Classification: TLP:CLEAR | Publication Date: 2026-10-21 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 32 New Leak-Site Claims — Sector Targeting Analysis, Detection Rules & Pre-Encryption Hunt Content

Executive Summary

Leak-site monitoring on 2026-10-21 shows the N0N ransomware operation has listed 32 organizations on its dark web extortion portal across its most recent 100 postings, with a visible surge in publication tempo over the last three days (15 listings published between 2026-10-19 and 2026-10-21 alone). Named sectors include Retail & E-Commerce, Technology, Hospitality, Healthcare, Financial Services, and Professional Services, with claimed victims spanning at least eight countries: PT, US, ET, TN, TT, CH, KR, and EG.

Every listing on a ransomware leak site is an unverified claim by a criminal actor. N0N claims to have compromised these organizations; this briefing does not assert, and no tier of our data supports, that any named organization was breached. That said, the TTP toolkit associated with this campaign pattern — edge-device exploitation, credential-based access, and staged exfiltration prior to encryption — maps directly to currently exploited vulnerabilities in the CISA Known Exploited Vulnerabilities catalog. Defenders in the affected sectors should treat this as a trigger for proactive hunting, not a wait-and-see event.

Organizations publicly named by N0N in this reporting window include TheHomeMag NorCal, Xylanpicks, 51Ridge (Newark NJ hosting/IT), Vormittag Associates Inc, Froggys Fog, and Hotel DuPont, alongside a large number of anonymized placeholder listings ("Company #95"–"#103"), a pattern that typically indicates victims still inside an extortion negotiation window.

Sourcing & Verification

• Corroboration status: 22 of 32 N0N listings were independently observed by a second leak-site crawler (MULTI-SOURCE). 10 listings appear on a single source only. MULTI-SOURCE means two independent crawlers saw the gang publish the claim — it does not mean any breach is confirmed.
• Claims, not confirmations: Inclusion in this briefing reflects the threat actor's own published assertion. It is not confirmation of a breach, an intrusion, or data theft at any named organization. Only the organization itself or its regulator can confirm an incident.
• Denials and silence are both ambiguous: A named organization may dispute a listing, and a denial is likewise not proof the claim is false. Disclosure obligations vary by jurisdiction and sector, and not every incident is legally reportable. Neither silence nor denial settles the question.
• Corrections: Security Arsenal will publish corrections to this briefing as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

N0N operates as an extortion-focused ransomware crew maintaining a dedicated Tor-based leak portal where claimed victims are published with countdown timers — the classic double-extortion pattern: pay, or stolen data is released publicly.

Known characteristics of the operation based on observed leak-site behavior:

• Model: Behavior is consistent with a RaaS-style or affiliate-driven operation — high posting volume, wide sector spread, and inconsistent victim geography suggest multiple operators or affiliates working a common brand and infrastructure rather than a single tightly-scoped intrusion team.
• Aliases: No widely adopted aliases have been reliably attributed to N0N at this time; the group brands itself consistently under the "N0N" name on its portal.
• Extortion approach: Double extortion. The presence of anonymized "Company #NN" listings strongly suggests a two-stage publication model: organizations are listed under placeholders during negotiation, then named publicly (or have data released) if talks fail. Named listings like Hotel DuPont and Froggys Fog likely represent negotiations that stalled or were refused.
• Ransom demands: Not publicly standardized; demand sizing in comparable campaigns scales to victim revenue, typically ranging from low six figures for SMB retail targets to seven figures for healthcare and financial services organizations.
• Initial access methods (typical for this campaign pattern): Exploitation of internet-facing edge devices (VPN concentrators, firewalls), exposed RDP with weak or brute-forced credentials, phishing with macro- or script-based payloads, and abuse of remote management tooling. See the CVE section below for sector-level exposure hypotheses.
• Dwell time: Comparable affiliate-driven operations typically dwell 3–14 days between initial access and detonation, with exfiltration staged in the final 48–72 hours. The pre-encryption window is where detection content in this briefing is aimed.

Current Campaign Analysis

Sector Targeting

From the 32 recent listings, the distribution skews toward mid-market organizations with monetizable data and operational downtime sensitivity:

Geographic Concentration

The United States dominates named listings, but the campaign is geographically broad: PT, US, ET, TN, TT, CH, KR, EG. The presence of Ethiopia, Tunisia, Trinidad and Tobago, and Egypt in the mix is characteristic of opportunistic edge-device exploitation rather than deliberate regional targeting — affiliates scan the internet, exploit what answers, and extort whoever the victim turns out to be.

Victim Profile

Named claimed victims skew small-to-mid-market: regional retail publishers, specialty e-commerce, a regional managed hosting provider, and a boutique hospitality property. These are organizations that typically lack 24/7 SOC coverage and often run flat networks with legacy edge appliances — precisely the profile where VPN/firewall exploitation and RDP exposure succeed. Revenue estimates for this profile band range roughly from $5M to $150M annually.

Posting Frequency & Escalation

• 2026-10-19: 3 listings (including Vormittag Associates Inc, Froggys Fog, Hotel DuPont)
• 2026-10-20: 5 listings (including 51Ridge)
• 2026-10-21: 7 listings (including TheHomeMag NorCal, Xylanpicks, and five "Company #NN" placeholders)

The accelerating daily cadence, combined with a heavy placeholder-to-named ratio, indicates an active pipeline of concurrent negotiations. Expect additional named publications over the coming week as countdown timers expire.

CVE Exposure Hypotheses (Sector-Level — NOT Victim Attribution)

We have no evidence linking any specific named listing to any specific CVE. The following is sector-level exposure analysis: N0N-pattern campaigns are known to exploit internet-facing infrastructure, and the following CISA KEV entries (all confirmed as exploited by ransomware actors) represent the most plausible initial-access surface for organizations matching this campaign's victim profile:

• CVE-2026-50751 — Check Point Security Gateway Improper Authentication (IKEv1 key exchange): Edge VPN gateways are the single most common entry point in opportunistic affiliate campaigns. If you run Check Point with IKEv1 remote access enabled, treat this as an emergency patch item.
• CVE-2026-20316 — Cisco Secure Firewall Management Center hard-coded password: FMC compromise yields both initial access and visibility blind spots — attackers can suppress or alter firewall policy and logging.
• CVE-2026-59310 — Broadcom VMware vCenter path traversal: vCenter compromise is a force multiplier — attackers who control the hypervisor layer can encrypt entire virtual estates in minutes. Relevant to hosting/IT targets (e.g., the profile of 51Ridge's claimed listing).
• CVE-2026-63077 — JetBrains TeamCity deserialization: CI/CD server compromise enables supply-chain-style payload distribution and credential theft from build pipelines. Relevant to technology-sector targets.
• CVE-2026-48027 — Nx Console embedded malicious code: Developer-workstation supply chain exposure; relevant to technology-sector initial access.

Hypothesis framing: these CVEs represent the class of exposure this campaign exploits. Patch posture against all five should be verified this week regardless of whether your organization appears on any leak site.

Detection Engineering

The detection content below targets the pre-encryption playbook: edge/VPN access anomalies, macro- and script-based phishing execution, RDP brute force, lateral movement via PsExec/WMI, Cobalt Strike-style beaconing, and data staging prior to exfiltration.

---
title: N0N Campaign - Suspicious Authentication Burst on VPN/Edge Device Followed by Interactive Logon
description: Detects a burst of failed external authentication attempts followed by a successful interactive or remote interactive logon within a short window, consistent with VPN/RDP brute-force-to-access patterns used in opportunistic ransomware affiliate campaigns.
status: experimental
date: 2026/10/21
author: Security Arsenal Threat Intelligence
logsource:
  category: authentication
  product: windows
detection:
  sel_failed:
    EventID: 4625
    LogonType:
      - 3
      - 10
  sel_success:
    EventID: 4624
    LogonType:
      - 3
      - 10
  condition: sel_failed and sel_success
timeframe: 15m
level: high
tags:
  - attack.credential_access
  - attack.t1110
  - attack.t1078
falsepositives:
  - Legitimate password spray from misconfigured service accounts
  - User password expiry events
---
title: N0N Campaign - Office Macro Spawning Scripting or LOLBin Child Process
description: Detects Microsoft Office applications spawning script interpreters, PowerShell, certutil, or rundll32 - consistent with phishing macro execution chains used for initial access in ransomware campaigns.
status: experimental
date: 2026/10/21
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  sel_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
  sel_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\cmd.exe'
  condition: sel_parent and sel_child
level: critical
tags:
  - attack.execution
  - attack.t1059
  - attack.t1204.002
falsepositives:
  - Rare; legitimate Office-to-script spawning is unusual in hardened environments
---
title: N0N Campaign - PsExec or WMI Remote Execution Followed by Mass File Rename or Shadow Copy Deletion
description: Detects remote service creation or WMI process execution correlated with vssadmin/wmic shadow copy deletion or high-volume file renames - the lateral-movement-to-detonation handoff in pre-encryption ransomware staging.
status: experimental
date: 2026/10/21
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  sel_lateral:
    Image|endswith:
      - '\psexec.exe'
      - '\psexesvc.exe'
      - '\wmic.exe'
    CommandLine|contains:
      - '/node:'
      - 'process call create'
      - '\\'
  sel_staging:
    CommandLine|contains:
      - 'vssadmin delete shadows'
      - 'vssadmin.exe delete'
      - 'wmic shadowcopy delete'
      - 'bcdedit'
      - 'wbadmin delete catalog'
  condition: sel_lateral or sel_staging
level: critical
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1047
  - attack.impact
  - attack.t1490
falsepositives:
  - Legitimate administrative PsExec use by IT staff
  - Backup software manipulating shadow copies (tune to known backup process paths)

The following Microsoft Sentinel hunt query surfaces pre-ransomware staging: it correlates rare outbound data-transfer volumes with the creation of new services, scheduled tasks, or archive-utility execution on the same host within a 24-hour window — the exfiltration-staging signature seen in double-extortion campaigns like this one.

// N0N Campaign Hunt: Pre-encryption staging - archive tools + new persistence + outbound volume
let lookback = 7d;
let window = 24h;
let StagingHosts =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName in~ ("rar.exe", "7z.exe", "winrar.exe", "tar.exe", "megacmd.exe", "rclone.exe")
       or ProcessCommandLine has_any ("vssadmin delete", "shadowcopy delete", "bcdedit", "wbadmin delete")
    | summarize StagingFirstSeen = min(TimeGenerated),
                StagingCmds = make_set(ProcessCommandLine, 10)
        by DeviceId, DeviceName;
let PersistenceHosts =
    DeviceEvents
    | where TimeGenerated > ago(lookback)
    | where ActionType has_any ("ServiceInstalled", "ScheduledTaskCreated")
       or (FileName =~ "schtasks.exe" and AdditionalFields has "/create")
    | summarize PersistFirstSeen = min(TimeGenerated) by DeviceId;
let NetVolume =
    DeviceNetworkEvents
    | where TimeGenerated > ago(lookback)
    | where RemoteIPType == "Public"
    | summarize TotalBytesOut = sum(tolong(AdditionalFields.bytes_sent)),
                UniqueDestinations = dcount(RemoteIP),
                Destinations = make_set(RemoteUrl, 15)
        by DeviceId
    | where TotalBytesOut > 500000000;  // >500MB outbound to public IPs
StagingHosts
| join kind=inner PersistenceHosts on DeviceId
| join kind=inner NetVolume on DeviceId
| where PersistFirstSeen between (StagingFirstSeen .. StagingFirstSeen + window)
| project DeviceName, StagingFirstSeen, StagingCmds, PersistFirstSeen,
          TotalBytesOut, UniqueDestinations, Destinations
| order by TotalBytesOut desc;

Rapid triage script for the pre-detonation window — enumerate scheduled tasks and services created in the last 7 days, check shadow copy integrity, and flag RDP exposure. Run this on any host showing staging indicators or on internet-facing jump boxes proactively.

# N0N Rapid Triage - pre-ransomware staging audit (run elevated)
$cutoff = (Get-Date).AddDays(-7)
Write-Host "=== Scheduled tasks created/modified in last 7 days ===" -ForegroundColor Cyan
Get-ScheduledTask | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    $taskPath = (Get-Item "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree$($_.TaskPath)$($_.TaskName)" -ErrorAction SilentlyContinue)
    if ($taskPath -and $taskPath.GetValue("SD")) {
        $created = (Get-ItemProperty $taskPath.PSPath -ErrorAction SilentlyContinue).PSObject.Properties
    }
    [PSCustomObject]@{ Name = $_.TaskName; Path = $_.TaskPath; Author = $_.Author;
        Action = ($_.Actions | ForEach-Object { "$($_.Execute) $($_.Arguments)" }) -join '; ' }
} | Where-Object { $_.Action -match 'powershell|cmd|rundll32|mshta|wscript|cscript|certutil|bitsadmin' } | Format-List

Write-Host "=== Services installed in last 7 days ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=$cutoff} -ErrorAction SilentlyContinue |
    Select-Object TimeCreated, @{N='Service';E={$_.Properties[0].Value}}, @{N='Binary';E={$_.Properties[1].Value}} |
    Format-Table -AutoSize

Write-Host "=== Volume Shadow Copy status (deletion = imminent detonation indicator) ===" -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) { Write-Host "WARNING: No shadow copies present - investigate vssadmin/wmic deletion" -ForegroundColor Red }
else { $shadows | Select-Object InstallDate, VolumeName, DeviceObject | Format-Table -AutoSize }

Write-Host "=== RDP exposure check ===" -ForegroundColor Cyan
$rdpEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections).fDenyTSConnections -eq 0
$nla = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue).UserAuthentication
$rdpListen = Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue
Write-Host "RDP enabled: $rdpEnabled | NLA enforced: $($nla -eq 1) | Listening: $([bool]$rdpListen)"
if ($rdpEnabled -and $nla -ne 1) { Write-Host "ACTION: Enable NLA immediately and restrict 3389 via host firewall" -ForegroundColor Red }

Write-Host "=== Recent failed RDP/network logons (brute-force indicator) ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=$cutoff} -MaxEvents 500 -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'Logon Type:\s+(3|10)' } |
    Group-Object { ($_.Message -split "`n") -match 'Source Network Address' } |
    Sort-Object Count -Descending | Select-Object -First 10 Count, Name | Format-Table -AutoSize

Incident Response Priorities

T-Minus Detection Checklist (Before Encryption Fires)

1. Shadow copy tampering: Any vssadmin delete shadows, wmic shadowcopy delete, or bcdedit recovery-option modification on a server is a near-certain pre-detonation signal. Page the on-call IR lead immediately.
2. Archive utility execution on servers: rar.exe, 7z.exe, or rclone.exe running on file servers, domain controllers, or database hosts where IT has no documented use case = active staging.
3. New services or scheduled tasks with encoded/obfuscated payloads created within 72 hours of an edge-device authentication anomaly.
4. Outbound volume spikes: >500MB to unfamiliar public IPs or known exfil destinations (MEGA, anonymous VPS ranges, cloud storage tenants you don't use).
5. EDR/AV tampering: Service stops, driver unload attempts, or exclusion-path additions on multiple hosts in a short window.
6. Cobalt Strike-style beaconing: Periodic small-packet connections at fixed intervals (30s/60s jittered) to recently registered or low-reputation domains.

Critical Assets This Campaign Pattern Prioritizes for Exfiltration

Based on the double-extortion model and the sectors in this campaign's victim mix:

• Customer PII and payment records (retail/e-commerce and hospitality profile — the Hotel DuPont and retail listings underscore this)
• Financial documents: accounting exports, payroll, banking details (Professional Services / Financial Services leverage)
• Protected health information (healthcare-sector listings — maximum regulatory leverage)
• Hosted customer data and hypervisor images (hosting/IT profile — a single hosting provider compromise can cascade to dozens of downstream tenants)
• Legal and M&A documents (Vormittag Associates Inc listing profile — professional services firms hold concentrated third-party sensitive material)

Containment Actions — Ordered by Urgency

1. Isolate, don't power off affected hosts (network-level isolation preserves memory and volatile evidence).
2. Disable the suspected initial-access path: force-reset VPN concentrator sessions, block the source IPs, and revoke any active RDP sessions.
3. Reset credentials in blast-radius order: the accounts observed in lateral movement first, then all local admins, then domain admins if DC access is suspected.
4. Block exfil at the egress: emergency-deny outbound to staging destinations identified by the KQL hunt; enable TLS inspection alerts on unusual upload volume if not already in place.
5. Protect backups: verify offline/immutable backup integrity before broad remediation — if shadow copies are being deleted, network-attached backup infrastructure is likely targeted next.
6. Preserve the leak-site evidence: capture the listing, timestamps, and any proof-of-breach samples the gang publishes. This is essential for legal, insurance, and regulatory response.

Hardening Recommendations

Immediate (24 Hours)

• Patch or mitigate all five KEV entries listed above — especially CVE-2026-50751 (Check Point IKEv1) and CVE-2026-20316 (Cisco FMC) if those products are in your edge stack. If patching isn't possible today, disable IKEv1 remote access and restrict FMC management interfaces to a dedicated management VLAN.
• Enforce NLA and MFA on all remote access. No exceptions for service accounts or legacy applications; place exceptions behind a jump host.
• Block Office child-process spawning via Attack Surface Reduction rules ("Block all Office applications from creating child processes"). This kills the macro-to-payload chain outright.
• Alert on shadow copy deletion commands fleet-wide using the Sigma content above. This is your highest-fidelity pre-detonation tripwire.
• Verify backup immutability and test one restore. Ransomware crews actively hunt backup infrastructure during staging.

Short-Term (Two Weeks)

• Eliminate direct internet exposure of RDP and management interfaces. Move all administrative access behind a VPN with device certificate + MFA, or a ZTNA broker.
• Segment the virtual estate: isolate vCenter and hypervisor management onto a dedicated network with its own jump-host access path, given the vCenter KEV exposure.
• Deploy egress data-loss monitoring: baseline outbound volume per host and alert on >3σ deviations; block unsanctioned cloud storage and file-sharing tenants.
• Deploy a deception layer: canary file shares and honey credentials on file servers — any touch is a high-confidence staging alert with near-zero false positives.
• Tabletop the double-extortion scenario with legal, communications, and executive leadership now: decide your posture on leak-site claims, regulator notification thresholds, and media response before you're named on a portal with a countdown timer.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub