud sync tools, large uploads to unfamiliar domains, and compression of database dumps, document shares, or analytics exports.
• Alert on shadow-copy deletion, backup catalog deletion, boot recovery changes, security log clearing, EDR tamper events, and mass file rename canaries.
• Confirm backup immutability before containment actions trigger destructive response by the actor.

High-value data classes for organizations resembling the listed profiles

This is not a claim that N0N stole these data classes from any named organization. For marketing analytics, IT document processing, and retail back-office environments, prioritize discovery and protection of customer databases, identity exports, API tokens, OAuth secrets, analytics warehouses, document-management repositories, scanned records, invoices, supplier records, POS or back-office configurations, support mailboxes, build secrets, and service-provider credentials. Service providers should assume downstream client impact is the highest reputational multiplier even when a listing is unverified.

Containment actions ordered by urgency

1. Preserve evidence: capture volatile memory, authentication logs, VPN and firewall logs, EDR timelines, and leak-site screenshots before blocking infrastructure.
2. Disable suspected compromised accounts and revoke active sessions, tokens, API keys, and OAuth grants.
3. Isolate affected segments from backup networks, hypervisor management, CI/CD control planes, and identity providers.
4. Block egress to suspicious destinations while preserving DNS, proxy, and TLS inspection logs.
5. Suspend nonessential remote access, enforce phishing-resistant MFA, and rotate exposed secrets in a controlled sequence.
6. Protect backups: verify immutability, remove backup credentials from production scopes, and test restore of one critical system before broad recovery commitments.
7. Prepare external communications that distinguish a criminal claim from a confirmed breach and route legal, regulator, and customer obligations through counsel.

Hardening Recommendations

Immediate, next 24 hours

• Confirm remediation or compensating controls for CVE-2026-59310, CVE-2026-63077, CVE-2026-20316, CVE-2026-50751, and CVE-2026-48027 where present; do not wait for attribution to N0N.
• Disable internet-facing RDP or place it behind VPN with phishing-resistant MFA, account lockout, network-level authentication, and source allowlisting.
• Remove legacy IKEv1 aggressive mode where feasible, restrict firewall management interfaces to dedicated admin networks, and verify no default or hard-coded management credentials remain reachable.
• Restrict vCenter, TeamCity, firewall management, and developer consoles to tiered admin networks with just-in-time access and separate credentials.
• Block Office macros from the internet, disable mshta and wscript for standard users where possible, and enable attack surface reduction rules for Office child processes.
• Enable canary files on high-value shares, alert on shadow-copy deletion and security log clearing, and verify EDR tamper protection.
• Snapshot and isolate backup control planes; confirm immutable copies and offline credentials.

Short-term, next 2 weeks

• Implement tiered administration separating identity, endpoint, virtualization, CI/CD, firewall, and backup control planes.
• Move to phishing-resistant MFA for remote access and privileged actions; remove shared local admin credentials via LAPS or equivalent.
• Deploy egress filtering with per-host and per-service baselines; deny direct workstation-to-cloud storage unless business approved.
• Establish data-centric detection for archive creation, bulk reads, database exports, document repository bulk downloads, and abnormal API token use.
• Exercise a leak-site claim playbook: verification, legal review, customer communication decision tree, regulator matrix, and correction handling.
• Build supplier-risk reach-outs for IT services, analytics integrations, retail back-office software, and document processing dependencies so a claim against one node does not cascade silently.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub