Classification: TLP:CLEAR | Publication Date: 2026-10-22 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 31 New Leak-Site Listings in a Week — Sector Targeting Analysis & Detection Rules

Executive Summary

Between 2026-10-19 and 2026-10-21, the ransomware group N0N listed 31 organizations on its dark web leak site, according to ransomware.live monitoring. The claimed victims span retail & e-commerce, technology, hospitality, healthcare, financial services, and professional services, with geographic concentration in the United States and Portugal and additional claimed victims in Ethiopia, Tunisia, Trinidad & Tobago, Switzerland, South Korea, and Egypt.

Every listing below is an unverified claim by a criminal actor. None of these postings confirm that a breach occurred. However, the volume and pacing — five or more postings per day across three consecutive days — indicate an active, escalating campaign. Organizations in the targeted sectors should treat this as a signal to validate perimeter exposure, review the CISA KEV vulnerabilities associated with ransomware operations, and run the detection content in this briefing.

Named organizations N0N claims to have compromised include TheHomeMag NorCal, Xylanpicks, 51Ridge (Newark NJ hosting/IT), Vormittag Associates Inc, Froggys Fog, and Hotel DuPont, alongside 25 anonymized entries ("Company #95" through "Company #103") spanning Portugal, Ethiopia, Tunisia, Trinidad & Tobago, and Switzerland.

Sourcing & Verification

• 14 of 31 listings were independently observed by a second leak-site crawler (MULTI-SOURCE). 17 of 31 listings appear on a single source only (SINGLE-SOURCE) and have not been corroborated as even existing on the gang's site by an independent observer.
• MULTI-SOURCE corroboration means two independent crawlers observed the gang post the claim. It does not mean the breach is confirmed. Inclusion in this briefing reflects the threat actor's claim only — it is not confirmation of a breach for any named organization.
• A named organization may dispute the listing. A denial is likewise not proof the claim is false: disclosure obligations vary by jurisdiction and sector, and not every incident is reportable. Neither silence nor denial settles the question. Only the organization itself or its regulator can confirm or refute an incident.
• Security Arsenal will publish corrections as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

Public reporting on N0N remains limited, and the following profile should be read as our current assessment with explicit confidence caveats rather than settled attribution.

• Aliases: No widely corroborated aliases have been established. The group brands itself simply as "N0N" on its leak site.
• Operating model: The high posting cadence (31 listings in roughly a week) is consistent with a Ransomware-as-a-Service (RaaS) or affiliate-driven model, where multiple operators push victims to a shared leak site. This has not been confirmed; a small, highly active closed group could produce similar output during a burst.
• Ransom demands: No reliable public dataset of N0N demands exists. Based on the victim profile (predominantly small-to-midsize businesses), demands are likely in the low-to-mid six-figure USD range, typical for SMB-focused operations. This is inference, not observed data.
• Initial access methods: Sector-typical vectors for groups with this victim profile include exploitation of perimeter appliances (VPN/firewall), phishing with macro- or script-based payloads, exposed RDP, and compromised managed/hosting providers. Notably, N0N claims to have compromised 51Ridge, a Newark NJ hosting/IT provider — a claim that, if accurate, would be consistent with a supply-chain pivot into downstream customers.
• Extortion approach: The leak-site model implies double extortion — data theft threatened alongside encryption. Whether N0N routinely exfiltrates before encryption is unconfirmed.
• Dwell time: Unknown for this group specifically. Sector-wide medians for similar operations run 5–11 days from initial access to detonation; defenders should assume the low end.

Current Campaign Analysis

Sector Targeting

The 31 claimed victims break down across: retail & e-commerce (TheHomeMag NorCal, Froggys Fog), technology/hosting (51Ridge), hospitality (Hotel DuPont), plus claimed healthcare, financial services, and professional services victims among the sector-tagged aggregate. The heavy presence of "Not Found" sector tags (anonymized companies) suggests N0N is deliberately withholding victim identities — a common pressure tactic mid-negotiation.

Geographic Concentration

The United States dominates named claims (6 of 7 named organizations), with Portugal appearing repeatedly among anonymized listings. Single claims touch Ethiopia, Tunisia, Trinidad & Tobago, Switzerland, South Korea, and Egypt — a broad spray consistent with opportunistic scanning rather than deliberate regional targeting.

Victim Profile

The named organizations are predominantly small-to-midsize businesses — regional media/publishing, specialty retail, a boutique hotel, and a regional hosting provider. Estimated revenues for this profile typically fall in the $1M–$50M range: organizations large enough to pay, often too small for mature security operations. The hosting/IT provider claim (51Ridge) is the outlier and the most strategically significant listing in the set.

Posting Frequency & Escalation

N0N posted at least 15 listings across three consecutive days (2026-10-19 through 2026-10-21), with 10+ on the final day. This burst pattern typically indicates one of three things: (1) a batch of intrusions from a single successful access vector reaching extortion stage simultaneously; (2) a new affiliate onboarding with pre-existing access; or (3) negotiation deadlines expiring in bulk. Defenders in targeted sectors should assume (1) until disproven.

Potential CVE Linkage (Hypothesis Only)

We have no evidence linking any specific named victim to a specific CVE. That said, N0N's SMB-heavy, US-and-Europe victim profile overlaps with the installed base of several vulnerabilities on CISA's Known Exploited Vulnerabilities catalog with confirmed ransomware use:

• CVE-2026-59310 (VMware vCenter path traversal) — SMBs running vCenter with management interfaces reachable from compromised segments are prime targets for hypervisor-level encryption.
• CVE-2026-20316 (Cisco Secure FMC hard-coded password) — perimeter management plane exposure is a classic initial access route for groups hitting SMBs.
• CVE-2026-50751 (Check Point Security Gateway improper authentication, IKEv1) — VPN gateway compromise fits the geographic spray pattern.
• CVE-2026-63077 (JetBrains TeamCity deserialization) — relevant if the hosting/IT provider claim reflects a build-pipeline compromise, which would also explain supply-chain reach.
• CVE-2026-48027 (Nx Console embedded malicious code) — a supply-chain/developer-tooling vector consistent with technology-sector targeting.

Treat these as sector-level exposure hypotheses to patch against, not as established intrusion paths for any named organization.

Detection Engineering

The following detection content targets TTPs consistent with N0N's profile: perimeter appliance exploitation, phishing payload execution, RDP abuse, PsExec/WMI lateral movement, and pre-encryption data staging.

---
title: Suspicious Process Spawned from VPN/Firewall Management Interface Session
description: Detects shell or scripting processes spawned on or immediately after authentication to perimeter management interfaces (Cisco FMC, Check Point), consistent with post-exploitation of appliances like CVE-2026-20316 or CVE-2026-50751
status: experimental
author: Security Arsenal Threat Intel
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\winlogon.exe'
      - '\svchost.exe'
  selection_image:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  selection_user:
    User|contains:
      - 'vpn'
      - 'fwadmin'
      - 'netadmin'
  condition: selection_parent and selection_image and selection_user
falsepositives:
  - Legitimate network administration workflows
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t1133
date: 2026/10/22
---
title: Office Macro Spawning Scripting or LOLBin Child Process
description: Detects Office applications spawning script interpreters, consistent with phishing-macro initial access used by SMB-targeting ransomware operations
status: experimental
author: Security Arsenal Threat Intel
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\outlook.exe'
      - '\powerpnt.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate macro-driven automation
level: critical
tags:
  - attack.initial_access
  - attack.t1566.001
  - attack.t1059
date: 2026/10/22
---
title: Pre-Encryption Staging - Shadow Copy Deletion or Mass Archive Creation
description: Detects Volume Shadow Copy deletion and mass compression utilities executed shortly before ransomware detonation, plus PsExec-style remote service execution for lateral movement
status: experimental
author: Security Arsenal Threat Intel
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
  selection_archive:
    Image|endswith:
      - '\7z.exe'
      - '\rar.exe'
      - '\winrar.exe'
    CommandLine|contains:
      - ' a '
      - ' -p'
  selection_psexec:
    Image|endswith:
      - '\psexec.exe'
      - '\psexesvc.exe'
      - '\paexec.exe'
  condition: 1 of selection_*
falsepositives:
  - Backup administrators using vssadmin
  - Legitimate software packaging with 7zip
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.t1560.001
  - attack.lateral_movement
  - attack.t1569.002
date: 2026/10/22

The following KQL query hunts for pre-ransomware staging behavior in Microsoft Sentinel: rapid sequences of remote service creation (PsExec/WMI pattern) followed by shadow copy tampering — the classic "quiet before detonation" window.

// Hunt: Lateral movement followed by shadow copy tampering within 4 hours
// Targets pre-encryption staging consistent with N0N-profile ransomware ops
let lookback = 7d;
let lateralWindow = 4h;
let LateralEvents =
    DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where FileName in~ ("psexec.exe", "psexesvc.exe", "paexec.exe", "wmic.exe")
       or (FileName =~ "sc.exe" and ProcessCommandLine has_any ("create", "start") and ProcessCommandLine has "\\\\")
       or (FileName =~ "wmic.exe" and ProcessCommandLine has "process call create")
    | project LateralTime=Timestamp, DeviceName, LateralCmd=ProcessCommandLine, AccountName, LateralFile=FileName;
let TamperEvents =
    DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where (FileName =~ "vssadmin.exe" and ProcessCommandLine has "delete shadows")
       or (FileName =~ "bcdedit.exe" and ProcessCommandLine has_any ("recoveryenabled", "bootstatuspolicy"))
       or (FileName =~ "wbadmin.exe" and ProcessCommandLine has "delete")
    | project TamperTime=Timestamp, DeviceName, TamperCmd=ProcessCommandLine;
LateralEvents
| join kind=inner TamperEvents on DeviceName
| where TamperTime between (LateralTime .. (LateralTime + lateralWindow))
| project DeviceName, AccountName, LateralTime, LateralFile, LateralCmd, TamperTime, TamperCmd
| order by DeviceName, LateralTime asc

The following PowerShell script provides rapid-response triage for a host suspected of being in the pre-detonation window: it enumerates scheduled tasks created in the last 7 days, checks Volume Shadow Copy health, and flags recently created local administrator accounts.

# Security Arsenal - Rapid Ransomware Pre-Detonation Triage
# Run elevated on any host flagged by the Sigma/KQL content above.
$cutoff = (Get-Date).AddDays(-7)
Write-Output "=== [1] Scheduled Tasks Created Since $cutoff ==="
Get-ScheduledTask | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    $xml = Export-ScheduledTask -TaskName $_.TaskName -TaskPath $_.TaskPath -ErrorAction SilentlyContinue
    if ($xml -match '<Date>([^<]+)</Date>') {
        $created = [datetime]$Matches[1]
        if ($created -gt $cutoff) {
            [PSCustomObject]@{ Task="$($_.TaskPath)$($_.TaskName)"; Created=$created; State=$_.State }
        }
    }
} | Format-Table -AutoSize

Write-Output "=== [2] Volume Shadow Copy Status ==="
$shadows = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) { Write-Output "WARNING: No shadow copies found - possible vssadmin deletion (T1490)" }
else { $shadows | Select-Object DeviceObject, InstallDate | Format-Table -AutoSize }

Write-Output "=== [3] Local Admin Accounts Created Since $cutoff ==="
Get-LocalGroupMember -Group "Administrators" -ErrorAction SilentlyContinue | ForEach-Object {
    $name = $_.Name.Split('\')[-1]
    $u = Get-LocalUser -Name $name -ErrorAction SilentlyContinue
    if ($u -and $u.PasswordLastSet -gt $cutoff) {
        [PSCustomObject]@{ Account=$_.Name; PasswordLastSet=$u.PasswordLastSet; Enabled=$u.Enabled }
    }
} | Format-Table -AutoSize

Write-Output "=== [4] RDP Exposure Check ==="
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue
$port = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumber -ErrorAction SilentlyContinue).PortNumber
Write-Output ("RDP Enabled: " + $(if ($rdp.fDenyTSConnections -eq 0) {"YES - Port $port"} else {"No"}))
Get-NetFirewallRule -DisplayGroup "Remote Desktop" -ErrorAction SilentlyContinue |
    Where-Object Enabled -eq 'True' | Select-Object DisplayName, Profile, Action | Format-Table -AutoSize

Incident Response Priorities

T-Minus Detection Checklist (Before Encryption Fires)

• Authentication anomalies on perimeter appliances: logins to Cisco FMC, Check Point gateways, or vCenter from unusual source IPs or at unusual hours — especially new admin sessions following the KEV disclosures above.
• Mass archive creation: 7z/RAR processes with password flags touching file shares; watch for archive sizes in the hundreds of MB.
• Staging directories: unexpected folders at drive roots (C:\staging, C:\temp\ex, user profile roots) accumulating copied documents.
• PsExec/WMI fan-out: one host spawning remote service creation across many targets in a short window — the loudest pre-detonation signal.
• Shadow copy and backup tampering: vssadmin delete shadows, bcdedit recovery-disable commands, backup job deletions or failures.
• Security tool disablement: EDR service stop attempts, Defender exclusion additions, or tamper-protection events.

Exfiltration Priorities to Assume

Based on the SMB-focused double-extortion pattern, assume the operator prioritizes: financial records and payroll data, customer databases, contracts and legal documents, and HR/PII stores — the data classes that maximize negotiation leverage against mid-market firms. For the hospitality claim (Hotel DuPont), guest PII and payment data would be the highest-value target class.

Containment Actions by Urgency

1. Isolate, don't power off any host showing shadow-copy tampering or mass-encryption behavior — volatile memory holds key material and actor tooling.
2. Disable compromised or suspect accounts immediately, including service accounts seen in lateral movement telemetry; force enterprise-wide credential resets for anything that touched an affected host.
3. Block egress to unknown cloud storage and file-sharing endpoints at the proxy/firewall to cut off active exfiltration.
4. Snapshot hypervisors and preserve logs from VPN/firewall appliances before retention windows expire — these are the first logs affiliates try to clear.
5. Verify backup integrity offline before declaring any system clean; assume backup infrastructure was enumerated.

Hardening Recommendations

Immediate (24 hours)

• Patch or mitigate the KEV set: CVE-2026-59310 (vCenter), CVE-2026-20316 (Cisco FMC), CVE-2026-50751 (Check Point IKEv1), CVE-2026-63077 (TeamCity), CVE-2026-48027 (Nx Console). If patching is impossible, remove management interfaces from any untrusted network path.
• Audit RDP and VPN exposure: no RDP directly internet-facing; VPN concentrators patched and behind MFA.
• Deploy the Sigma rules above and run the KQL hunt retroactively over the past 14 days.
• Block Office macros from the internet via Mark-of-the-Web policy; alert on Office spawning script interpreters.
• Verify shadow copies and offline backups exist and are restorable — today, not during an incident.

Short-Term (2 weeks)

• Segment management planes: vCenter, firewall management, and backup consoles on isolated networks with jump-host-only access.
• Implement tiered administration so a single compromised workstation credential cannot reach hypervisor or backup control planes.
• Deploy application control (WDAC/AppLocker) blocking 7z/RAR and unsigned binaries outside approved paths on servers.
• Egress filtering with allowlisting for server VLANs — servers should not be able to reach arbitrary cloud storage.
• Vendor/supply-chain review: if you rely on small regional hosting or IT providers, validate their patch posture against the KEV list — N0N's claimed hosting-provider victim illustrates why.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub