Classification: TLP:CLEAR | Publication Date: 2026-10-19 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 32 Leak-Site Listings in Recent Posting Burst

Executive Summary

Security Arsenal's dark web monitoring has observed a concentrated posting burst on the N0N ransomware group's .onion leak site: 32 of the gang's last 100 postings occurred in the current window, with 15 listings published between 2026-10-16 and 2026-10-18 alone. Named organizations span technology, professional services, manufacturing, energy & utilities, and healthcare, across Egypt, the United States, the Netherlands, and Brazil.

Every listing in this briefing is an accusation by a criminal actor. N0N claims to have compromised these organizations. No tier in our collection confirms a breach occurred — only the named organization or its regulator can do that. Security teams in the affected sectors should treat this as a targeting-intelligence signal, not a confirmed victim list, and use the detection content below to hunt for the TTPs this group is known to use.

Notable claims in the burst include Telecom Egypt (Technology, EG), SMIC US Company (Manufacturing, US — described on the listing as the Sunnyvale, CA US arm of Semiconductor Manufacturing International Corporation), ECO USA (Energy & Utilities, US), Solid Trading B.V. (NL), Prafesta Ind. e Com. de Embalagens Ltda (Manufacturing, BR), All Business Technologies and SQA Services Inc (Professional Services), plus a run of placeholder-tagged entries ("Company #80–#91") typical of staged drip-release extortion.

Sourcing & Verification

• Corroboration: 30 of 32 recent N0N listings were independently observed by a second leak-site crawler; 2 listings appear on a single source only. Multi-source corroboration means two independent crawlers saw the gang publish the claim — nothing more.
• What inclusion means: A listing reflects the threat actor's claim. It is not confirmation of a breach, and no collection tier available to us changes that.
• Disputes and denials: A named organization may dispute a listing. A denial is likewise not proof the claim is false — disclosure obligations vary by jurisdiction and not every incident is reportable, so neither silence nor denial settles the question.
• Corrections: Security Arsenal will publish corrections and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

N0N is an extortion-focused ransomware operation tracked via its dedicated leak site on the Tor network. Key characteristics based on observed leak-site behavior and community tracking:

• Model: Operates with characteristics of a closed or semi-closed RaaS — the disciplined, templated victim postings (including numbered placeholder entries) suggest centralized leak-site management with affiliate-driven intrusions.
• Aliases: Tracked primarily as N0N; no widely adopted alternate naming in community telemetry as of this publication.
• Extortion approach: Double extortion. Victims are listed with publication countdowns; numbered placeholder entries ("Company #89", etc.) indicate the gang names victims only after negotiations stall, using staged disclosure as pressure.
• Typical ransom demands: Mid-five to low-seven figures USD based on the SMB-to-midmarket profile of most claimed victims, with higher demands reserved for large enterprises and telecom/manufacturing names.
• Initial access methods (group-level TTPs, not tied to any specific named listing): Exploitation of internet-facing remote access services (VPN concentrators, RDP), spearphishing with macro-enabled documents or malicious installers, and opportunistic use of recently disclosed perimeter CVEs.
• Dwell time: Observed pattern across comparable leak-site operations is 3–14 days from initial access to encryption, with data staging occurring in the final 48–72 hours before detonation.

Current Campaign Analysis

Sector targeting

The 32 recent listings skew toward Technology and Professional Services, with meaningful representation from Manufacturing (SMIC US Company claim; Prafesta Ind. e Com. de Embalagens Ltda claim), Energy & Utilities (ECO USA claim), and Healthcare. A large block of listings carries no sector tag ("Not Found"), consistent with the placeholder-release pattern noted above.

Geographic concentration

The claimed-victim pool concentrates in EG, US, NL, and BR. The Telecom Egypt claim is notable: telecom operators are high-leverage extortion targets due to subscriber data sensitivity and service-availability pressure. The US entries dominate the placeholder series, consistent with a US-weighted affiliate pipeline.

Victim profile

The named, sector-tagged listings span SMB professional-services firms (a bookkeeping/tax practice) through midmarket manufacturers to large enterprise/telecom names. Revenue exposure across the claimed set plausibly ranges from under $10M to $1B+ — a classic opportunistic RaaS spread where affiliates encrypt whatever their initial-access brokers deliver, then triage by ability to pay.

Posting frequency & escalation

15 listings across 2026-10-16 to 2026-10-18 is a burst pattern, not steady-state. Bursts typically indicate one of: (a) a batch of intrusions from a single access broker maturing simultaneously, (b) a negotiation-deadline cascade, or (c) a deliberate visibility push. The clustered numbered placeholders (#84–#91) support the deadline-cascade reading.

CVE exposure hypothesis (sector-level only)

We have no evidence linking any CVE to any specific named listing. However, N0N's known reliance on perimeter and remote-access exploitation makes the following CISA KEV entries (all flagged with confirmed ransomware use) relevant exposure for organizations in the targeted sectors:

• CVE-2026-59310 — Broadcom VMware vCenter path traversal (KEV 2026-08-18): hypervisor management planes are prime ransomware targets; vCenter compromise enables mass VM encryption.
• CVE-2026-20316 — Cisco Secure FMC hard-coded password (KEV 2026-07-29): firewall management plane access enables policy manipulation and lateral reach.
• CVE-2026-50751 — Check Point Security Gateway improper authentication in IKEv1 (KEV 2026-06-08): VPN gateway compromise is a textbook initial-access path for this class of actor.
• CVE-2026-63077 — JetBrains TeamCity deserialization (KEV 2026-08-05): CI/CD server compromise enables supply-chain-style payload distribution and credential harvesting.
• CVE-2026-50751 / CVE-2026-48027 — Nx Console embedded malicious code (KEV 2026-05-27): developer-workstation supply chain exposure relevant to the technology-sector targeting observed.

Organizations in technology, manufacturing, energy, and professional services should verify patch posture on all five immediately, regardless of whether they appear in any listing.

Detection Engineering

The following detections target TTPs consistent with N0N's known playbook: perimeter/VPN initial access, PsExec/WMI lateral movement, and pre-encryption data staging.

---
title: Suspicious PsExec-Style Remote Service Creation (N0N Lateral Movement)
id: 8f3a1c2e-4b7d-4e9a-b1c6-2d5f8a9e0c31
status: production
description: Detects service creation events consistent with PsExec or cloned tooling used for ransomware lateral movement and mass payload push
date: 2026/10/19
author: Security Arsenal Threat Intelligence
logsource:
  category: service_creation
  product: windows
detection:
  selection_service:
    EventID: 7045
    ServiceFileName|contains:
      - '\ADMIN$\'
      - 'PSEXESVC'
      - '\Windows\Temp\'
      - 'paexec'
      - 'remcom'
  filter_legit:
    ServiceFileName|contains:
      - 'C:\Program Files\'
  condition: selection_service and not filter_legit
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002
---
title: Pre-Ransomware Data Staging via Archive Utilities (N0N Exfil Pattern)
id: 5c2e9b41-7a3f-4d8c-9e2b-1f6a4d7c8e92
status: production
description: Detects execution of archive utilities with suspicious output paths consistent with data staging before double-extortion exfiltration
date: 2026/10/19
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\winzip.exe'
  selection_cli:
    CommandLine|contains:
      - ' a '
      - '-mx'
      - '-p'
      - '\AppData\Local\Temp\'
      - '\ProgramData\'
  filter_user:
    User|contains: 'SYSTEM'
  condition: selection_img and selection_cli and not filter_user
level: medium
tags:
  - attack.collection
  - attack.t1560.001
  - attack.exfiltration
---
title: Anomalous Authentication Burst on VPN/RDP Gateway (N0N Initial Access)
id: 2d7f4a93-6e1b-4c5d-8f3a-9b2e6c1d5a74
status: experimental
description: Detects brute-force or password-spray authentication patterns against remote access services preceding known ransomware intrusions
date: 2026/10/19
author: Security Arsenal Threat Intelligence
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4625
    LogonType:
      - 3
      - 10
  timeframe: 5m
  condition: selection | count() by IpAddress > 25
level: high
tags:
  - attack.credential_access
  - attack.t1110
  - attack.t1133

// Hunt: pre-ransomware staging + lateral movement chain (N0N-consistent TTPs)
// Looks for archive staging followed by remote service execution within 6h window
let Staging =
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where FileName in~ ("rar.exe", "7z.exe", "winrar.exe")
    | where ProcessCommandLine has_any ("AppData", "ProgramData", ".rar", ".7z")
    | project StagingTime=TimeGenerated, DeviceId, DeviceName, StagingCmd=ProcessCommandLine, AccountName;
let LateralMove =
    DeviceEvents
    | where TimeGenerated > ago(7d)
    | where ActionType == "ServiceInstalled"
    | extend ServiceName = tostring(parse_json(AdditionalFields).ServiceName),
             ServicePath = tostring(parse_json(AdditionalFields).ServiceFileName)
    | where ServicePath has_any ("ADMIN$", "PSEXESVC", "Temp")
    | project LateralTime=TimeGenerated, DeviceId, ServiceName, ServicePath;
Staging
| join kind=inner LateralMove on DeviceId
| where LateralTime between (StagingTime .. StagingTime + 6h)
| project DeviceName, AccountName, StagingTime, StagingCmd, LateralTime, ServiceName, ServicePath
| order by StagingTime asc;

# Rapid-response triage: N0N pre-encryption indicators
# Run elevated on suspect hosts. Outputs consolidated findings.

Write-Host "=== [1] Scheduled tasks created in last 7 days ===" -ForegroundColor Cyan
Get-ScheduledTask | Where-Object {
    $_.Date -gt (Get-Date).AddDays(-7)
} | Select-Object TaskName, TaskPath, Date, @{N='Action';E={$_.Actions.Execute}} | Format-Table -AutoSize

Write-Host "=== [2] Volume Shadow Copy status & recent deletions ===" -ForegroundColor Cyan
Get-WmiObject Win32_ShadowCopy | Select-Object DeviceObject, InstallDate | Format-Table -AutoSize
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7036; StartTime=(Get-Date).AddDays(-3)} -ErrorAction SilentlyContinue |
    Where-Object {$_.Message -match 'Volume Shadow Copy'} | Select-Object TimeCreated, Message

Write-Host "=== [3] Exposed RDP check ===" -ForegroundColor Cyan
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections
Write-Host "RDP Disabled flag (0 = RDP ENABLED): $($rdp.fDenyTSConnections)"
Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue |
    Select-Object LocalAddress, LocalPort, State

Write-Host "=== [4] Recent suspicious services (PsExec-style) ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
    Where-Object {$_.Message -match 'ADMIN\$|PSEXESVC|Temp|paexec'} |
    Select-Object TimeCreated, Message

Write-Host "=== [5] Large archive files created in last 72h (staging) ===" -ForegroundColor Cyan
Get-ChildItem C:\Users,C:\ProgramData -Recurse -Include *.rar,*.7z,*.zip -ErrorAction SilentlyContinue |
    Where-Object {$_.CreationTime -gt (Get-Date).AddHours(-72) -and $_.Length -gt 100MB} |
    Select-Object FullName, Length, CreationTime

Incident Response Priorities

T-minus detection checklist (before encryption fires)

1. Archive utility execution on servers — rar.exe/7z.exe on systems that never run backups is the single highest-fidelity pre-extortion signal.
2. New service installations (Event 7045) referencing ADMIN$, Temp, or randomized service names — PsExec-style lateral push.
3. vssadmin / wbadmin / bcdedit execution — shadow copy deletion typically fires 1–4 hours before detonation.
4. Anomalous outbound volume to cloud storage (MEGA, DropMeFiles, rclone endpoints) or unfamiliar VPS ASNs.
5. Mass file-renames in staging directories and enumeration of backup infrastructure (Veeam, Commvault consoles accessed by non-backup admins).
6. Disabled EDR/AV services — check Event 7036 and tamper-protection alerts fleet-wide.

Assets this class of actor prioritizes for exfiltration

• Finance and legal shares (contracts, payroll, M&A material)
• Identity stores and credential vaults (NTDS.dit, exported KeePass/AD data)
• Customer/subscriber databases — especially critical given the telecom-sector claim in this burst
• Engineering/IP repositories (source code, CAD, process documentation) — relevant to the manufacturing claims
• Backup catalogs (to target recovery capability)

Containment, ordered by urgency

1. Isolate, don't power off confirmed-compromised hosts (preserve volatile memory for forensics).
2. Disable the suspected initial-access account(s) and force enterprise-wide credential resets for any account with admin reach; assume krbtgt compromise if DC access is suspected (double-reset procedure).
3. Block known exfil destinations at egress (rclone/cloud-storage API endpoints) before pulling network cables — exfil may still be in flight.
4. Segment backup infrastructure from production immediately; verify offline/immutable copies exist and are untouched.
5. Snapshot vCenter and hypervisor state if CVE-2026-59310-class exposure is present — mass VM encryption starts there.
6. Engage IR retainer and legal counsel early; do not contact the actor without counsel involvement.

Hardening Recommendations

Immediate (24 hours)

• Patch or mitigate all five KEV CVEs listed above (vCenter, TeamCity, Cisco FMC, Check Point, Nx Console) — these are confirmed ransomware-exploited and match N0N's perimeter-access tradecraft.
• Audit internet-facing RDP and VPN gateways: enforce MFA on all remote access, disable RDP on the public internet entirely, and review VPN auth logs for spray/brute-force bursts.
• Block archive utilities (rar/7z) from executing on servers via AppLocker/WDAC where no legitimate use exists.
• Enable and alert on Volume Shadow Copy deletion attempts (vssadmin delete shadows, wmic shadowcopy delete).
• Verify backup immutability and confirm at least one copy is offline or logically air-gapped.

Short-term (2 weeks)

• Tiered administration: separate workstation, server, and identity admin tiers; eliminate standing Domain Admin logons on member servers.
• Egress filtering with TLS inspection on server VLANs — data staging to consumer cloud storage is the chokepoint for double extortion.
• Deploy canary files/hosts on file shares and backup infrastructure with high-priority alerting.
• CI/CD hardening (relevant to TeamCity/Nx exposure): isolate build servers, rotate all build-time secrets, and pin developer-tool versions to verified sources.
• Tabletop the extortion scenario: legal, comms, and executives should rehearse a leak-site claim response — including the reality that a claim may be false, exaggerated, or unverifiable.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub