Classification: TLP:CLEAR | Publication Date: 2026-10-21 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 30 Leak-Site Claims Posted — Sector Targeting Analysis & Detection Rules

Executive Summary

N0N's leak site shows 30 recent postings, with a visible burst from 2026-10-18 through 2026-10-21 and a US-heavy sample. In the provided slice, N0N has listed or claims to have compromised Xylanpicks, 51Ridge (Newark NJ hosting/IT), Vormittag Associates Inc, Froggys Fog, Hotel DuPont, Kingwood Endoscopy, The Akeeli Group, Finzly Corp, Amagi Media Labs, and several anonymized entries labeled Company #93 through Company #98. These are criminal allegations, not confirmed intrusions. The sector mix is operationally important: technology and hosting, retail and e-commerce, hospitality, healthcare, financial services and professional services all carry high-pressure payment, regulated-data or downtime leverage. Treat this as a pre-encryption warning window: prioritize edge/VPN authentication review, outbound exfiltration detection, PsExec/WMI lateral movement hunting, and shadow-copy preservation.

Sourcing & Verification

• 20 of 30 N0N listings were independently observed by a second leak-site crawler; 10 appear on a single source only.
• Inclusion reflects the threat actor's claim and is NOT confirmation of a breach, intrusion, data theft or encryption event.
• A named organization may dispute a listing; a denial is likewise not proof the claim is false. Disclosure obligations vary by jurisdiction and not every incident is reportable, so neither silence nor denial settles the question.
• No tier in this data confirms a breach. Only the organization, its counsel, insurer, regulator or law-enforcement channel can do that.
• Security Arsenal will publish corrections and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

• Aliases: none are established in the provided telemetry. Do not cluster N0N with similarly named crews without infrastructure, payload, negotiator or wallet overlap.
• Operating model: RaaS versus closed group is not established from the dataset. The numbered Company #93-#98 postings suggest batching or backlog processing, which can appear in either affiliate-driven RaaS or a small closed crew clearing access inventory.
• Ransom demands: not disclosed in the provided data. Do not estimate per-victim demand from a leak post alone.
• Initial access methods: not proven for any named organization here. Sector-level hypothesis only: edge device and remote access exploitation are consistent with the active KEV set below, while phishing, exposed RDP, stolen VPN credentials and abused managed service tooling remain common ransomware entry points.
• Extortion approach: leak-site publication implies at least name-and-shame pressure; treat as potential double extortion until data sampling, proof packs or victim statements clarify whether exfiltration is real.
• Dwell time: not measurable from posting dates. Publication date is not intrusion date and may lag access by days, weeks or months.

Current Campaign Analysis

Targeted sectors

The live data lists: Not Found, Technology, Retail & E-Commerce, Hospitality, Healthcare, Other, Financial Services and Professional Services. Named examples in the sample include 51Ridge (Newark NJ hosting/IT) and Amagi Media Labs in technology; Froggys Fog in retail and e-commerce; Hotel DuPont in hospitality; Kingwood Endoscopy in healthcare; Finzly Corp in financial services. Xylanpicks, Vormittag Associates Inc, The Akeeli Group and Company #93-#98 are listed as Not Found or Other in the provided fields.

Geographic concentration

The targeted-country field spans US, ET, TN, TT, CH, KR, EG and NL, but the visible named sample is heavily US: Xylanpicks, 51Ridge, Vormittag Associates Inc, Froggys Fog, Hotel DuPont, Kingwood Endoscopy, The Akeeli Group, Company #94, Finzly Corp, Company #93 and Amagi Media Labs are tagged US. Company #98 is tagged ET, Company #97 TN, Company #96 TT and Company #95 CH. That pattern points to US pressure-leverage with a long international tail rather than a region-exclusive operation.

Victim profile

Reliable revenue estimates cannot be derived from the listings. The defensible read is SMB-to-midmarket and department-scale enterprise targets: hosting/IT and media technology imply downstream customer leverage; retail, hospitality and healthcare imply payment or regulated data urgency; financial services and professional services imply confidentiality, wire-fraud and regulatory pressure. Anonymized numbered entries may indicate withheld identities, pending negotiation or lower-confidence proof.

Posting frequency and escalation

Fifteen representative listings cluster from 2026-10-18 to 2026-10-21, inside a broader count of 30 recent postings. A four-day run with mixed named and numbered organizations is consistent with batch publication after access triage, not necessarily four-day intrusion dwell. Watch for escalation signals: proof-pack release, countdown timers, reposting after denial, or movement from anonymized Company # entries to named listings.

CVE exposure hypothesis — not victim attribution

Do not map any CVE to a named listed organization. At sector level only, prioritize exposure review for CISA KEV items with confirmed ransomware use: CVE-2026-59310 Broadcom VMware vCenter path traversal; CVE-2026-63077 JetBrains TeamCity deserialization; CVE-2026-20316 Cisco Secure Firewall Management Center hard-coded password; CVE-2026-50751 Check Point Security Gateway improper authentication in IKEv1 key exchange; and CVE-2026-48027 Nx Console embedded malicious code. The common defensive theme is edge, virtualization management, CI/CD and security-management plane control: exactly where pre-ransomware operators want durable access before staging and detonation.

Detection Engineering

---
title: N0N hypothesis - edge or remote access anomaly before ransomware staging
id: 9f0d7a21-6b2c-4f0b-9a4a-n0nedge001
status: experimental
description: Detects suspicious authentication and management-plane access patterns consistent with ransomware operators using VPN, firewall, vCenter or CI/CD exposure. Hypothesis only; not attribution to any listed organization.
author: Security Arsenal
date: 2026/10/21
logsource:
  category: authentication
  service: remoteaccess
detection:
  selection_edge:
    EventID|contains:
      - 'successful logon'
      - 'authentication success'
    Source_Network_Address|startswith:
      - '10.'
      - '172.'
      - '192.168.'
  filter_baseline:
    User_Name|endswith: '$'
  condition: selection_edge and not filter_baseline
falsepositives:
  - managed VPN concentrators
  - approved jump hosts
level: medium
tags:
  - attack.initial_access
  - attack.t1078
  - attack.t1133
---
title: N0N hypothesis - phishing macro or office child process execution
id: 7d2a11a4-77a0-4c0c-9a77-n0nmacro002
status: experimental
description: Flags Office or browser processes spawning script interpreters, encoders or download cradles often seen before ransomware staging.
author: Security Arsenal
date: 2026/10/21
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - 'winword.exe'
      - 'excel.exe'
      - 'outlook.exe'
      - 'chrome.exe'
      - 'msedge.exe'
  selection_child:
    Image|endswith:
      - 'powershell.exe'
      - 'wscript.exe'
      - 'cscript.exe'
      - 'mshta.exe'
      - 'rundll32.exe'
      - 'curl.exe'
      - 'certutil.exe'
  condition: selection_parent and selection_child
falsepositives:
  - browser extensions
  - approved document automation
level: high
tags:
  - attack.execution
  - attack.t1059
  - attack.t1204
---
title: N0N hypothesis - lateral movement and pre-encryption cleanup
id: 4c5db9a2-91b4-4f19-8ee2-n0nlateral003
status: experimental
description: Detects PsExec or WMI remote execution combined with shadow copy deletion, backup tampering or staged archive tooling before encryption.
author: Security Arsenal
date: 2026/10/21
logsource:
  category: process_creation
  product: windows
detection:
  selection_lateral:
    CommandLine|contains:
      - 'psexec'
      - 'wmic /node'
      - 'wmiexec'
      - 'winrm quickconfig'
  selection_cleanup:
    CommandLine|contains:
      - 'vssadmin delete shadows'
      - 'wmic shadowcopy delete'
      - 'bcdedit'
      - 'wbadmin delete catalog'
  selection_stage:
    CommandLine|contains:
      - '7z a'
      - 'rar a'
      - 'robocopy'
      - 'rclone copy'
  condition: selection_lateral and 1 of selection_cleanup, selection_stage
falsepositives:
  - backup administrators
  - software distribution
level: critical
tags:
  - attack.lateral_movement
  - attack.t1021
  - attack.t1490
  - attack.t1560

let lookback = 7d;
let staging = dynamic(["vssadmin delete shadows", "wmic shadowcopy delete", "bcdedit", "wbadmin delete catalog", "psexec", "wmic /node", "rclone copy", "7z a", "rar a"]);
let remote_admin = dynamic(["psexec", "wmic", "winrm", "ssh", "rdp"]);
DeviceProcessEvents
| where Timestamp > ago(lookback)
| extend Cmd = tostring(ProcessCommandLine)
| where Cmd has_any (staging) or InitiatingProcessCommandLine has_any (remote_admin)
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Hosts=dcount(DeviceName), Samples=make_set(ProcessCommandLine, 5) by InitiatingProcessFileName, ProcessFileName, AccountName
| extend Score = iff(Hosts >= 3 and Samples matches regex @"vssadmin|shadowcopy|bcdedit|wbadmin", 100, iff(Hosts >= 3, 70, 40))
| order by Score desc, LastSeen desc;

# Rapid N0N-campaign triage: exposed remote access, suspicious command lines, tasks and shadow copies.
$ErrorActionPreference = 'SilentlyContinue'
Write-Output '== Remote access listeners =='
Get-NetTCPConnection -State Listen | Where-Object {$_.LocalPort -in 3389,5985,5986,22,443,8443} | Select-Object LocalAddress,LocalPort,OwningProcess,@{n='Process';e={(Get-Process -Id $_.OwningProcess).ProcessName}}
Write-Output '== Suspicious live command lines =='
Get-CimInstance Win32_Process | Where-Object {$_.CommandLine -match 'psexec|wmic /node|vssadmin delete shadows|shadowcopy delete|rclone copy|7z a|rar a'} | Select-Object ProcessId,Name,CommandLine,CreationDate
Write-Output '== Scheduled tasks recently run or enabled =='
Get-ScheduledTask | Where-Object {$_.State -ne 'Disabled'} | Select-Object TaskName,TaskPath,State,LastRunTime,NextRunTime | Sort-Object LastRunTime -Descending | Select-Object -First 100
Write-Output '== Volume shadow copies =='
Get-CimInstance Win32_ShadowCopy | Select-Object DeviceObject,InstallDate,VolumeName
Write-Output '== Recent outbound-heavy processes =='
Get-NetTCPConnection -State Established | Where-Object {$_.RemotePort -in 80,443,445,3389,5985} | Group-Object OwningProcess | Sort-Object Count -Descending | Select-Object -First 25 Name,Count

Incident Response Priorities

T-minus detection checklist: before encryption fires

• New or unusual VPN, IKEv1, firewall FMC, vCenter, TeamCity or CI/CD authentication, especially outside change windows.
• Office or browser process spawning PowerShell, mshta, rundll32, certutil or curl within minutes of email delivery.
• PsExec, WMI /node, WinRM, RDP or SMB admin-share use fanning from one workstation to three or more hosts.
• Archive staging: 7z, rar, robocopy or rclone against finance, HR, legal, EHR export, POS, reservation or source repositories.
• Backup interference: vssadmin delete shadows, wmic shadowcopy delete, bcdedit recovery changes, wbadmin catalog deletion, backup job disablement.
• EDR tamper, service stop loops, mass file rename entropy, ransom-note text artifacts, or simultaneous logout and lock events.

Critical assets this crew likely values for leverage

Based on listed sectors rather than confirmed victim telemetry, prioritize protection and exfiltration monitoring around identity stores, virtualization management, backup catalogs, file shares holding contracts and PHI/PCI-adjacent exports, finance and payroll databases, hotel reservation/PMS exports, retail order and customer data, healthcare imaging/endoscopy records, source code and CI/CD secrets, and managed-hosting customer credentials.

Containment actions ordered by urgency

1. Isolate suspected staging hosts from SMB, RDP and outbound internet while preserving memory and triage artifacts.
2. Disable or rotate exposed edge, VPN, firewall, vCenter, TeamCity and service accounts; revoke tokens and API keys.
3. Block outbound exfiltration to unknown storage, VPS and file-sharing destinations; alert on rare ASN and high-volume TLS.
4. Protect backups and snapshots: immutable copies offline, separate credentials, verify restore before broad shutdown.
5. Snapshot domain controllers, PKI, backup servers, hypervisor management and security tooling before aggressive cleanup.
6. If leak pressure starts, coordinate legal, comms, insurer and regulator workflows; do not validate criminal proof packs publicly.

Hardening Recommendations

Immediate — 24 hours

• Patch or mitigate KEV-exposed edge and management systems: Check Point IKEv1 improper authentication, Cisco FMC hard-coded password, VMware vCenter path traversal, JetBrains TeamCity deserialization and Nx Console malicious package exposure. If patching is blocked, isolate management interfaces and require MFA plus allow-listing.
• Enforce phishing-resistant MFA for VPN, remote access, vCenter, firewall, CI/CD and cloud consoles; disable legacy IKEv1 paths where feasible.
• Block Office child processes, script interpreters from email/browser parents, and unsigned PowerShell where operationally possible.
• Alert on vssadmin, shadowcopy, bcdedit, wbadmin, backup disablement and mass archive creation.
• Deny inbound RDP/SMB from user subnets to servers except tiered admin hosts; require just-in-time admin and dedicated PAWs.
• Turn on outbound egress filtering and TLS inspection exceptions reporting for rare destinations; baseline normal backup and replication traffic.

Short term — two weeks

• Segment identity, backup, virtualization, CI/CD and security management planes away from general user and server networks.
• Move backups to immutable, isolated, separately authenticated storage with tested restore runbooks and deletion quorum controls.
• Deploy canary shares and decoy credential objects in high-value file repositories; alert on touch, enumeration or archive attempts.
• Implement application allow-listing on servers and high-risk workstations; constrain PsExec/WMI/WinRM to approved automation accounts.
• Add data-loss and egress analytics keyed to sector data: EHR exports, PMS reservations, POS batches, finance wire files, legal matter folders and source repositories.
• Build a leak-site response playbook: claim intake, proof handling, regulator decision tree, customer notification criteria, negotiation boundaries and correction workflow.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub