N0N Ransomware Gang: 38 New Leak-Site Listings — Sector Targeting Analysis & Detection Rules

Classification: TLP:CLEAR | Publication Date: 2026-10-19 | Source: ransomware.live leak-site monitoring | Nature of data: Unverified threat-actor claims

Executive Summary

N0N's dark web leak site currently shows 38 recent listings, all independently observed by two leak-site crawlers and none treated here as confirmed intrusions. The named set is US-heavy and spans hospitality, healthcare, financial services, technology, professional services, manufacturing and other/unknown categories. N0N has listed or claims to have compromised Hotel DuPont, Kingwood Endoscopy, The Akeeli Group, Finzly Corp, Amagi Media Labs, Telecom Egypt, SMIC US Company, Solid Trading B.V., All Business Technologies, and several unresolved 'Company #89-#94' entries; these are criminal accusations, not verified breaches. Defenders in the listed sectors should prioritize pre-encryption detection: exposed remote access, suspicious authentication bursts, data staging, shadow-copy tampering, and mass outbound transfer.

Sourcing & Verification

Of the 38 listings reviewed, 38 were independently observed by a second crawler and 0 were single-source only. Inclusion reflects the threat actor's claim and is not confirmation of a breach; no tier in this dataset verifies compromise. A named organization may dispute a listing, and a denial is likewise not proof the claim is false: disclosure obligations vary by jurisdiction, contract and regulator, and not every incident is reportable, so neither silence nor denial settles the question. Security Arsenal will publish corrections and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

Known aliases: no reliable aliases are established in the supplied dataset; track primarily as N0N and watch for spelling variants in negotiation IDs, onion mirrors and ransom-note branding. Operating model: not confirmed from this data alone; the cadence and broad sector mix are consistent with either a small closed crew or an affiliate-driven RaaS using a shared leak site, so defenders should assume repeatable playbooks rather than a single operator. Ransom demands: not disclosed in the feed; based on sector mix, expect demands calibrated to perceived cyber-insurance coverage and regulatory sensitivity rather than flat pricing. Initial access: treat phishing, internet-facing VPN/firewall flaws, RDP exposure and abused remote-management tooling as plausible hypotheses, not victim-specific facts. Extortion approach: leak-site naming plus implied publication pressure indicates double-extortion behavior even where encryption status is unknown. Dwell time: not measurable from leak posts; prioritize controls that catch staging before detonation because public naming often occurs after data theft claims are prepared.

Current Campaign Analysis

Sector emphasis in the supplied listings: hospitality and healthcare appear alongside financial services, technology, professional services and manufacturing, with additional 'Other' and 'Not Found' entries that should be treated as unclassified rather than benign. Geographic concentration is strongly US-centric, with single listings tied to KR, EG, NL and BR in the recent window; the US concentration increases odds that downstream customers, processors and clinics are exposed through supplier relationships. Victim profile: the named set ranges from regional service firms and a boutique hospitality property to larger technology, telecom, financial-software and semiconductor-adjacent entities, implying opportunistic plus value-selected targeting rather than one revenue band. Posting cadence: clustered postings on 2026-10-18 and 2026-10-19 suggest batch publication after claim preparation; escalation risk is highest in the 72 hours after listing when proof packs, countdowns or partial data teasers may appear. CVE linkage: CVE-2026-59310, CVE-2026-63077, CVE-2026-20316, CVE-2026-50751 and CVE-2026-48027 are sector-level exposure hypotheses from CISA KEV with confirmed ransomware use; there is no evidence in this feed tying any specific named organization to any specific CVE.

Detection Engineering

---
title: N0N Hypothesis - Remote Access Brute Force Followed By Admin Logon
id: 7f2a1d10-n0n0-4a11-9c01-202610190001
status: experimental
description: Detects password-spray or brute-force bursts against VPN/RDP-adjacent Windows logons followed by a successful interactive or network logon. Hypothesis tied to N0N-style initial access, not proof for any named listing.
author: Security Arsenal
logsource:
  product: windows
  service: security
detection:
  sel_fail:
    EventID: 4625
  sel_success:
    EventID: 4624
    LogonType:
      - 3
      - 10
  condition: sel_fail and sel_success
  timeframe: 15m
level: high
tags:
  - attack.initial_access
  - attack.t1110
  - attack.t1078
falsepositives:
  - Vulnerability scanners
  - Misconfigured service accounts
---
title: N0N Hypothesis - PsExec WMI Or Remote Service Staging
id: 7f2a1d10-n0n0-4a11-9c01-202610190002
status: experimental
description: Detects common lateral-movement and staging artifacts including PsExec-style service creation, WMI process execution and remote admin share use. Use for pre-ransomware hunting.
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  sel_img:
    Image|endswith:
      - 'psexec.exe'
      - 'wmic.exe'
      - 'powershell.exe'
      - 'rundll32.exe'
  sel_cmd:
    CommandLine|contains:
      - 'admin$'
      - 'ipc$'
      - 'psexec'
      - 'wmic /node'
      - 'Invoke-WMIMethod'
      - 'Start-Process'
  condition: sel_img and sel_cmd
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1047
  - attack.t1569.002
falsepositives:
  - EDR remote response
  - SCCM and software distribution
---
title: N0N Hypothesis - Pre Encryption Exfil And Shadow Copy Tampering
id: 7f2a1d10-n0n0-4a11-9c01-202610190003
status: experimental
description: Detects data staging plus destructive preparation often seen before ransomware detonation: archive tools, cloud sync CLI, vssadmin deletion and large outbound transfer markers.
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  sel_stage:
    CommandLine|contains:
      - '7z a'
      - 'rar a'
      - 'rclone copy'
      - 'rclone sync'
      - 'megacmd'
      - 'curl -T'
      - 'ftp -s:'
  sel_destroy:
    CommandLine|contains:
      - 'vssadmin delete shadows'
      - 'wmic shadowcopy delete'
      - 'bcdedit'
      - 'wbadmin delete catalog'
  condition: 1 of sel_*
level: critical
tags:
  - attack.exfiltration
  - attack.t1567
  - attack.t1490
  - attack.impact
falsepositives:
  - Backup jobs
  - Legitimate archival packaging

// Hunt: possible pre-ransomware staging after remote logon in the last 14 days
let Lookback = 14d;
let RemoteLogons = SecurityEvent
| where TimeGenerated >= ago(Lookback)
| where EventID == 4624 and LogonType in (3,10)
| summarize FirstLogon=min(TimeGenerated), Logons=count() by Account, Computer, IpAddress
| where Logons >= 1;
let SuspiciousProc = SecurityEvent
| where TimeGenerated >= ago(Lookback)
| where EventID == 4688
| where Process has_any ('psexec','wmic','rclone','7z','rar','vssadmin','wbadmin','powershell','rundll32')
   or CommandLine has_any ('admin$','shadowcopy','delete shadows','rclone copy','vssadmin delete','wmic /node')
| project ProcTime=TimeGenerated, Computer, Account, Process, CommandLine, ParentProcessName;
RemoteLogons
| join kind=inner SuspiciousProc on Computer, Account
| where ProcTime between (FirstLogon .. FirstLogon + 6h)
| summarize FirstSeen=min(ProcTime), LastSeen=max(ProcTime), Commands=make_set(CommandLine, 20), Processes=make_set(Process, 20) by Computer, Account, IpAddress
| order by FirstSeen asc;

# Rapid triage: run as local admin on suspected Windows hosts
$days = 7
$cut = (Get-Date).AddDays(-$days)
Write-Output '=== Recent scheduled tasks ==='
Get-ScheduledTask | Where-Object { $_.Date -gt $cut } | Select-Object TaskName, TaskPath, Date, Author | Format-Table -AutoSize
Write-Output '=== RDP listener state ==='
Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue | Select-Object LocalAddress, LocalPort, State, OwningProcess
Write-Output '=== Shadow copies and recent deletion clues ==='
vssadmin list shadows
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7036; StartTime=$cut} -ErrorAction SilentlyContinue | Where-Object { $_.Message -match 'Volume Shadow Copy|VSS' } | Select-Object TimeCreated, Message -First 25
Write-Output '=== New local admins in window ==='
Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue | Select-Object Name, ObjectClass, PrincipalSource
Write-Output '=== Top outbound by process, last 24h if available ==='
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | Where-Object { $_.RemoteAddress -notmatch '^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|127\.)' } | Group-Object OwningProcess | Sort-Object Count -Descending | Select-Object -First 15 Name, Count

Incident Response Priorities

T-minus detection checklist before encryption fires: new or reused VPN accounts from unusual ASN or geography; RDP/ SMB admin share use from non-admin subnets; PsExec, WMI or remote service creation outside change windows; archive creation on file servers, EHR exports, payment systems, CI runners and backup repositories; rclone, MEGA, curl upload, FTP script or unexpected cloud-sync process; vssadmin, wbadmin, bcdedit or shadowcopy deletion; disabling of EDR services; sudden Kerberos ticket anomalies after a single remote logon. Assets historically prioritized for exfiltration in comparable double-extortion playbooks: identity stores, finance and payroll exports, EHR/PHI repositories, hotel guest and loyalty databases, source code and CI secrets, legal engagement files, contracts, insurance policies and backup catalogs. Containment by urgency: isolate suspected staging hosts without powering off volatile evidence; block egress to consumer storage and unknown VPS ASNs; disable implicated VPN/RDP accounts and force credential reset for exposed admin tiers; revoke refresh tokens and API keys; freeze service creation and remote execution via application control; preserve firewall, VPN, EDR, Windows Security and DNS logs; snapshot affected VMs before cleanup; activate regulator and counsel workflows only after facts are verified by the organization.

Hardening Recommendations

Immediate, 24 hours: deny inbound RDP from the internet and place it behind VPN plus MFA; audit and disable stale VPN, service and vendor accounts; block outbound to known exfil tools where not business-required; alert on vssadmin delete, shadowcopy delete and mass archive creation; verify EDR tamper protection and isolated backups with an offline copy; confirm patching status for KEV exposure at sector level, especially VMware vCenter, TeamCity, Cisco Secure FMC, Check Point gateways and developer workstation extensions, without assuming any named listing used those flaws. Short-term, two weeks: segment clinical, hospitality PMS, finance and code-signing zones away from general user subnets; deploy just-in-time admin and remove standing local admin; add egress allowlisting for servers; centralize VPN, firewall, EDR, DNS and Windows event telemetry into Sentinel; require phishing-resistant MFA for remote access and privileged actions; baseline PsExec, WMI, rclone, 7z and RAR usage so anomaly alerts are actionable; rehearse a leak-site claim runbook that separates public statement decisions from technical containment.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub