Classification: TLP:CLEAR | Publication Date: 2026-10-18 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 31 Leak-Site Claims in Recent Campaign — Sector Analysis & Detection Engineering

Executive Summary

Security Arsenal's dark web monitoring has observed a sustained posting cadence from the N0N ransomware operation, with 31 claimed victims across the gang's last 100 leak-site postings and 15 listings published between 2026-10-16 and 2026-10-18 alone. The gang names organizations spanning energy & utilities, manufacturing, healthcare, professional services, and unclassified sectors across the United States, Netherlands, Brazil, and Egypt.

Critical caveat for all readers: every entry in this briefing is an unverified accusation by a criminal group. N0N claims to have compromised these organizations; none of these claims constitutes a confirmed breach. The value of this data is in understanding the gang's stated targeting priorities and preparing defenses accordingly — not in treating any named organization as an incident victim.

Sourcing & Verification

• 26 of 31 listings in the recent posting set were independently observed by a second leak-site crawler (MULTI-SOURCE), meaning two independent collection systems saw the gang publish the claim. 5 listings appear on a single source only.
• Inclusion in this briefing reflects the threat actor's claim and is NOT confirmation of a breach. No corroboration tier in our data confirms that any compromise occurred — only the named organization or its regulator can do that.
• A named organization may dispute the listing, and a denial is likewise not proof the claim is false: disclosure obligations vary by jurisdiction and sector, and not every incident is reportable. Neither silence nor denial settles the question.
• Security Arsenal will publish corrections to this briefing as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

N0N's leak site follows the standard playbook: victim name, sector tag, and country are published first, with data-dump threats escalating if the victim does not engage. The heavy proportion of anonymized listings ("Company #NN") suggests the gang uses unnamed placeholder posts as negotiation leverage — a tactic consistent with double-extortion crews that publish names only after talks stall.

Current Campaign Analysis

Sector targeting

From the 15 listings published 2026-10-16 through 2026-10-18:

• Energy & Utilities: ECO USA (US) — claimed, not confirmed
• Manufacturing: Prafesta Ind. e Com. de Embalagens Ltda (BR) — claimed, not confirmed
• Professional Services: SQA Services Inc (country undisclosed) — claimed, not confirmed
• Other: Solid Trading B.V. (NL) — claimed, not confirmed
• Unclassified ("Not Found"): Company #76–#80, #84–#86, #88–#90 (predominantly US-tagged)

The aggregate sector set across the last 100 postings includes Healthcare — organizations in that vertical should treat this campaign as directly relevant even though no healthcare entity appears in the most recent 15-post window.

Geographic concentration

The claimed victim base is heavily US-weighted, with secondary presence in the Netherlands, Brazil, and Egypt. This is a classic English-language extortion pattern: US entities face the strongest regulatory and reputational pressure and historically pay at the highest rates.

Victim profile

Named organizations (a Dutch trading firm, a Brazilian packaging manufacturer, a US energy-sector entity, a professional services firm) point to mid-market targets — organizations large enough to hold monetizable data and pay meaningful ransoms, but frequently below the security-maturity line of Fortune-500 enterprises. Estimated revenue range for this profile: roughly $10M–$500M.

Posting frequency and escalation

The observed cadence — 5 claims on 10-16, 5 on 10-17, 5 on 10-18 — is an unusually regular drip rather than a bulk dump. Two interpretations:

1. Pipeline effect: the gang is processing intrusions from an earlier access wave (possibly purchased from initial access brokers) on a steady negotiation conveyor.
2. Deliberate pacing: regular posting keeps the leak site "fresh" on monitoring services and maximizes per-victim pressure.

Either way, the pattern indicates an operation that is currently active and productive, not dormant.

CVE exposure hypothesis (sector-level, not victim attribution)

We have no evidence linking any named organization above to a specific exploited vulnerability. However, N0N's assessed initial-access pattern overlaps heavily with the following CISA KEV entries confirmed for ransomware use. Defenders in the targeted sectors should treat these as priority patch/verify items:

• CVE-2026-59310 — VMware vCenter path traversal (KEV 2026-08-18): network-accessible vCenter instances are high-value targets; compromise of the virtualization layer enables mass encryption of guest VMs — the single highest-impact ransomware scenario.
• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1) (KEV 2026-06-08): edge-VPN compromise is the canonical entry point for crews with this victimology.
• CVE-2026-20316 — Cisco Secure FMC hard-coded password (KEV 2026-07-29): management-plane takeover of the firewall estate enables both access and blind-spot creation.
• CVE-2026-63077 — JetBrains TeamCity deserialization (KEV 2026-08-05): build-server compromise enables supply-chain pivoting and credential harvesting at scale.
• CVE-2026-48027 — Nx Console embedded malicious code (KEV 2026-05-27): developer-workstation supply-chain foothold; relevant to professional-services and software-adjacent victims.

If your organization runs any of these products unpatched and sits in a targeted sector/geography, assume adversaries are probing for it.

Detection Engineering

The following content targets the TTP cluster associated with this gang's assessed playbook: edge/VPN exploitation, RDP brute force, macro-driven phishing execution, PsExec/WMI lateral movement, and pre-encryption data staging.

---
title: RDP Brute Force Followed by Successful Logon - Potential Ransomware Initial Access
id: 9f3a2c11-7b4e-4d1a-9c02-n0n000000001
status: experimental
description: Detects a burst of failed RDP authentications (Event 4625) from a single source followed by a successful logon (4624 type 10/3) to the same target within 10 minutes. Consistent with password-spray/brute-force initial access used by ransomware crews against exposed RDP.
author: Security Arsenal Threat Research
references:
  - https://securityarsenal.com/darkside
date: 2026/10/18
logsource:
  product: windows
  service: security
detection:
  selection_failed:
    EventID: 4625
    LogonType:
      - 3
      - 10
  selection_success:
    EventID: 4624
    LogonType:
      - 3
      - 10
  condition: selection_failed | count() by SourceAddress, TargetUserName >= 10
timeframe: 10m
falsepositives:
  - Service accounts with misconfigured credentials
  - Vulnerability scanners
level: high
tags:
  - attack.initial_access
  - attack.t1110
  - attack.t1133
---
title: Office Macro Spawning Scripting or LOLBin Child Process - Phishing Execution Stage
id: 9f3a2c11-7b4e-4d1a-9c02-n0n000000002
status: experimental
description: Detects Office applications spawning powershell, cmd, wscript, cscript, mshta, or rundll32 - a hallmark of macro-based phishing loaders used to stage ransomware operator tooling and Cobalt Strike beacons.
author: Security Arsenal Threat Research
references:
  - https://securityarsenal.com/darkside
date: 2026/10/18
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate Office automation add-ins
level: high
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1059
---
title: PsExec-Style Service Creation or WMI Remote Process - Lateral Movement Pre-Encryption
id: 9f3a2c11-7b4e-4d1a-9c02-n0n000000003
status: experimental
description: Detects remote service installation events (7045) with PsExec-like service names or WmiPrvSE spawning command interpreters - indicators of lateral movement during the pre-encryption staging phase observed across ransomware operations.
author: Security Arsenal Threat Research
references:
  - https://securityarsenal.com/darkside
date: 2026/10/18
logsource:
  product: windows
detection:
  selection_service:
    EventID: 7045
    ServiceName|contains:
      - 'PSEXESVC'
      - 'PAExec'
      - 'csexec'
      - 'remcom'
  selection_wmi:
    EventID: 4688
    ParentImage|endswith: '\WmiPrvSE.exe'
    NewProcessName|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\net.exe'
      - '\nltest.exe'
      - '\vssadmin.exe'
  condition: selection_service or selection_wmi
falsepositives:
  - Administrative tooling (SCCM, PDQ, legitimate PsExec use) - baseline admin hosts
level: critical
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1047
  - attack.t1569.002

// Hunt: Pre-ransomware staging - shadow copy deletion, backup tampering, and mass file renames
// Platform: Microsoft Sentinel / Defender XDR
// Lookback: 7 days
let lookback = 7d;
let ShadowCopyTamper = DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where ProcessCommandLine has_any ("vssadmin delete shadows", "vssadmin Delete Shadows",
                                        "wmic shadowcopy delete", "bcdedit", "wbadmin delete")
       or (FileName =~ "vssadmin.exe" and ProcessCommandLine has "delete")
    | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName;
let SuspiciousArchiveStaging = DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName has_any ("rclone.exe", "rclone", "7z.exe", "7za.exe", "rar.exe", "WinRAR.exe", "megasync.exe")
       or ProcessCommandLine has_any ("rclone copy", "rclone move", "--transfers", "mega.nz", "mega.io")
    | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine;
let MassRename = DeviceFileEvents
    | where TimeGenerated > ago(1d)
    | where ActionType == "FileRenamed"
    | where FileName matches regex @"\.(n0n|locked|encrypted|[a-z0-9]{6,10})$"
    | summarize RenameCount = count(), SampleExtensions = make_set(FileExtension, 10)
      by DeviceName, bin(TimeGenerated, 10m)
    | where RenameCount > 100;
union ShadowCopyTamper, SuspiciousArchiveStaging
| order by TimeGenerated desc;
// Review MassRename separately - it indicates possible ACTIVE encryption. Escalate immediately.
MassRename

# N0N Rapid Triage - run on suspect hosts / via GPO sweep
# Checks: RDP exposure, shadow copy integrity, new scheduled tasks (7d), new local admins
$days = 7
$cutoff = (Get-Date).AddDays(-$days)
$report = @()

# 1. RDP exposure
$rdpEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$nla = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue).UserAuthentication
$report += [pscustomobject]@{Check='RDP Enabled'; Result=$rdpEnabled; Detail="NLA=$(if($nla){'ON'}else{'OFF - RISK'})"}

# 2. Shadow copies still present?
$shadows = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue
$report += [pscustomobject]@{Check='Volume Shadow Copies'; Result=($null -ne $shadows -and $shadows.Count -gt 0); Detail="Count=$(@($shadows).Count)"}

# 3. Scheduled tasks created/modified in last 7 days (persistence/staging)
$tasks = Get-ScheduledTask | Where-Object { $_.Date -gt $cutoff } |
  Select-Object TaskName, TaskPath, Date, @{n='Action';a={($_.Actions | ForEach-Object Execute) -join '; '}}
$tasks | ForEach-Object { $report += [pscustomobject]@{Check='New Scheduled Task'; Result='REVIEW'; Detail="$($_.TaskPath)$($_.TaskName) -> $($_.Action)"} }

# 4. Local admins added recently
try {
  $admins = Get-LocalGroupMember -Group 'Administrators' -ErrorAction Stop
  $report += [pscustomobject]@{Check='Local Admin Membership'; Result='REVIEW'; Detail=($admins.Name -join ', ')}
} catch {}

# 5. Recent failed logons spike (4625)
$fails = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=$cutoff} -ErrorAction SilentlyContinue
$report += [pscustomobject]@{Check='Failed Logons (7d)'; Result=($fails.Count -gt 500); Detail="Count=$($fails.Count)"}

$report | Format-Table -AutoSize
$report | Export-Csv ".\n0n_triage_$(hostname)_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation

Incident Response Priorities

T-minus detection checklist (before encryption fires)

• Shadow copy / backup tampering: any execution of vssadmin delete shadows, bcdedit recovery-disabling, or backup-catalog deletion is a five-alarm pre-detonation signal.
• Staging archives: large 7z/RAR archives appearing on file servers, or rclone/megasync processes on systems that have no business running them.
• EDR/AV disabling: service-stop events targeting your security stack, especially from a single admin context across many hosts in a short window.
• Anomalous admin-tool fan-out: one account authenticating to dozens of servers via WMI/SMB/RDP within hours — classic pre-encryption push of the payload.
• vCenter anomalies: new or unusual logins to vCenter, unexpected VM power-offs, or snapshot deletions (see CVE-2026-59310 exposure above).

Assets this profile of gang prioritizes for exfiltration

• Finance and HR data: payroll, PII, tax records — maximum regulatory-leak pressure.
• Legal and contractual documents: especially for professional-services and trading firms (e.g., the claimed professional-services and trading victims in this campaign).
• OT-adjacent documentation for energy-sector targets: network diagrams, engineering schematics — high extortion leverage even if OT itself is untouched.
• Email archives of executives: used to personalize extortion and find payment-decision makers.

Containment, ordered by urgency

1. Isolate, don't power off — network-quarantine affected hosts to preserve volatile evidence.
2. Kill the access path — disable the suspected entry vector first (VPN concentrator session, compromised account, exposed RDP). Reset credentials after scoping, or you tip off the operator.
3. Protect the virtualization layer — lock down vCenter/hypervisor admin access; if that falls, containment of encryption becomes nearly impossible.
4. Snapshot backup integrity — verify offline/immutable backups are intact before engaging; assume the gang already checked.
5. Engage IR counsel and review notification obligations — sector (energy, healthcare) and geography (US states, EU/NL, Brazil LGPD) drive differing disclosure duties.

Hardening Recommendations

Immediate (24 hours)

• Patch or mitigate the five KEV CVEs above — vCenter (CVE-2026-59310), Check Point (CVE-2026-50751), Cisco FMC (CVE-2026-20316), TeamCity (CVE-2026-63077), Nx Console (CVE-2026-48027). If patching is blocked, remove the management interfaces from internet exposure entirely.
• Kill exposed RDP — VPN-only or gateway-brokered access with MFA; enable NLA; alert on >10 failed 4625s per source in 10 minutes (rule above).
• Block Office child processes via ASR rules — closes the macro-loader stage.
• Verify shadow copies and immutable backups exist and restore-test one critical system.
• Alert on rclone, vssadmin delete, and mass file renames — deploy the KQL hunt above.

Short-term (2 weeks)

• Segment the virtualization and backup planes onto dedicated management networks with jump-host-only admin access and phishing-resistant MFA (FIDO2).
• Deploy honey credentials / canary service accounts that no legitimate process uses — any authentication attempt is a high-fidelity lateral-movement alert.
• Egress filtering and DLP on bulk transfers — the double-extortion model dies without exfiltration; flag single-host sustained outbound >5GB to unsanctioned destinations.
• Tabletop the extortion scenario — including the "unnamed Company #NN listing" negotiation phase; legal, comms, and execs should rehearse a leak-site-naming decision tree before it happens.

This briefing is based on unverified threat-actor claims collected from dark web leak infrastructure. Security Arsenal does not independently confirm breaches. Named organizations may contact us at security@securityarsenal.com.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub