N0N Ransomware Gang: 38 Organizations Listed in Single-Source Leak Campaign — Sector Targeting Analysis & Detection Rules

---
title: N0N Ransomware - Suspicious VPN Authentication Anomaly
id: a1b2c3d4-0001-4e5f-8a9b-n0nvpn000001
status: experimental
description: Detects anomalous VPN authentication patterns consistent with compromised credential use, including impossible travel, off-hours access, and authentication from known VPN/proxy exit nodes. Aligned with N0N's suspected VPN initial access vector.
author: Security Arsenal Threat Intelligence
date: 2026/11/11
references:
  - https://securityarsenal.com/darkside
logsource:
  category: authentication
  product: vpn
detection:
  selection_auth_success:
    - action: success
    - result: success
    - outcome: success
  filter_business_hours:
    timestamp|between: '08:00-18:00'
  filter_known_ips:
    src_ip|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection_auth_success and not filter_business_hours and not filter_known_ips
falsepositives:
  - Legitimate remote workers in different time zones
  - On-call engineers authenticating off-hours
level: medium
tags:
  - attack.initial_access
  - attack.t1133
  - attack.t1078

---
title: N0N Ransomware - RDP Brute Force Followed by Successful Login
id: a1b2c3d4-0002-4e5f-8a9b-n0nrdp000002
status: experimental
description: Detects multiple failed RDP login attempts (Event ID 4625) from a single source IP followed by a successful login (Event ID 4624) within a 10-minute window. Consistent with RDP brute-force initial access used by mid-tier ransomware groups.
author: Security Arsenal Threat Intelligence
date: 2026/11/11
references:
  - https://securityarsenal.com/darkside
logsource:
  product: windows
  service: security
detection:
  selection_failed:
    EventID: 4625
    LogonType: 10
  selection_success:
    EventID: 4624
    LogonType: 10
  condition: selection_failed | count(IpAddress) by IpAddress > 10
timeframe: 10m
falsepositives:
  - Legitimate users mistyping passwords repeatedly
  - Misconfigured service accounts
level: high
tags:
  - attack.credential_access
  - attack.t1110
  - attack.t1021.001

---
title: N0N Ransomware - Pre-Encryption Data Staging and Exfiltration
id: a1b2c3d4-0003-4e5f-8a9b-n0nexf000003
status: experimental
description: Detects indicators of data staging and exfiltration commonly observed before ransomware detonation, including large archive creation, use of legitimate cloud sync tools in unusual contexts, and high-volume outbound data transfers to non-corporate destinations.
author: Security Arsenal Threat Intelligence
date: 2026/11/11
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_archive_tools:
    Image|endswith:
      - '\7z.exe'
      - '\rar.exe'
      - '\winrar.exe'
    CommandLine|contains:
      - ' a '
      - '-mx'
      - '-hp'
  selection_cloud_sync:
    Image|endswith:
      - '\rclone.exe'
      - '\megasync.exe'
      - '\rclone.exe'
    CommandLine|contains:
      - 'copy'
      - 'sync'
      - 'move'
  selection_vss_delete:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'recoveryenabled no'
  condition: 1 of selection_*
falsepositives:
  - Legitimate backup operations using archive tools
  - IT administrators managing shadow copies
  - Authorized cloud backup solutions
level: high
tags:
  - attack.collection
  - attack.t1560
  - attack.exfiltration
  - attack.t1567
  - attack.impact
  - attack.t1490

// N0N Ransomware - Lateral Movement and Pre-Staging Hunt
// Hunts for PsExec-style service creation, WMI remote execution,
// and suspicious scheduled task creation in the last 7 days.
// Recommended: Run daily across endpoints and servers.

let TimeWindow = 7d;

// PsExec-like remote service creation
let PsExecActivity = SecurityEvent
| where TimeGenerated > ago(TimeWindow)
| where EventID == 7045
| where ServiceName matches regex @"(?i)(psexec|psexesvc|paexec|remcom|csexec)"
| project TimeGenerated, Computer, ServiceName, ServiceFileName, Account, IpAddress
| extend IndicatorType = "PsExec-Style Service Install";

// WMI remote process creation
let WMIActivity = SecurityEvent
| where TimeGenerated > ago(TimeWindow)
| where EventID == 4688
| where ParentProcessName has @"WmiPrvSE.exe"
| where Process !in (@"wmiprvse.exe", @"svchost.exe")
| project TimeGenerated, Computer, Process, CommandLine, Account, ParentProcessName
| extend IndicatorType = "WMI Remote Process Creation";

// Suspicious scheduled task creation (last 7 days)
let SchedTaskActivity = SecurityEvent
| where TimeGenerated > ago(TimeWindow)
| where EventID == 4698
| where TaskName !startswith @"\Microsoft\"
| project TimeGenerated, Computer, TaskName, TaskContent, Account
| extend IndicatorType = "Non-Microsoft Scheduled Task Created";

// Combine all indicators
union PsExecActivity, WMIActivity, SchedTaskActivity
| summarize IndicatorCount = count(), IndicatorTypes = make_set(IndicatorType) by Computer, Account
| where IndicatorCount >= 2
| sort by IndicatorCount desc

# N0N Ransomware - Rapid Response Hardening & Detection Script
# Run as Administrator on critical servers and endpoints
# Checks: RDP exposure, recent scheduled tasks, VSS status, and suspicious services

Write-Host "=== N0N Rapid Response Check - $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss') ===" -ForegroundColor Cyan

# 1. Check RDP Exposure
Write-Host "`n[1] Checking RDP Exposure..." -ForegroundColor Yellow
$RDPEnabled = (Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections
if ($RDPEnabled -eq 0) {
    Write-Host "  [!] RDP is ENABLED" -ForegroundColor Red
    $RDPPort = (Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp').PortNumber
    Write-Host "  [!] RDP Port: $RDPPort" -ForegroundColor Red
    $NLA = (Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp').UserAuthentication
    if ($NLA -ne 1) { Write-Host "  [CRITICAL] NLA is DISABLED — RDP is highly exposed" -ForegroundColor Red }
} else {
    Write-Host "  [+] RDP is disabled" -ForegroundColor Green
}

# 2. Scheduled Tasks Created in Last 7 Days
Write-Host "`n[2] Enumerating Scheduled Tasks (last 7 days)..." -ForegroundColor Yellow
$CutoffDate = (Get-Date).AddDays(-7)
$RecentTasks = Get-ScheduledTask | Where-Object { $_.Date -gt $CutoffDate -and $_.TaskPath -notlike "\Microsoft*" }
if ($RecentTasks) {
    $RecentTasks | ForEach-Object {
        Write-Host "  [!] Task: $($_.TaskName) | Path: $($_.TaskPath) | Created: $($_.Date)" -ForegroundColor Red
    }
} else {
    Write-Host "  [+] No suspicious scheduled tasks found" -ForegroundColor Green
}

# 3. Volume Shadow Copy Status
Write-Host "`n[3] Checking Volume Shadow Copy Status..." -ForegroundColor Yellow
$Shadows = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($Shadows) {
    Write-Host "  [+] $($Shadows.Count) shadow copies exist" -ForegroundColor Green
} else {
    Write-Host "  [CRITICAL] No shadow copies found — may have been deleted by threat actor" -ForegroundColor Red
}
$VSSService = Get-Service -Name VSS -ErrorAction SilentlyContinue
if ($VSSService.Status -ne 'Running') {
    Write-Host "  [!] VSS Service is not running: $($VSSService.Status)" -ForegroundColor Red
}

# 4. Recently Installed Services (last 7 days)
Write-Host "`n[4] Checking for Recently Installed Services..." -ForegroundColor Yellow
$RecentServices = Get-WinEvent -FilterHashtable @{LogName='System'; ID=7045; StartTime=$CutoffDate} -MaxEvents 50 -ErrorAction SilentlyContinue
if ($RecentServices) {
    $RecentServices | ForEach-Object {
        $svcName = ($_.Message -split "`n")[0] -replace '.*: ',''
        Write-Host "  [!] Service: $svcName | Time: $($_.TimeCreated)" -ForegroundColor Red
    }
} else {
    Write-Host "  [+] No new services installed in last 7 days" -ForegroundColor Green
}

# 5. Outbound Connections to Suspicious Ports
Write-Host "`n[5] Checking for Suspicious Outbound Connections..." -ForegroundColor Yellow
$SuspiciousPorts = @(4444, 5555, 6666, 8443, 9999, 1337)
$Connections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | Where-Object { $SuspiciousPorts -contains $_.RemotePort -and $_.RemoteAddress -notlike "10.*" -and $_.RemoteAddress -notlike "192.168.*" -and $_.RemoteAddress -notlike "172.16.*" }
if ($Connections) {
    $Connections | ForEach-Object {
        $ProcName = (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName
        Write-Host "  [CRITICAL] Connection to $($_.RemoteAddress):$($_.RemotePort) by $ProcName (PID: $($_.OwningProcess))" -ForegroundColor Red
    }
} else {
    Write-Host "  [+] No suspicious outbound connections detected" -ForegroundColor Green
}

Write-Host "`n=== Scan Complete ===" -ForegroundColor Cyan