Classification: TLP:CLEAR | Publication Date: 2026-10-20 | Source: ransomware.live leak-site monitoring | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 39 Victim Claims Posted in 48 Hours

Executive Summary

Security Arsenal's dark web monitoring has observed an unusually dense posting burst from the ransomware group N0N. Of the gang's last 100 leak-site postings, 39 were published in the current collection window — including 15 named and placeholder entries published between 2026-10-18 and 2026-10-19 alone. N0N has listed, or claims to have compromised, organizations spanning Retail & E-Commerce, Hospitality, Healthcare, Financial Services, Technology, Manufacturing, and Professional Services, with geographic concentration in the United States and additional claims touching South Korea, Egypt, the Netherlands, and Brazil.

Named organizations in the most recent postings include Froggys Fog, Hotel DuPont, Kingwood Endoscopy, The Akeeli Group, Finzly Corp, Amagi Media Labs, Telecom Egypt, All Business Technologies, and SMIC US Company, alongside multiple anonymized placeholder entries ("Company #89" through "#94") typical of a gang staging negotiations before public naming.

Critical caveat: every entry below is an accusation made by a criminal group on its own infrastructure. None of these listings constitutes confirmation that any named organization was breached. Security teams at listed organizations — and organizations in the same sectors — should treat this as a signal to hunt, not a verdict.

Sourcing & Verification

• Corroboration: 39 of 39 listings in this collection window were independently observed by a second leak-site crawler; 0 appear on a single source only. Multi-source observation confirms only that the gang published the claim — it does not confirm that any intrusion occurred.
• Inclusion in this briefing reflects the threat actor's claim and is NOT confirmation of a breach. No corroboration tier in our data verifies victimization; only the named organization or its regulator can do that.
• A named organization may dispute a listing. A denial is likewise not proof the claim is false — disclosure obligations vary by jurisdiction and sector, and not every incident is reportable. Neither silence nor denial settles the question.
• Security Arsenal will publish corrections as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

The following reflects Security Arsenal's assessment of N0N's observed tradecraft across its leak-site history and incident telemetry shared within the intelligence community. Attribution details for newer groups remain fluid; treat capability assessments as directional.

• Aliases / branding: Operates under the name "N0N" (leetspeak styling). No confirmed rebrand lineage to a major legacy family has been established, though tooling overlap suggests affiliate churn from disbanded RaaS programs.
• Operating model: Assessed to function as a small closed crew or boutique RaaS with a limited affiliate roster. The mix of named victims and numbered placeholder entries ("Company #89–#94") indicates a negotiation-first model where organizations are listed anonymously while extortion talks proceed, then named publicly on deadline expiry.
• Ransom demands: Consistent with mid-market extortion economics — demands assessed in the low-to-mid six figures USD, scaled to victim revenue. Healthcare and financial services listings suggest willingness to pressure regulated sectors where downtime and disclosure risk inflate leverage.
• Initial access methods (assessed): The group's victimology pattern — heavy US mid-market, mixed sector, rapid posting cadence — is consistent with external-facing service exploitation (VPN concentrators, firewalls, remote access gateways), RDP brute forcing / purchased RDP credentials from initial access brokers, and phishing with macro- or script-based payloads. Sector-level exposure to the KEV vulnerabilities discussed below is a plausible access hypothesis, not a confirmed vector for any named organization.
• Extortion model: Double extortion — data exfiltration claimed prior to encryption, with leak-site publication used as deadline pressure. The batch posting pattern suggests a standardized playbook rather than bespoke intrusions.
• Dwell time: Based on comparable crews with this operational tempo, assessed dwell time from initial access to detonation is likely in the 3–10 day range, with exfiltration typically preceding encryption by 24–72 hours. This window is the defender's opportunity — see Incident Response Priorities.

Current Campaign Analysis

Sector targeting

From the 39 listings in the current window, N0N claims victims across:

The healthcare and financial services claims are the most operationally significant: both sectors carry mandatory disclosure regimes, which gangs exploit as negotiation leverage. The hospitality listing is consistent with groups harvesting payment-card-adjacent and guest PII for resale even when encryption fails.

Geographic concentration

The US dominates the listing set (at least 11 of the 15 most recent entries). Outliers — a KR placeholder, Telecom Egypt (EG), and NL/BR presence in the broader 39 — suggest N0N is opportunistic rather than geographically strategic, consistent with scanning-driven or broker-sourced access rather than targeted intrusion campaigns.

Victim profile

The named organizations skew toward mid-market enterprises: large enough to pay, small enough to lack 24/7 SOC coverage. Revenue estimates across the named set plausibly span ~$10M–$500M. This is the classic sweet spot for crews of N0N's assessed size — organizations with cyber insurance, regulatory exposure, and thin weekend monitoring.

Posting frequency / escalation pattern

15 postings in roughly 48 hours (2026-10-18 → 2026-10-19) is an aggressive cadence. Two interpretations: (1) a genuine access surge from a newly acquired broker batch or a freshly exploited edge-device vulnerability; or (2) backlog dumping — posting older intrusions en masse to inflate the site's appearance of momentum. The numbered placeholders support interpretation (1): they represent pending negotiations, i.e., a live pipeline, not archives.

CVE exposure (hypothesis only)

We have no evidence linking any specific CVE to any specific named organization above. However, N0N's assessed access methods align with several vulnerabilities currently on CISA's Known Exploited Vulnerabilities catalog with confirmed ransomware use. Organizations in targeted sectors should treat the following as priority patching exposure hypotheses:

• CVE-2026-59310 — Broadcom VMware vCenter path traversal (KEV 2026-08-18). vCenter compromise is a pre-ransomware force multiplier: control of the virtualization layer enables mass VM encryption in a single detonation event.
• CVE-2026-20316 — Cisco Secure Firewall Management Center hard-coded password (KEV 2026-07-29). FMC compromise hands an actor the keys to the network perimeter — consistent with a VPN/edge-access playbook.
• CVE-2026-50751 — Check Point Security Gateway improper authentication in IKEv1 key exchange (KEV 2026-06-08). Direct VPN gateway access; the canonical initial access vector for opportunistic crews.
• CVE-2026-63077 — JetBrains TeamCity deserialization, unauthenticated RCE (KEV 2026-08-05). CI/CD compromise enables supply-chain-style downstream access and credential harvesting from build agents.
• CVE-2026-48027 — Nx Console embedded malicious code (KEV 2026-05-27). Developer-workstation supply chain entry; consistent with the technology-sector claims in this campaign.

Patch posture against these five CVEs should be validated this week regardless of whether your organization appears on any leak site.

Detection Engineering

The following detections target the TTP cluster assessed for N0N and comparable crews: edge/VPN access, RDP-based lateral movement, PsExec/WMI tooling, and pre-encryption staging (shadow copy deletion, mass file operations).

---
title: N0N Campaign - RDP Brute Force Followed by Successful Logon
id: 8f3a1c2e-7b4d-4e1a-9c5f-2d6a8b0e1f3a
status: experimental
description: Detects a burst of failed logons (4625) from a single source IP followed by a successful network logon (4624 type 3/10), consistent with RDP brute-force initial access used by opportunistic ransomware crews including N0N.
author: Security Arsenal Threat Intelligence
date: 2026/10/20
references:
  - https://securityarsenal.com/darkside
logsource:
  product: windows
  service: security
detection:
  failed:
    EventID: 4625
  successful:
    EventID: 4624
    LogonType:
      - 3
      - 10
  condition: failed and successful
timeframe: 30m
falsepositives:
  - Legitimate user password typos
  - Misconfigured service accounts
level: high
tags:
  - attack.initial_access
  - attack.t1110
  - attack.t1078
---
title: N0N Campaign - PsExec or Remote Service Installation for Lateral Movement
id: 1b7d4e9a-3c2f-4a8b-9d0e-5f6a7b8c9d0e
status: experimental
description: Detects installation of new services (7045) with names or paths consistent with PsExec-style lateral movement and ransomware staging tooling observed across N0N-comparable intrusions.
author: Security Arsenal Threat Intelligence
date: 2026/10/20
references:
  - https://securityarsenal.com/darkside
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 7045
  psexec_pattern:
    ServiceName|contains:
      - 'PSEXESVC'
      - 'PAExec'
      - 'csexec'
  suspicious_path:
    ImagePath|contains:
      - '\\ADMIN$\\'
      - '\\IPC$\\'
      - 'AppData\\Local\\Temp'
      - '\\Windows\\Temp'
  condition: selection and (psexec_pattern or suspicious_path)
falsepositives:
  - Legitimate remote administration by IT teams
  - Software deployment tools (SCCM, PDQ)
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002
  - attack.t1543.003
---
title: N0N Campaign - Volume Shadow Copy Deletion Pre-Encryption Staging
id: 4e9c2a6b-8d1f-4b3e-a7c5-0d2e4f6a8b0c
status: experimental
description: Detects deletion or resizing of Volume Shadow Copies via vssadmin, wmic, bcdedit, or PowerShell — a near-universal pre-encryption staging step in ransomware playbooks including crews with N0N's profile. High-fidelity when correlated with new service installs or mass file renames.
author: Security Arsenal Threat Intelligence
date: 2026/10/20
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'Delete Shadows'
  wmic:
    Image|endswith: '\wmic.exe'
    CommandLine|contains: 'shadowcopy'
  bcdedit:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains: 'recoveryenabled'
  powershell:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'Get-WmiObject Win32_Shadowcopy'
      - 'Remove-WmiObject'
      - 'vssadmin delete'
  condition: vssadmin or wmic or bcdedit or powershell
falsepositives:
  - Backup software maintenance
  - Storage administrators reclaiming shadow storage
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.t1486

// N0N Campaign Hunt: Pre-ransomware staging cluster — Sentinel
// Correlates shadow copy tampering, suspicious service installs, and admin-share writes
// on the same host within a 6-hour window. Run over the last 14 days.
let lookback = 14d;
let window = 6h;
let ShadowTamper = SecurityEvent
| where TimeGenerated > ago(lookback)
| where EventID == 4688
| where Process has_any ("vssadmin.exe", "wmic.exe", "bcdedit.exe")
| where CommandLine has_any ("delete shadows", "shadowcopy", "recoveryenabled")
| project ShadowTime = TimeGenerated, Computer, Account, CommandLine;
let SuspiciousSvc = Event
| where TimeGenerated > ago(lookback)
| where EventLog == "System" and EventID == 7045
| where ServiceName has_any ("PSEXESVC", "PAExec")
   or ServiceFileName has_any ("ADMIN$", "Temp")
| project SvcTime = TimeGenerated, Computer, ServiceName, ServiceFileName;
let AdminShareWrites = SecurityEvent
| where TimeGenerated > ago(lookback)
| where EventID == 5145
| where ShareName has_any ("\\ADMIN$", "\\C$")
| where SubjectAccount !endswith "$"  // exclude machine accounts
| project ShareTime = TimeGenerated, Computer, SubjectAccount, RelativeTargetName;
ShadowTamper
| join kind=inner SuspiciousSvc on Computer
| where SvcTime between (ShadowTime .. ShadowTime + window)
| join kind=inner AdminShareWrites on Computer
| where ShareTime between (ShadowTime - window .. ShadowTime)
| summarize FirstSeen = min(ShadowTime), ActivityCount = count(),
    Signals = make_set(ipv4_lookup_is_Mitigation, 0) , // placeholder no-op
    Commands = make_set(CommandLine, 5),
    Services = make_set(ServiceName, 5),
    Accounts = make_set(SubjectAccount, 5)
  by Computer
| where ActivityCount >= 3
| order by FirstSeen desc;

# N0N Rapid Triage Script — run on suspected hosts or via GPO/Intune across the fleet
# Checks: exposed RDP, scheduled tasks added in last 7 days, shadow copy health,
# suspicious services, recent logon anomalies.
# Requires: Run as Administrator. Read-only; safe for production.

Write-Host "=== N0N Rapid Triage - $(Get-Date) - $env:COMPUTERNAME ===" -ForegroundColor Cyan

# 1. RDP exposure check
$rdpEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$nlaEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -ErrorAction SilentlyContinue).UserAuthentication
Write-Host "[RDP] Enabled: $rdpEnabled | NLA: $nlaEnabled"
if ($rdpEnabled -and $nlaEnabled -ne 1) {
    Write-Host "[!] RDP enabled WITHOUT NLA — brute-force exposure. Disable or restrict now." -ForegroundColor Red
}
$rdpFw = Get-NetFirewallRule -DisplayGroup "Remote Desktop" -ErrorAction SilentlyContinue | Where-Object Enabled -eq 'True'
if ($rdpFw) { Write-Host "[!] RDP firewall rules active — verify source-IP scoping." -ForegroundColor Yellow }

# 2. Scheduled tasks created/modified in last 7 days (common persistence)
Write-Host "`n=== Scheduled Tasks (last 7 days) ==="
Get-ScheduledTask | ForEach-Object {
    $info = Get-ScheduledTaskInfo $_ -ErrorAction SilentlyContinue
    $task = $_
    try {
        $xml = [xml](Export-ScheduledTask -TaskName $task.TaskName -TaskPath $task.TaskPath)
        $created = [datetime]$xml.Task.RegistrationInfo.Date
        if ($created -gt (Get-Date).AddDays(-7)) {
            $author = $xml.Task.RegistrationInfo.Author
            $action = ($xml.Task.Actions.Exec | ForEach-Object { "$($_.Command) $($_.Arguments)" }) -join '; '
            Write-Host "[TASK] $($task.TaskPath)$($task.TaskName) | Created: $created | Author: $author"
            Write-Host "       Action: $action"
        }
    } catch {}
}

# 3. Volume Shadow Copy health
Write-Host "`n=== Volume Shadow Copies ==="
$shadows = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($shadows) {
    $shadows | ForEach-Object { Write-Host "[VSS] $($_.DeviceObject) | Created: $($_.InstallDate)" }
} else {
    Write-Host "[!!!] NO shadow copies present. If backups rely on VSS, treat as possible tampering indicator." -ForegroundColor Red
}

# 4. Suspicious services (PsExec-style + temp paths)
Write-Host "`n=== Suspicious Services ==="
Get-WmiObject Win32_Service | Where-Object {
    $_.Name -match 'PSEXESVC|PAExec' -or $_.PathName -match 'ADMIN\$|Temp\\'
} | ForEach-Object { Write-Host "[SVC] $($_.Name) | $($_.PathName)" -ForegroundColor Yellow }

# 5. Failed logon burst (last 24h)
Write-Host "`n=== Failed Logons by Source (last 24h) ==="
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)} -ErrorAction SilentlyContinue |
    Group-Object { $_.Properties[19].Value } |
    Where-Object Count -gt 20 |
    Sort-Object Count -Descending |
    ForEach-Object { Write-Host "[AUTH] Source $($_.Name): $($_.Count) failures" -ForegroundColor Red }

Write-Host "`n=== Triage complete. Review [!!!]/[!] items immediately. ===" -ForegroundColor Cyan

Incident Response Priorities

T-minus detection checklist (before encryption fires)

N0N-profile crews follow a predictable pre-detonation sequence. If you observe any two of these together, assume active staging:

1. Edge/VPN anomalies — logins from impossible-travel geographies, new admin accounts on VPN concentrators, authentication against legacy IKEv1 profiles (relevant to CVE-2026-50751 exposure).
2. Credential dumping artifacts — lsass.exe memory access by non-system processes, NTDS.dit access, presence of Mimikatz-style tools.
3. Lateral movement tooling — PsExec-style service installs (7045), WMIC remote process creation, ADMIN$ writes from unexpected accounts.
4. Discovery commands — net group "Domain Admins", nltest /dclist, mass port scans from a single internal host.
5. Exfiltration staging — large archives in temp directories, Rclone/MEGA/FileZilla processes on servers, sustained outbound transfers to unfamiliar cloud endpoints.
6. Defense tampering — shadow copy deletion, bcdedit recovery disabling, security tool service stops, event log clearing (EventID 1102).

Items 5 and 6 together mean you are likely inside the final 24–72 hour window.

Critical assets this gang profile prioritizes for exfiltration

Based on the sector mix N0N is claiming, assume targeting of:

• Healthcare claims → patient records, billing systems, and anything with PHI leverage (see Kingwood Endoscopy listing claim).
• Financial services claims → customer PII, transaction records, and regulatory-reportable data (see Finzly Corp listing claim).
• Hospitality claims → guest PII and reservation databases (see Hotel DuPont listing claim).
• Technology/manufacturing claims → source code, build pipelines, and IP — consistent with TeamCity/Nx-class supply chain interest (see Amagi Media Labs, Telecom Egypt, SMIC US Company listing claims).
• Cross-cutting → Active Directory exports, HR files, and executive mailboxes for extortion ammunition.

Containment actions, ordered by urgency

1. Isolate at the identity layer first. Disable suspect accounts and force resets for all privileged credentials — cutting identity cuts lateral movement faster than host isolation at scale.
2. Block egress to known exfil channels (Rclone endpoints, MEGA, anonymous file shares) at the proxy/firewall. Exfiltration in progress is a race; encryption is not yet your worst problem.
3. Preserve, don't wipe. Snapshot volatile memory and logs on staging hosts before containment reboots — you will need them for scoping and for any future disclosure analysis.
4. Segment virtualization management. Isolate vCenter/ESXi management interfaces immediately (CVE-2026-59310 exposure) — mass VM encryption is the worst-case detonation mode.
5. Validate backup integrity and offline copies. Confirm shadow copies and backups were not already tampered with before relying on them.
6. Engage IR retainer and legal counsel early. If your organization appears on N0N's site — as a claim, not a confirmed breach — counsel should drive disclosure analysis; obligations vary by sector and state.

Hardening Recommendations

Immediate (24 hours)

• Patch or mitigate the five KEV CVEs listed above — specifically Check Point gateways (CVE-2026-50751), Cisco FMC (CVE-2026-20316), vCenter (CVE-2026-59310), and TeamCity (CVE-2026-63077). If patching isn't possible in 24h, take the management interfaces off the internet entirely.
• Enforce MFA on all remote access — VPN, RDP gateways, and third-party remote tools. NLA on for any RDP that must remain.
• Block PsExec-style service creation via AppLocker/WDAC policies on servers; alert on EventID 7045 fleet-wide (Sigma rules above).
• Deploy the shadow-copy tampering rule — vssadmin deletion is the highest-fidelity pre-encryption tripwire available.
• Hunt the last 14 days with the KQL query above, especially if you operate in healthcare, financial services, hospitality, or US mid-market retail.

Short-term (2 weeks)

• Segment backup and virtualization planes onto separate, MFA-gated networks unreachable from standard user/server VLANs. Test an actual restore.
• Deploy egress filtering with allowlisting for server VLANs — servers rarely need arbitrary internet egress; ransomware staging almost always does.
• Implement tiered administration — separate accounts and PAWs for domain admin work, eliminating the credential theft payoff from a single compromised endpoint.
• Stand up canary credentials and decoy fileshares — cheap, high-signal early warning for the discovery/exfil phases of crews with N0N's playbook.
• Review CI/CD exposure — if you run TeamCity or the Nx toolchain, audit build agents for credential material and rotate everything stored there (CVE-2026-63077, CVE-2026-48027).

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub