Classification: TLP:CLEAR | Publication Date: 2026-10-20 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 35 New Leak-Site Listings in 72 Hours — Cross-Sector Campaign Analysis & Detection Engineering

Executive Summary

Between 2026-10-18 and 2026-10-20, the ransomware group tracked as N0N posted 35 organizations to its dark web leak site — an aggressive burst even by current e-crime standards. The listings span eight countries (US, KR, EG, NL, CH, TN, TT, ET) and a deliberately broad sector mix: healthcare (Kingwood Endoscopy), financial services (Finzly Corp), telecommunications (Telecom Egypt), technology (Amagi Media Labs), hospitality (Hotel DuPont), retail (Froggys Fog), and professional services (Vormittag Associates Inc), alongside a large block of unlabeled listings ("Company #92–#98").

Every statement below about a named organization reflects N0N's own claim on its leak site. None of these listings constitutes a confirmed breach. This briefing is designed for two audiences: security teams at potentially exposed organizations who need detection content now, and defenders sector-wide who should treat a 35-listing burst as a signal to validate their pre-encryption detection coverage.

Key defensive takeaways:

• The posting cadence (15 listings in ~48 hours across three publishing days) suggests either a batch-detonation campaign or a backlog dump timed for negotiation pressure. Both patterns historically correlate with intrusions staged weeks earlier — meaning the window to catch pre-encryption activity in your environment may still be open.
• N0N's known tradecraft concentrates on edge-device exploitation and valid-account access. Three CVEs currently on CISA's KEV list map directly to that playbook (see Current Campaign Analysis).
• Healthcare and financial services organizations in the US should treat this as a priority signal: both sectors appear by name in the current batch.

Sourcing & Verification

This briefing is built from monitoring of N0N's .onion leak site via ransomware.live. Readers must understand exactly what this data is — and what it is not.

• Corroboration status: 28 of 35 listings in the recent posting window were independently observed by a second leak-site crawler (tagged MULTI-SOURCE above); 7 listings appear on a single source only and carry elevated uncertainty that the posting itself exists as observed.
• What corroboration means — and doesn't: MULTI-SOURCE confirms only that two independent crawlers observed the gang publish the claim. It does not confirm a breach occurred. No tier in this dataset confirms a breach — only the named organization or its regulator can do that.
• Inclusion is not accusation by Security Arsenal. Every organization named in this briefing is included because a criminal group claims to have compromised it. That claim may be exaggerated, stale, fabricated to inflate the gang's apparent throughput, or accurate. We do not know which.
• Disputes and denials: A named organization may dispute its listing. A denial is likewise not proof the claim is false — disclosure obligations vary by jurisdiction and sector, and not every incident is legally reportable. Neither silence nor denial settles the question.
• Corrections: Security Arsenal will publish corrections to this briefing as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

Aliases and tracking: N0N is tracked under its self-applied branding; no widely accepted alternate aliases have been established in public reporting. Analysts should not conflate this cluster with similarly named groups without infrastructure or payload overlap.

Operating model: N0N's victimology and posting cadence are consistent with a Ransomware-as-a-Service (RaaS) or semi-closed affiliate model — the breadth of sectors and geographies in a single 72-hour window, with no coherent vertical strategy, is characteristic of multiple affiliates working independent accesses rather than a single disciplined intrusion team. The heavy presence of unlabeled "Company #NN" listings suggests volume-driven negotiation staging, where victims are posted sequentially to pressure earlier-stage negotiations.

Ransom demands: Consistent with mid-tier RaaS operations, demands are assessed to scale with victim revenue, typically ranging from low six figures for SMB victims to seven figures for regulated-sector targets (healthcare, financial services, telecom). The inclusion of a healthcare provider (Kingwood Endoscopy), a fintech (Finzly Corp), and a national telecom (Telecom Egypt) in a single batch indicates willingness to absorb the law-enforcement attention that regulated-sector targeting brings.

Initial access methods (assessed):

1. Edge device / VPN exploitation — perimeter appliances are the gang's most probable entry vector given sector-agnostic victimology.
2. Phishing with macro- or script-based payloads — for endpoints behind patched perimeters.
3. Exposed RDP and brute-forced or purchased valid accounts — consistent with SMB-heavy listing batches.
4. Access broker purchases — batch posting patterns are a classic indicator of bought access being monetized at scale.

Extortion model: Double extortion. The leak-site-first publication pattern (listing before or alongside encryption disclosure) confirms data theft is central to the monetization strategy, not an afterthought.

Dwell time: Based on the batch-posting pattern, assessed dwell time is days to a few weeks from access to listing — shorter than mature big-game operators, consistent with affiliates running standardized tooling rather than hands-on-keyboard campaigns. This compresses the defender's detection window and elevates the value of pre-encryption behavioral detections over signature-based controls.

Current Campaign Analysis

Sector targeting

The named listings break down as follows: Technology (Amagi Media Labs; Telecom Egypt), Healthcare (Kingwood Endoscopy), Financial Services (Finzly Corp), Hospitality (Hotel DuPont), Retail & E-Commerce (Froggys Fog), Other (The Akeeli Group), Professional Services (Vormittag Associates Inc), and eight unlabeled listings (Company #92–#98). The unlabeled block dominates by count, which is typical of volume operations that withhold victim names pending negotiation.

This is opportunistic breadth, not vertical focus. Defenders should not assume their sector is safe because it isn't named — the unlabeled listings almost certainly conceal additional verticals.

Geographic concentration

The United States dominates the named listings (8 of 15), with single listings in South Korea (Company #92), Egypt (Telecom Egypt), and additional unlabeled listings tagged to Ethiopia, Tunisia, Trinidad and Tobago, Switzerland, and the Netherlands. US-centric weighting with scattered international victims again matches an affiliate model harvesting whatever access is available, not a geopolitically motivated cluster.

Victim profile

Named organizations skew toward small-to-midsize enterprises and mid-market firms — specialty retail, a boutique hotel, an ambulatory surgical center, a mid-size fintech — with Telecom Egypt as the notable large-enterprise outlier. Revenue exposure for the SMB cohort is plausibly in the $5M–$250M range; these are organizations with meaningful data but often without 24/7 SOC coverage, which is precisely the gap batch campaigns exploit.

Posting frequency and escalation

• 2026-10-18: 3 listings (Amagi Media Labs, Company #92, Telecom Egypt)
• 2026-10-19: 8 listings (Vormittag Associates Inc, Froggys Fog, Hotel DuPont, Kingwood Endoscopy, The Akeeli Group, Company #94, Finzly Corp, Company #93)
• 2026-10-20: 4 listings (Company #95–#98)

Fifteen listings in roughly 48 hours, with an escalating then sustained daily cadence. Two interpretations: (1) affiliates are detonating/monetizing a stockpile of previously staged access; (2) the gang is staging listings to maximize negotiation pressure across concurrent victims. Either way, the intrusions behind these claims likely began weeks ago — retro hunts in environments matching the victim profile are warranted now.

CVE exposure hypotheses (sector-level, NOT victim attribution)

We have no evidence linking any specific CVE to any specific listing. The following are hypothesis-level mappings between N0N's known access tradecraft and currently exploited vulnerabilities on CISA's KEV:

• CVE-2026-50751 (Check Point Security Gateway improper authentication, IKEv1) — direct match for VPN/edge access; the single highest-priority patch for this threat profile.
• CVE-2026-20316 (Cisco Secure FMC hard-coded password) — perimeter management-plane compromise enabling full firewall control.
• CVE-2026-59310 (VMware vCenter path traversal) — relevant post-access: vCenter compromise enables hypervisor-level encryption, the highest-impact ransomware detonation scenario.
• CVE-2026-63077 (JetBrains TeamCity deserialization) — build-server compromise enables supply-chain staging and credential harvesting; relevant to technology-sector targeting.
• CVE-2026-48027 (Nx Console embedded malicious code) — supply-chain precedent demonstrating developer-tooling as an access path.

Any organization running Check Point IKEv1 gateways, Cisco FMC, or internet-reachable vCenter should treat KEV remediation as a this-week action.

Detection Engineering

The following detections target N0N's assessed playbook: edge/VPN access, valid-account lateral movement, and pre-encryption data staging. Tune thresholds to environment baselines.

---
title: VPN/Edge Appliance Authentication Anomaly - Impossible Travel or Off-Hours Admin Logon
title: N0N Campaign Hunt - Edge Access
description: Detects successful VPN authentication from geographies inconsistent with the user's baseline or outside business hours for admin-tier accounts, consistent with purchased/brute-forced valid account usage.
status: experimental
author: Security Arsenal Threat Intelligence
date: 2026/10/20
logsource:
  category: authentication
  product: vpn
detection:
  selection_success:
    event.outcome: success
  selection_admin:
    user.group|contains:
      - 'admin'
      - 'administrator'
      - 'vpn-admins'
  filter_baseline_geo:
    source.country|in: '%user_baseline_countries%'
  filter_business_hours:
    event.hour|gte: 7
    event.hour|lte: 19
  condition: selection_success and selection_admin and not (filter_baseline_geo and filter_business_hours)
falsepositives:
  - Traveling executives
  - MSP after-hours maintenance windows
level: high
tags:
  - attack.initial_access
  - attack.t1078
  - attack.t1133
---
title: PsExec or Remote Service Creation Followed by Mass File Rename
description: Detects remote service installation (PsExec-style) on a host followed within 10 minutes by high-volume file rename/extension-change events — a pre-encryption staging and detonation sequence used across ransomware affiliates.
status: experimental
author: Security Arsenal Threat Intelligence
date: 2026/10/20
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec:
    - Image|endswith:
        - '\PSEXESVC.exe'
        - '\psexec.exe'
    - CommandLine|contains:
        - '\\ADMIN$'
        - '\\IPC$'
  selection_service_install:
    EventID: 7045
    ServiceFileName|contains:
      - 'ADMIN$'
      - 'AppData'
      - 'Temp'
  condition: selection_psexec or selection_service_install
falsepositives:
  - Legitimate administrative tooling (SCCM, PDQ)
  - IT remote management scripts
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002
---
title: Data Staging via Archive Utility in Non-Standard Directory
description: Detects execution of common archiving tools (rar, 7z, winzip CLI) from user-writable or temp paths — consistent with pre-exfiltration data staging observed before double-extortion leaks.
status: experimental
author: Security Arsenal Threat Intelligence
date: 2026/10/20
logsource:
  category: process_creation
  product: windows
detection:
  selection_archivers:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\7za.exe'
      - '\winzip64.exe'
  selection_suspicious_paths:
    Image|contains:
      - '\AppData\Local\Temp\'
      - '\ProgramData\'
      - '\Users\Public\'
      - '\Windows\Temp\'
  selection_compression_args:
    CommandLine|contains:
      - ' a '
      - ' -p'
      - ' u '
  condition: selection_archivers and (selection_suspicious_paths or selection_compression_args)
falsepositives:
  - Backup software
  - Software packaging teams
level: medium
tags:
  - attack.collection
  - attack.t1560.001
  - attack.exfiltration

// N0N Campaign Hunt: Pre-ransomware staging sequence —
// valid-account logon -> remote execution -> shadow copy tampering -> bulk archive creation
// Run over 14 days; pivot on the 'Host' and 'Account' outputs.
let Lookback = 14d;
let SuspiciousLogons =
    SigninLogs
    | where TimeGenerated >= ago(Lookback)
    | where ResultType == 0
    | where Location !in ("US","CA")  // tune to your org's normal geographies
    | project LogonTime=TimeGenerated, Account=UserPrincipalName, IPAddress, Location, AppDisplayName;
let RemoteExec =
    SecurityEvent
    | where TimeGenerated >= ago(Lookback)
    | where EventID == 4624 and LogonType in (3, 10)  // network / RDP
    | summarize FirstNetLogon=min(TimeGenerated) by Account, Computer, IpAddress;
let ShadowTamper =
    SecurityEvent
    | where TimeGenerated >= ago(Lookback)
    | where EventID == 4688
    | where Process has_any ("vssadmin.exe", "wmic.exe", "bcdedit.exe", "diskshadow.exe")
    | where CommandLine has_any ("delete shadows", "shadowcopy delete", "recoveryenabled no", "delete catalog -quiet")
    | project ShadowTime=TimeGenerated, Computer, Account=SubjectUserName, CommandLine;
let ArchiveStaging =
    SecurityEvent
    | where TimeGenerated >= ago(Lookback)
    | where EventID == 4688
    | where Process has_any ("rar.exe", "7z.exe", "7za.exe")
    | where CommandLine has_any (" a ", " -p")
    | project ArchiveTime=TimeGenerated, Computer, Account=SubjectUserName, CommandLine;
ShadowTamper
| join kind=inner ArchiveStaging on Computer, Account
| where abs(datetime_diff('minute', ArchiveTime, ShadowTime)) <= 120
| join kind=leftouter RemoteExec on Computer, Account
| join kind=leftouter SuspiciousLogons on $left.Account == $right.Account
| project Computer, Account, ShadowTime, ArchiveTime, CmdShadow=CommandLine, FirstNetLogon, SuspiciousLogonIP=IPAddress, SuspiciousLogonGeo=Location
| sort by ShadowTime asc;

# N0N Rapid Triage Script - run on suspect hosts or via your RMM/EDR remote shell.
# Checks: exposed RDP, scheduled tasks created in last 7 days, shadow copy state,
# recently created services, and suspicious archive utilities in temp paths.
# Requires: local admin. Output: console + C:\IR-Triage_<host>_<date>.log

$report = "C:\IR-Triage_$env:COMPUTERNAME`_$(Get-Date -Format yyyyMMdd_HHmm).log"
Start-Transcript -Path $report -Force

Write-Host "=== [1] RDP Exposure ===" -ForegroundColor Cyan
$rdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections
Write-Host "RDP Disabled flag: $rdpEnabled (0 = RDP ENABLED)"
Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue |
  Select-Object LocalAddress, LocalPort, State | Format-Table
$nla = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue).UserAuthentication
Write-Host "NLA enabled: $nla (1 = good)"

Write-Host "=== [2] Scheduled Tasks Created in Last 7 Days ===" -ForegroundColor Cyan
Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt (Get-Date).AddDays(-7) } |
  Select-Object TaskName, TaskPath, Date, @{n='Action';e={$_.Actions.Execute}} | Format-List

Write-Host "=== [3] Volume Shadow Copies ===" -ForegroundColor Cyan
$shadows = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($shadows) { $shadows | Select-Object ID, InstallDate, VolumeName | Format-Table }
else { Write-Host "WARNING: No shadow copies present - possible vssadmin deletion (pre-encryption indicator)" -ForegroundColor Red }

Write-Host "=== [4] Services Created in Last 7 Days (PsExec-style check) ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
  Select-Object TimeCreated, Message | Format-List

Write-Host "=== [5] Archive Utilities in Temp/Public Paths ===" -ForegroundColor Cyan
$paths = @("$env:TEMP","C:\Users\Public","C:\ProgramData","C:\Windows\Temp")
foreach ($p in $paths) {
  Get-ChildItem $p -Recurse -Include rar.exe,7z.exe,7za.exe -ErrorAction SilentlyContinue |
    Select-Object FullName, CreationTime, LastWriteTime
}

Write-Host "=== [6] Recent Failed Logons (brute-force check) ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
  Group-Object {$_.Properties[19].Value} | Sort-Object Count -Descending |
  Select-Object -First 10 Count, Name | Format-Table

Stop-Transcript
Write-Host "Triage complete -> $report" -ForegroundColor Green

Incident Response Priorities

T-minus detection checklist (before encryption fires)

If your organization matches the victim profile above — or if you simply want to validate coverage — hunt for this sequence, in this order:

1. Anomalous VPN/edge authentication — admin-tier logons from new geographies, new devices, or outside change windows; IKEv1 anomalies on Check Point gateways; unexpected FMC administrative sessions.
2. Discovery bursts — net group "Domain Admins", nltest /dclist, BloodHound/SharpHound artifacts (*.json in temp paths), rapid port scans from a single internal host.
3. Lateral movement — PsExec service installs (Event 7045 with ADMIN$ paths), new RDP sessions between workstations (workstation-to-workstation RDP is almost never legitimate), WMI process creation.
4. Data staging — archive utilities executing from %TEMP%, ProgramData, or Users\Public; large outbound transfers to unfamiliar cloud storage or VPS IPs; sustained egress >2x baseline from a single host.
5. Pre-detonation tampering — vssadmin delete shadows, bcdedit ... recoveryenabled no, wbadmin delete catalog, security-tool service stops, mass wevtutil cl log clearing.

Critical assets N0N historically prioritizes for exfiltration

Based on the sector mix in current listings, assume priority interest in: patient and customer PII databases (healthcare/hospitality/retail exposure), financial records and payment data (fintech/retail), HR files and payroll, legal/contracts, and executive email archives. Telecom targeting implies interest in subscriber records and network configuration data — exfiltration of which creates regulatory exposure well beyond the ransom.

Containment actions, ordered by urgency

1. Isolate, don't power off suspect hosts — preserve memory for forensic scoping; VLAN quarantine via NAC/EDR network isolation.
2. Disable the suspected compromised accounts and force global credential resets for any account observed in lateral movement — include service accounts.
3. Block egress at the perimeter to known exfil destinations; if staging is confirmed, temporarily restrict outbound cloud-storage categories.
4. Snapshot and isolate backup infrastructure immediately — verify backup control plane has not been touched; rotate backup admin credentials.
5. Patch/segment edge devices named in the KEV list; if a Check Point gateway or FMC is suspect, treat all credentials traversing it as compromised.
6. Engage IR retainer and counsel before any negotiation contact — leak-site publication starts a regulatory and legal clock regardless of whether encryption has fired.

Hardening Recommendations

Immediate (24 hours)

• Patch or mitigate CVE-2026-50751 (Check Point IKEv1) and CVE-2026-20316 (Cisco FMC) — these are the highest-probability edge access paths for this threat profile. If patching is not possible today, disable IKEv1Aggressive Mode / restrict management interfaces to trusted networks.
• Patch CVE-2026-59310 (vCenter) and confirm vCenter is not internet-reachable. Audit CVE-2026-63077 (TeamCity) exposure for any build infrastructure.
• Enforce phishing-resistant MFA on all remote access — VPN, RDP gateways, VDI — no exceptions for service or break-glass accounts without compensating controls.
• Deploy the Sigma rules and KQL query above; run the triage script against any host with anomalous authentication in the last 14 days.
• Verify shadow copies exist and backup immutability is actually enabled — test one restore.
• Alert on workstation-to-workstation RDP/SMB and any archive utility execution outside approved software inventory.

Short-term (2 weeks)

• Segment hypervisor and backup management planes onto dedicated networks with jump-host-only access; hypervisor-level encryption is the worst-case detonation and must require crossing a monitored chokepoint.
• Eliminate standing edge-device admin access — move firewall/VPN administration behind privileged access workstations with session recording.
• Deploy deception credentials and honey shares in directories affiliates commonly stage from (ProgramData, file server roots); ransomware actors touch these reliably.
• Implement egress filtering with category blocking for consumer cloud storage and newly registered domains; double extortion dies without exfil paths.
• Establish detection coverage for the T-minus sequence as a single correlated analytic (logon anomaly → lateral movement → shadow tampering) rather than isolated alerts — the value is in the chain.
• Conduct a tabletop against the leak-site scenario: your organization appears on a dark web leak site on a Friday night. Who verifies, who communicates, who decides on engagement? The batch-posting pattern means you may have hours, not days.

Security Arsenal monitors ransomware leak sites continuously. If your organization appears in a listing referenced in this briefing, or if you have information that corrects or contextualizes any claim above, contact us at security@securityarsenal.com.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub