Classification: TLP:CLEAR | Publication Date: 2026-10-19 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 36 Leak-Site Listings in Latest Posting Wave — Sector Analysis & Detection Engineering

Executive Summary

Between 2026-10-17 and 2026-10-19, the ransomware group tracked as N0N published 36 new listings on its dark web leak site, naming organizations across Financial Services, Technology, Professional Services, Manufacturing, Energy & Utilities, and Healthcare, with a geographic concentration in the United States and secondary claims touching South Korea, Egypt, the Netherlands, and Brazil.

Every listing on a ransomware leak site is an unverified accusation made by a criminal actor. N0N claims to have compromised these organizations — nothing in this data confirms a breach occurred. Named organizations include Finzly Corp, Amagi Media Labs, Telecom Egypt, SMIC US Company, Solid Trading B.V., and ECO USA, alongside a bookkeeping/tax practice listed as All Business Technologies (Fox Hill), SQA Services Inc, and numerous placeholder entries ("Company #86–#93") that N0N uses for victims it has not yet publicly identified — a common pressure tactic.

Security teams in the named sectors should treat this as a threat-actor capability and tempo signal, not as confirmation of any specific incident, and should use the detection engineering content below to hunt for the TTPs this group is known to employ.

Sourcing & Verification

This briefing is built from leak-site monitoring via ransomware.live. Readers must understand the verification tiers before acting on any name in this report:

• 30 of 36 listings were independently observed by a second leak-site crawler (multi-source). This means two independent collection systems saw N0N post the claim — it confirms the posting exists, not that the breach is real.
• 6 of 36 listings (including Finzly Corp, Amagi Media Labs, and "Company #92/#93") appear on a single source only, with no second-crawler confirmation that the posting even exists on the gang's site.
• No tier in this data confirms a breach. Inclusion in this briefing reflects the threat actor's claim only. Only the named organization or its regulator can confirm an incident.
• A named organization may dispute the listing. A denial is likewise not proof the claim is false — disclosure obligations vary by jurisdiction and sector, and not every incident is reportable. Neither silence nor denial settles the question.
• Security Arsenal will publish corrections as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

The use of numbered placeholder victims ("Company #86" through "#93") is a deliberate pressure mechanism: the gang signals it holds data on unnamed organizations and threatens to identify them if negotiations fail. Defenders should assume at least some placeholders correspond to real claimed victims in the US and South Korea.

Current Campaign Analysis

Sector Targeting

From the last 100 postings (36 recent listings analyzed):

• Financial Services — Finzly Corp (US, single-source claim). Payment/fintech infrastructure is a high-pressure extortion target.
• Technology — Amagi Media Labs (US, single-source) and Telecom Egypt (EG, multi-source). Telecom claims carry national-infrastructure sensitivity.
• Manufacturing — SMIC US Company (Sunnyvale, CA — multi-source). Semiconductor supply-chain claims warrant heightened scrutiny given downstream exposure.
• Professional Services — All Business Technologies (Fox Hill bookkeeping and tax practice) and SQA Services Inc (both multi-source). Tax/bookkeeping practices hold concentrated PII and financial records — classic double-extortion leverage.
• Energy & Utilities — ECO USA (US, multi-source).
• Not Found / Placeholder — 8+ numbered entries, predominantly US-tagged, one KR-tagged.

Geographic Concentration

The United States dominates the victim list, with single listings attributed to South Korea, Egypt, the Netherlands, and Brazil. This US-heavy distribution is consistent with affiliate preference for high-insurance-penetration markets.

Victim Profile

The claimed victim mix spans SMB professional services (a local tax practice) through mid-market technology firms to large enterprise/national telecom and semiconductor entities. This breadth suggests opportunistic affiliate access rather than a curated target list — whoever buys or lands access gets posted.

Posting Frequency & Escalation

The data shows a clustered burst pattern: a wave of postings on 2026-10-18 (the majority of the 36), bracketed by smaller batches on 10-17 and 10-19. Burst posting typically indicates either a batch of affiliates "cashing in" simultaneously or the operator clearing a negotiation backlog. Expect follow-on placeholder reveals over the next 7–14 days.

CVE Exposure Hypothesis (Sector-Level Only)

N0N's known tradecraft aligns with edge-device and management-plane exploitation. The following actively exploited vulnerabilities (CISA KEV, confirmed ransomware use) represent exposure the gang's affiliate ecosystem is positioned to abuse — we have no evidence linking any specific CVE to any specific named victim:

• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1). Direct perimeter VPN compromise; the most probable access class for this actor.
• CVE-2026-20316 — Cisco Secure FMC hard-coded password. Management-plane takeover enabling policy tampering and lateral pivot.
• CVE-2026-59310 — VMware vCenter path traversal. Virtualization-layer access is a force multiplier: vCenter compromise enables mass encryption of VM estates.
• CVE-2026-63077 — JetBrains TeamCity deserialization. CI/CD compromise fits the technology-sector targeting and enables supply-chain staging.
• CVE-2026-48027 — Nx Console embedded malicious code. Developer-toolchain poisoning; relevant to the technology/manufacturing claims.

Patch posture check for these five CVEs is the single highest-value 24-hour action for organizations in the named sectors.

Detection Engineering

The following detections target N0N's known playbook: edge/VPN exploitation, phishing-driven execution, RDP abuse, PsExec/WMI lateral movement, and pre-encryption data staging.

---
title: N0N Ransomware - Suspicious VPN/Firewall Authentication Anomaly (Edge Exploitation)
id: 8f3a2b11-4c6e-4a9d-b7f2-n0n000000001
status: experimental
description: Detects authentication anomalies consistent with exploited VPN/firewall appliances (Check Point CVE-2026-50751, Cisco FMC CVE-2026-20316) — logons from unusual geographies or atypical hours followed by immediate administrative session establishment.
author: Security Arsenal Threat Intelligence
date: 2026/10/19
references:
  - https://securityarsenal.com/darkside
logsource:
  category: authentication
  product: firewall
detection:
  selection_success:
    EventType: login_success
  selection_risk:
    SourceCountry|notin:
      - 'US'
      - 'EXPECTED_CORPORATE_REGIONS'
  timeframe: 5m
  condition: selection_success and selection_risk
fields:
  - SourceIp
  - Username
  - SourceCountry
  - TargetDevice
falsepositives:
  - Legitimate travel by administrators
  - MSP/outsourced SOC access
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t1078
---
title: N0N Ransomware - PsExec/WMI Remote Service Creation for Lateral Movement
id: 8f3a2b11-4c6e-4a9d-b7f2-n0n000000002
status: experimental
description: Detects remote service creation and WMI process execution patterns associated with N0N affiliate lateral movement and pre-detonation ransomware staging across multiple hosts.
author: Security Arsenal Threat Intelligence
date: 2026/10/19
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec:
    Image|endswith:
      - '\psexec.exe'
      - '\psexesvc.exe'
      - '\paexec.exe'
  selection_wmi:
    ParentImage|endswith: '\wmiprvse.exe'
    CommandLine|contains:
      - 'cmd.exe'
      - 'powershell'
      - 'rundll32'
  selection_service:
    EventID: 7045
    ServiceFileName|contains:
      - 'ADMIN$'
      - '\\'
      - '%TEMP%'
  condition: 1 of selection_*
fields:
  - Computer
  - Image
  - CommandLine
  - ParentImage
  - User
falsepositives:
  - Legitimate administrative tooling (SCCM, PDQ) — baseline and allowlist
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1047
  - attack.t1569.002
---
title: N0N Ransomware - Pre-Encryption Data Staging and Shadow Copy Tampering
id: 8f3a2b11-4c6e-4a9d-b7f2-n0n000000003
status: experimental
description: Detects archive-based data staging to unusual directories and Volume Shadow Copy deletion — the two highest-fidelity pre-detonation signals in N0N intrusions.
author: Security Arsenal Threat Intelligence
date: 2026/10/19
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    - CommandLine|contains|all:
        - 'vssadmin'
        - 'delete'
        - 'shadows'
    - CommandLine|contains|all:
        - 'wmic'
        - 'shadowcopy'
        - 'delete'
    - CommandLine|contains:
        - 'bcdedit'
        - 'recoveryenabled no'
  selection_staging:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\winrar.exe'
    CommandLine|contains:
      - ' a '
      - '-p'
      - '.rar'
      - '.7z'
  condition: selection_vss or selection_staging
fields:
  - Computer
  - Image
  - CommandLine
  - User
falsepositives:
  - Backup software VSS management
  - Legitimate archiving by users — filter by directory and frequency
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.collection
  - attack.t1560.001

KQL (Microsoft Sentinel) — Pre-Ransomware Staging & Lateral Movement Hunt

// N0N hunt: multi-host lateral movement + data staging + shadow copy tampering
// Lookback: 14 days. Tune allowlists for admin tooling before production use.
let lookback = 14d;
let VssTamper = DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where ProcessCommandLine has_any ("vssadmin", "shadowcopy", "bcdedit")
        and ProcessCommandLine has_any ("delete", "resize", "recoveryenabled");
let Staging = DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where FileName in~ ("rar.exe", "7z.exe", "7za.exe", "winrar.exe")
    | summarize ArchiveOps = count(), Hosts = dcount(DeviceName) by AccountName, bin(Timestamp, 1h);
let LateralSMB = DeviceNetworkEvents
    | where Timestamp > ago(lookback)
    | where RemotePort == 445 and InitiatingProcessFileName in~ ("psexec.exe", "wmiprvse.exe", "services.exe")
    | summarize Targets = dcount(RemoteIP) by DeviceName, InitiatingProcessFileName, bin(Timestamp, 1h)
    | where Targets > 5; // fan-out threshold: one host touching 5+ SMB targets in an hour
VssTamper
| summarize VssEvents = count(), FirstSeen = min(Timestamp) by DeviceName, AccountName
| join kind=inner (LateralSMB) on DeviceName
| project DeviceName, AccountName, VssEvents, Targets, FirstSeen, InitiatingProcessFileName
| extend RiskScore = VssEvents * 3 + Targets
| order by RiskScore desc

Rapid-Response PowerShell — Exposure & Pre-Detonation Sweep

# Security Arsenal - N0N Rapid Response Sweep (run elevated on suspect hosts/DC)
# Checks: exposed RDP, new scheduled tasks (7d), shadow copy state, suspicious services
$cutoff = (Get-Date).AddDays(-7)
$report = @{}

# 1. RDP exposure check
$rdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$nla = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -ErrorAction SilentlyContinue).UserAuthentication
$report['RDP'] = [pscustomobject]@{ Enabled = $rdpEnabled; NLA_Enforced = ($nla -eq 1) }

# 2. Scheduled tasks created in last 7 days (persistence/detonation staging)
$report['NewScheduledTasks'] = Get-ScheduledTask | Where-Object { $_.Date -gt $cutoff } |
    Select-Object TaskName, TaskPath, Date, @{N='Author';E={$_.Author}}

# 3. Volume Shadow Copy inventory (N0N deletes these pre-detonation)
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
$report['ShadowCopies'] = [pscustomobject]@{
    Count = ($shadows | Measure-Object).Count
    OldestShadow = ($shadows | Sort-Object InstallDate | Select-Object -First 1).InstallDate
    Alert = (($shadows | Measure-Object).Count -eq 0)
}

# 4. Recently installed services (PsExec-style lateral movement artifacts)
$report['NewServices'] = Get-CimInstance Win32_Service |
    Where-Object { $_.PathName -match 'ADMIN\$|%TEMP%|\\.*\\' -or $_.State -eq 'Stopped' -and $_.PathName -match '\.exe' } |
    Select-Object Name, DisplayName, PathName, State, StartName

# 5. Failed logon burst (RDP brute-force indicator) - last 24h
$report['FailedLogons24h'] = (Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)} -ErrorAction SilentlyContinue | Measure-Object).Count

$report | ConvertTo-Json -Depth 4 | Out-File ".\n0n_sweep_$(Get-Date -Format 'yyyyMMdd_HHmm').json"
Write-Host "[+] Sweep complete. Zero shadow copies or RDP without NLA = immediate escalation." -ForegroundColor Yellow

Incident Response Priorities

T-Minus Detection Checklist (Before Encryption Fires)

N0N's double-extortion model means exfiltration precedes encryption by 24–72 hours. In priority order:

1. Egress anomaly: sustained outbound transfers (>1 GB/hr) to unfamiliar IPs, cloud storage (MEGA, Rclone endpoints), or FTP — especially overnight/weekends.
2. Archive creation bursts: rar/7z execution on file servers, domain controllers, or database hosts (see Sigma rule 3).
3. Shadow copy manipulation: any vssadmin delete shadows execution outside backup windows is a critical tripwire.
4. SMB fan-out: a single host connecting to 5+ peers over 445 within an hour (KQL query above).
5. New services/scheduled tasks created in the last 7 days on servers (sweep script above).
6. EDR tampering: attempts to stop, uninstall, or exclude security tooling via GPO or direct service control.

Assets This Gang Historically Prioritizes for Exfiltration

Based on the claimed victim mix:

• Financial/PII stores — customer databases, tax records, payroll (the bookkeeping-practice claim signals appetite for dense PII).
• Email archives of executives and legal/finance teams — for leverage material.
• Source code and CI/CD artifacts — relevant to the technology-sector claims and the TeamCity/Nx exposure class.
• Backup infrastructure credentials — to ensure recovery is impossible without payment.

Containment Actions — Ordered by Urgency

1. Isolate the egress path for any host showing staging indicators — block at the firewall before host isolation triggers detonation.
2. Disable compromised accounts and force credential resets for any account implicated in lateral movement (check for tickets/NTLM from staging hosts).
3. Snapshot and preserve — capture memory and disk of staging hosts before remediation; exfil evidence matters for disclosure analysis.
4. Protect backups: verify offline/immutable copies are intact and unreachable from production credentials.
5. Segment: apply emergency ACLs isolating server VLANs from workstation lateral paths.
6. Engage IR retainer before touching the suspected initial-access edge device — VPN/firewall appliances hold forensic evidence of CVE exploitation.

Hardening Recommendations

Immediate (24 Hours)

• Patch the five KEV CVEs on any exposed appliance: Check Point gateways (CVE-2026-50751), Cisco FMC (CVE-2026-20316), vCenter (CVE-2026-59310), TeamCity (CVE-2026-63077), and audit developer workstations for Nx Console (CVE-2026-48027). These are confirmed ransomware-exploited.
• Enforce NLA + MFA on all RDP, or take RDP off the internet entirely behind VPN/ZTNA.
• Deploy the Sigma rules above and run the KQL hunt across the last 14 days — retro-hunting is essential given 5–14 day dwell time.
• Alert on any VSS deletion as a page-the-on-call event.
• Block or alert on Rclone/MEGA/unapproved cloud storage egress at the proxy.

Short-Term (2 Weeks)

• Segment backup infrastructure onto separate credentials and network zones; move to immutable/offline backup tiers.
• Deploy honey credentials and canary file shares on file servers — any access is a high-fidelity lateral-movement signal.
• Restrict PsExec/WMI/SMB admin shares to dedicated PAWs (privileged access workstations) via firewall policy.
• Macro hardening: block Office macros from internet-sourced files (Mark of the Web enforcement) via GPO.
• CI/CD isolation: segment build servers (TeamCity class systems) from production and require signed artifacts — directly counters the toolchain-compromise vector seen in this actor's sector targeting.
• Tabletop the leak-site scenario: rehearse the decision tree for "we appear on N0N's site" — legal, comms, and regulator notification paths — before it happens.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub