Classification: TLP:CLEAR | Publication Date: 2026-10-30 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 3 New Leak-Site Listings in 72 Hours — Energy Sector Exposure, CVE Hypotheses & Detection Rules

Executive Summary

Between 2026-10-26 and 2026-10-28, the ransomware group N0N published three new victim listings on its dark web leak site, spanning Malaysia (MY), the United Arab Emirates (AE), and Spain (ES). The most sector-significant listing names Ingelectus Innovative Electrical Solutions S.L., a Spanish energy and electrical engineering firm — a claim that, if accurate, would fit the broader criminal trend of targeting energy-adjacent engineering companies as soft entry points into critical infrastructure supply chains.

Everything in this briefing is derived from threat-actor claims scraped from N0N's leak site. None of the three listings constitutes a confirmed breach. Two of the three postings were independently observed by a second leak-site crawler (confirming the gang published the claim); one appears on a single source only. Defenders should treat this bulletin as an early-warning trigger for proactive hunting and hardening — not as confirmation that any named organization has suffered an incident.

Sourcing & Verification

• 2 of 3 listings were independently observed by a second leak-site crawler (MULTI-SOURCE): the postings tagged Company #112 (MY) and Company #111 (AE). This confirms the gang made the claim; it does not confirm a breach occurred.
• 1 of 3 listings appears on ransomware.live only (SINGLE-SOURCE): Ingelectus Innovative Electrical Solutions S.L. (ES). No second crawler has corroborated that the posting even exists, so this claim carries additional uncertainty.
• Inclusion in this briefing reflects the threat actor's claim and is NOT confirmation of a breach, compromise, or incident at any named organization.
• A named organization may dispute a listing. A denial is likewise not proof the claim is false — disclosure obligations vary by jurisdiction and sector, and not every incident is reportable, so neither silence nor denial settles the question.
• Security Arsenal will publish corrections as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

N0N is an emerging ransomware operation whose public footprint is still developing. The following profile combines observed leak-site behavior with TTPs consistent across comparable mid-tier ransomware crews; where evidence is thin, we say so.

• Aliases: None confirmed at time of publication. The group brands itself as "N0N" on its leak infrastructure.
• Operating model: Current evidence is consistent with a closed or semi-closed group rather than a mature Ransomware-as-a-Service (RaaS) program. No public affiliate recruitment posts have been observed. Low victim volume (3 postings in the trailing window) is typical of small crews running intrusions in-house.
• Ransom demands: Not publicly documented for N0N specifically. Comparable emerging crews typically open in the low-to-mid six figures (USD, cryptocurrency-denominated) and scale demands to perceived victim revenue.
• Initial access methods (typical for this crew class): Internet-facing edge device exploitation (VPN concentrators, firewalls), exposed RDP with weak or brute-forced credentials, and phishing with macro- or script-based payloads. N0N's specific vector mix is unconfirmed — see the CVE hypothesis discussion below.
• Extortion model: Double extortion is standard in this tier — data theft prior to encryption, with leak-site publication used as payment leverage. N0N's leak-site activity is consistent with this model.
• Dwell time: No confirmed dwell-time data exists for N0N. Comparable crews typically operate 3–14 days from initial access to detonation, with exfiltration occurring in the final 48–72 hours. This is the window defenders must hunt in.

Current Campaign Analysis

Sectors being targeted

Two of the three listings carry no sector classification ("Not Found"), which itself is informative: unclassified victims on leak sites are frequently smaller organizations whose public profile is thin. The one classified listing — Ingelectus Innovative Electrical Solutions S.L. — falls in Energy & Utilities, the single most strategically significant sector in this set.

Geographic concentration

Three countries, three victims: Malaysia, United Arab Emirates, Spain. There is no tight geographic cluster, but the MY/AE pair is consistent with the well-documented ransomware focus on Gulf and Southeast Asian enterprises, where security maturity varies widely and incident disclosure regimes are less aggressive. The Spanish listing extends the group's reach into the EU energy supply chain.

Victim profile

With only three data points, firm conclusions are impossible — and we will not invent them. The pattern is consistent with small-to-midsize enterprises (SMEs): specialized engineering and industrial services firms in the roughly €5M–€50M revenue band that typically lack 24/7 SOC coverage, and unclassified entities likely of similar or smaller scale. SMEs in industrial sectors are attractive precisely because they hold partner and customer data (including data belonging to much larger energy operators) while running thinner defenses.

Posting frequency and escalation

Three postings in three consecutive days (2026-10-26 → 2026-10-28) suggests either a batch of intrusions reaching the extortion phase simultaneously, or deliberate drip-release for pressure. One day separates each posting — a cadence that looks staged rather than coincidental. Watch for: (a) follow-on postings against organizations in the same sectors, and (b) countdown timers or partial data dumps escalating pressure on current listings.

CVE connection — hypothesis only

We have no evidence linking any specific CVE to any specific N0N listing. What we can say is that N0N's victim profile (SMEs with internet-facing infrastructure) overlaps heavily with organizations exposed to this quarter's actively exploited, ransomware-associated vulnerabilities:

• CVE-2026-50751 (Check Point Security Gateway improper authentication, IKEv1) — edge VPN/firewall exploitation is the classic SME entry vector.
• CVE-2026-20316 (Cisco Secure FMC hard-coded password) — management-plane compromise of perimeter firewalls.
• CVE-2026-59310 (VMware vCenter path traversal) — relevant at the virtualization layer, where ransomware crews hunt for hypervisor access to maximize blast radius.
• CVE-2026-63077 (JetBrains TeamCity deserialization) — CI/CD server compromise, a growing supply-chain-adjacent vector.
• CVE-2026-48027 (Nx Console embedded malicious code) — developer tooling supply-chain exposure.

Treat these as prioritized patch targets, not attribution. If your attack surface includes any of these products, assume exposure regardless of N0N's actual vector.

Detection Engineering

The following detections target the TTP cluster typical of this crew class: edge/VPN initial access, PsExec/WMI lateral movement, pre-encryption data staging, and shadow copy destruction. Tune thresholds to your environment.

---
title: Edge VPN and Firewall Exploitation Followed by Internal Authentication Anomaly
id: 8f3a1c2e-n0n1-4a5b-9c6d-202610300001
status: experimental
description: Detects successful internal authentication from a source with recent edge-device (VPN/firewall) logon anomalies — consistent with post-exploitation pivot after CVE-2026-50751 or CVE-2026-20316 class edge compromise. Hypothesis-level detection for N0N-style intrusion chains.
author: Security Arsenal Threat Intel
logsource:
  category: authentication
  product: windows
detection:
  selection_success:
    EventID: 4624
    LogonType:
      - 3
      - 10
  selection_edge_source:
    IpAddress|contains:
      - 'vpn'
      - 'dmz'
  condition: selection_success and selection_edge_source
falsepositives:
  - Legitimate VPN user logons — baseline known VPN egress ranges and tune IpAddress matching to your edge device naming
level: high
tags:
  - attack.initial_access
  - attack.t1133
  - attack.t1190
date: 2026/10/30
---
title: PsExec or WMI Remote Service Creation Followed by Mass File Rename
id: 8f3a1c2e-n0n1-4a5b-9c6d-202610300002
status: experimental
description: Detects remote service creation (PsExec/WMI-style lateral movement, EventID 7045) correlated with suspicious service binary paths in temp/user-writable directories — a hallmark of pre-detonation ransomware staging.
author: Security Arsenal Threat Intel
logsource:
  category: process_creation
  product: windows
detection:
  selection_service:
    EventID: 7045
  selection_suspicious_path:
    ImagePath|contains:
      - '\AppData\'
      - '\Temp\'
      - '\ProgramData\'
      - '\Users\Public\'
  selection_suspicious_name:
    ServiceName|re: '^[a-zA-Z0-9]{6,10}$'
  condition: selection_service and (selection_suspicious_path or selection_suspicious_name)
falsepositives:
  - Legitimate software updaters installing services from ProgramData — whitelist known updater service names
level: critical
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1570
date: 2026/10/30
---
title: Volume Shadow Copy Deletion via vssadmin wmic or bcdedit
id: 8f3a1c2e-n0n1-4a5b-9c6d-202610300003
status: experimental
description: Detects deletion of Volume Shadow Copies or boot configuration tampering — near-universal ransomware pre-encryption behavior. High-fidelity pre-detonation tripwire.
author: Security Arsenal Threat Intel
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    CommandLine|contains:
      - 'vssadmin delete shadows'
      - 'vssadmin Delete Shadows'
      - 'wmic shadowcopy delete'
      - 'bcdedit'
      - 'wbadmin delete catalog'
      - 'diskshadow'
  filter_legit:
    CommandLine|contains:
      - 'backup exec'
      - 'veeam'
  condition: selection_vss and not filter_legit
falsepositives:
  - Rare; backup maintenance scripts — whitelist known backup tooling paths
level: critical
tags:
  - attack.impact
  - attack.t1490
date: 2026/10/30

// Hunt: pre-ransomware staging — lateral movement + data staging + shadow copy tampering
// Microsoft Sentinel | Lookback: 14 days | Recommended cadence: daily during active campaign windows
let Lookback = 14d;
let SuspiciousHosts =
    DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where ProcessCommandLine has_any ("vssadmin delete shadows", "wmic shadowcopy delete", "bcdedit", "wbadmin delete catalog")
    | summarize ShadowCopyTamper = count() by DeviceName;
let LateralMovement =
    DeviceNetworkEvents
    | where Timestamp > ago(Lookback)
    | where RemotePort in (445, 135, 3389, 5985)
    | where InitiatingProcessFileName in~ ("psexec.exe", "psexesvc.exe", "wmic.exe", "winrs.exe", "powershell.exe")
    | summarize LateralConnections = dcount(RemoteIP), LateralTargets = make_set(RemoteIP, 20) by DeviceName, InitiatingProcessFileName;
let DataStaging =
    DeviceFileEvents
    | where Timestamp > ago(Lookback)
    | where FileName endswith ".7z" or FileName endswith ".rar" or FileName endswith ".zip"
    | where FolderPath has_any ("\\Temp\\", "\\AppData\\", "\\ProgramData\\", "\\Users\\Public\\")
    | summarize ArchiveFiles = count(), ArchiveNames = make_set(FileName, 10) by DeviceName;
SuspiciousHosts
| join kind=fullouter LateralMovement on DeviceName
| join kind=fullouter DataStaging on DeviceName
| extend RiskScore = (todouble(ShadowCopyTamper) * 50) + (todouble(LateralConnections) * 10) + (todouble(ArchiveFiles) * 5)
| where RiskScore > 15
| project DeviceName, ShadowCopyTamper, LateralConnections, LateralTargets, ArchiveFiles, ArchiveNames, RiskScore
| order by RiskScore desc

# Rapid-response audit: exposed RDP, recent scheduled tasks, and shadow copy health
# Run elevated. Output written to C:\IR-Audit-<hostname>-<date>.txt
$out = "C:\IR-Audit-$env:COMPUTERNAME-$(Get-Date -Format 'yyyyMMdd-HHmm').txt"
"=== RDP EXPOSURE ===" | Out-File $out
"RDP Enabled: $((Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0)" | Out-File $out -Append
"RDP Listening Port: $((Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumber -ErrorAction SilentlyContinue).PortNumber)" | Out-File $out -Append
"NLA Required: $((Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue).UserAuthentication)" | Out-File $out -Append
"`n=== SCHEDULED TASKS CREATED/MODIFIED IN LAST 7 DAYS ===" | Out-File $out -Append
Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt (Get-Date).AddDays(-7) } |
  Select-Object TaskName, TaskPath, Date, @{N='Action';E={($_.Actions | ForEach-Object { $_.Execute }) -join '; '}} |
  Format-Table -AutoSize | Out-File $out -Append
"`n=== VOLUME SHADOW COPIES ===" | Out-File $out -Append
$shadows = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($shadows) { $shadows | Select-Object DeviceObject, InstallDate | Format-Table -AutoSize | Out-File $out -Append }
else { "WARNING: NO SHADOW COPIES FOUND — investigate for vssadmin deletion (ransomware precursor)" | Out-File $out -Append }
"`n=== RECENT FAILED RDP LOGONS (last 48h, EventID 4625) ===" | Out-File $out -Append
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddHours(-48)} -MaxEvents 500 -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'Logon Type:\s+(3|10)' } |
  Group-Object { ($_.Message -split "\n") -match 'Source Network Address' } |
  Sort-Object Count -Descending | Format-Table -AutoSize | Out-File $out -Append
Write-Host "Audit complete: $out"

Incident Response Priorities

T-minus detection checklist (before encryption fires)

• Shadow copy deletion commands (vssadmin, wmic shadowcopy, bcdedit) — highest-fidelity pre-detonation signal. Alert instantly.
• New services installed from user-writable paths (%AppData%, %Temp%, %ProgramData%) — PsExec/WMI staging.
• Mass archive creation (.7z/.rar) in temp directories or file servers — exfiltration staging, typically final 48–72 hours.
• Anomalous RDP/WinRM (445/5985) fan-out from a single workstation — lateral movement sweep.
• New scheduled tasks created within 7 days on servers that don't normally receive them.
• EDR/AV tampering events — attempts to stop, disable, or uninstall security agents.

Critical assets this crew class prioritizes for exfiltration

• File servers and NAS holding finance, HR, and legal documents — the standard double-extortion leverage set.
• Engineering/technical data: for energy-sector victims like the claimed Spanish listing, schematics, project files, and grid-adjacent documentation have outsized extortion value.
• Email archives of executives and finance staff — enables follow-on BEC and payment-fraud pressure.
• Backup infrastructure — expect deliberate targeting of backup servers and catalogs before detonation.

Containment actions, ordered by urgency

1. Isolate any host triggering shadow-copy-deletion or mass-rename alerts — network-level isolation first, power-off only if isolation is impossible (preserve volatile memory where feasible).
2. Disable the suspected initial access vector: force-reset credentials for VPN/RDP-adjacent accounts; take compromised edge devices offline and image them before remediation.
3. Kill active sessions enterprise-wide for any account observed in lateral movement — assume credential theft (treat as full domain compromise until scoped).
4. Snapshot and preserve forensic evidence: memory, prefetch, SRUM, USN journal, VPN/firewall logs (these rotate fast — export now).
5. Verify backup integrity before declaring containment — check for deletion of backup catalogs and shadow copies on backup servers specifically.
6. Engage your IR retainer and legal counsel early — do not negotiate or contact the actor directly.

Hardening Recommendations

Immediate (24 hours)

• Patch or mitigate the KEV set: CVE-2026-50751 (Check Point), CVE-2026-20316 (Cisco FMC), CVE-2026-59310 (vCenter), CVE-2026-63077 (TeamCity), CVE-2026-48027 (Nx Console). If patching is blocked, take the management interface off the internet entirely.
• Enforce MFA on all remote access — VPN, RDP gateways, and webmail. Edge-device exploitation plus credential replay is this crew class's bread and butter.
• Disable RDP exposure to the internet; require VPN + NLA + MFA for any RDP path.
• Deploy the shadow-copy-deletion Sigma rule above with instant paging — it is the cheapest high-fidelity ransomware tripwire available.
• Block macro execution from internet-sourced Office documents via Group Policy if not already done.
• Verify offline/immutable backups exist and that backup admin credentials are separate from domain credentials.

Short-term (2 weeks)

• Segment the network so workstations cannot reach server SMB/RDP/WinRM except through monitored jump paths — lateral movement via 445/3389/5985 should be architecturally impossible for user endpoints.
• Deploy LAPS or equivalent to eliminate shared local admin passwords, the accelerant for PsExec-style spread.
• Tier administrative access: no domain admin logons on workstations or member servers, ever.
• Implement application control (WDAC/AppLocker) blocking execution from user-writable directories on servers.
• Centralize edge-device logs (VPN, firewall, FMC) into your SIEM with ≥90-day retention — initial-access forensics dies when appliance logs rotate.
• For energy/utilities organizations: review third-party engineering firms' access into your environment. The claimed targeting of an electrical engineering SME is consistent with the sector pattern of using suppliers as stepping stones.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub