Classification: TLP:CLEAR | Publication Date: 2026-10-20 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: Current Leak-Site Campaign Intelligence

Executive Summary

Security Arsenal monitoring of ransomware.live indexed 40 recent N0N leak-site postings as of 2026-10-20. The claims span Retail & E-Commerce, Hospitality, Healthcare, Financial Services, Technology, Professional Services, Other, and uncategorized/Not Found entries across TN, TT, CH, US, KR, EG, NL, and BR. Named examples in the latest batch include Vormittag Associates Inc, Froggys Fog, Hotel DuPont, Kingwood Endoscopy, The Akeeli Group, Finzly Corp, Amagi Media Labs, Telecom Egypt, and All Business Technologies (Fox Hill bookkeeping and tax practice), plus several anonymized "Company #" entries. These are threat-actor claims only; no listing here confirms compromise.

Operationally, the cluster is consistent with an opportunistic double-extortion rhythm: many same-day or adjacent-day posts, broad sector mix, US-heavy named organizations, and enough healthcare/financial/professional-services entries to suggest interest in regulated data and time-sensitive operations. Defenders should treat edge VPN/firewall authentication weaknesses, exposed RDP, phish-to-macro chains, and backup/shadow-copy tampering as priority hunt surfaces. CVE linkage is sector-level hypothesis only: N0N-adjacent ransomware operators commonly exploit internet-facing VMware vCenter, Cisco FMC, Check Point gateways, JetBrains TeamCity, and developer-tool supply-chain paths when exposed; we have no evidence tying any named organization above to a specific CVE.

Sourcing & Verification

• Corroboration: 38 of 40 listings were independently observed by a second leak-site crawler; 2 appear on a single source only.
• Meaning of inclusion: MULTI-SOURCE means two crawlers saw the gang post the claim. Inclusion reflects the threat actor's statement and is not confirmation of a breach for any organization, named or anonymized.
• Disputes and silence: A named organization may dispute a listing; a denial is likewise not proof the claim is false. Disclosure obligations vary by jurisdiction and contract, and not every incident is reportable, so neither silence nor denial settles the question.
• Corrections: Security Arsenal will publish corrections and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

• Aliases / attribution stability: No reliable aliases were established from the provided dataset. Treat "N0N" as the leak-site brand until infrastructure, payload, or negotiation overlap proves otherwise.
• Operating model: The observed pattern is consistent with a leak-site-driven extortion operation. Whether N0N is a closed crew, RaaS affiliate using shared builders, or a rebrand cannot be determined from victim posts alone. Assume affiliate-like TTP drift until binary/YARA/infrastructure clustering says otherwise.
• Ransom posture: Typical demands for comparable mid-market double-extortion crews range from low six figures to multi-million USD depending on revenue, cyber-insurance signals, and perceived regulatory exposure. No victim-specific demand amount is available in this dataset.
• Initial access methods: Most probable for ransomware crews with this victimology: phishing with malicious macros/ISO/LNK loaders, exploitation of VPN/firewall/remote access edge devices, weak or exposed RDP, credential stuffing against remote portals, and CI/CD or developer-tool compromise where present. For this campaign, CVE discussion is hypothesis-based exposure mapping, not confirmed victim root cause.
• Double extortion: Posting cadence indicates name-and-shame pressure paired with threatened data release. Expect claims of exfil before encryption even when the proof pack is small; validate via egress logs, DNS/cloud storage telemetry, and DLP rather than trusting the leak page.
• Dwell time: Not provided. For planning, assume hands-on staging can be hours to days after initial access in edge-exploit cases, and days to weeks in phish/credential cases. Hunt for staging markers rather than waiting for detonation.

Current Campaign Analysis

Sectors targeted. The gang's latest 100-post window shows 40 listed claims concentrated in: Not Found/uncategorized, Retail & E-Commerce, Hospitality, Healthcare, Other, Financial Services, Technology, and Professional Services. Named entries are US-heavy, with additional claimed postings tied to TN, TT, CH, KR, EG, NL, and BR. The presence of healthcare (Kingwood Endoscopy), financial services (Finzly Corp), hospitality (Hotel DuPont), retail (Froggys Fog), technology/media (Amagi Media Labs, Telecom Egypt), and professional bookkeeping/tax services (All Business Technologies) suggests interest in regulated records, payment-adjacent operations, customer data, and operational disruption leverage. None of this confirms impact at those entities.

Geographic concentration. The strongest named concentration is the US, with isolated claimed entries across North Africa/Middle East, Europe, Asia, Caribbean, and South America. This is broad enough to indicate opportunistic access rather than a narrow regional mandate.

Victim profile. Named organizations skew small-to-mid enterprise and mid-market: specialty healthcare services, hospitality, retail/e-commerce brands, fintech/financial software, media technology, telecom-scale technology, and boutique professional services. Revenue is not supplied; based on sector norms, likely range spans roughly $5M-$500M annual revenue, with Telecom Egypt potentially above that band. Treat revenue estimates as triage context only.

Posting frequency / escalation. The visible sample shows clusters on 2026-10-18 through 2026-10-20, including multiple same-day posts and several anonymized entries. That cadence often means either a batch of accesses matured simultaneously or negotiator pressure shifted to public listing. Watch for follow-on "data sample" posts, countdown timers, or re-posts after denial.

CVE exposure hypotheses. CISA KEV items relevant to ransomware initial access include CVE-2026-59310 (VMware vCenter path traversal), CVE-2026-63077 (JetBrains TeamCity deserialization), CVE-2026-20316 (Cisco Secure FMC hard-coded password), CVE-2026-50751 (Check Point IKEv1 improper authentication), and CVE-2026-48027 (Nx Console embedded malicious code). These should drive exposure validation for organizations in the targeted sectors, especially technology and financial services with CI/CD and virtualization footprints. This is not an assertion that any listed organization was entered via these CVEs.

Detection Engineering

---
title: N0N Ransomware Campaign - Suspicious VPN Edge Authentication Anomalies
id: 8f0d7a10-n0n1-4a21-9c10-20261020a001
status: experimental
description: Detects bursts of failed VPN/firewall authentication followed by success from new ASN/geography, consistent with edge credential attacks used by ransomware operators. Hypothesis-driven for N0N leak-site campaign; not victim-specific.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal Threat Intelligence
date: 2026/10/20
logsource:
  category: authentication
  product: vpn
  definition: Includes Cisco FMC/ASA, Check Point, Fortinet, Palo Alto GlobalProtect, SSL VPN and RDP gateway logs normalized to authentication outcomes.
detection:
  selection_fail:
    action|contains: 'failure'
    user|endswith: '*'
  selection_success:
    action|contains: 'success'
  condition: selection_fail and selection_success
  timeframe: 15m
fields:
  - user
  - src_ip
  - src_geo
  - src_asn
  - device
  - auth_method
falsepositives:
  - Password spray testing, VPN client retry storms, MIS travel.
level: high
tags:
  - attack.initial_access
  - attack.t1078
  - attack.t1133
---
title: N0N Ransomware Campaign - Office Macro or Container Spawn to Scripting and Credential Access
id: 8f0d7a10-n0n1-4a21-9c10-20261020a002
status: experimental
description: Detects Office/ISO/LNK execution spawning script interpreters with credential-access or discovery commands, a common phish-to-loader ransomware precursor.
references:
  - https://attack.mitre.org/techniques/T1204/
author: Security Arsenal Threat Intelligence
date: 2026/10/20
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
      - '\explorer.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\cmd.exe'
  selection_cmd:
    CommandLine|contains:
      - 'Invoke-Mimikatz'
      - 'sekurlsa'
      - 'lsass'
      - 'whoami /all'
      - 'nltest /dclist'
      - 'net group "Domain Admins"'
      - 'vssadmin delete shadows'
      - 'bcdedit'
      - 'wmic shadowcopy delete'
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
  - Admin automation, helpdesk scripts, EDR simulation.
level: critical
tags:
  - attack.execution
  - attack.t1059
  - attack.t1003
  - attack.t1490
---
title: N0N Ransomware Campaign - Pre-Encryption Staging and Exfiltration Tooling
id: 8f0d7a10-n0n1-4a21-9c10-20261020a003
status: experimental
description: Detects PsExec/WMI service creation, archive staging in unusual paths, and outbound transfers to cloud storage or pastebin-like domains before mass encryption.
references:
  - https://attack.mitre.org/techniques/T1567/
author: Security Arsenal Threat Intelligence
date: 2026/10/20
logsource:
  category: process_creation
  product: windows
detection:
  selection_lateral:
    Image|endswith:
      - '\psexec.exe'
      - '\psexesvc.exe'
      - '\wmiprvse.exe'
      - '\wmic.exe'
  selection_stage:
    CommandLine|contains:
      - 'rar.exe a -r'
      - '7z.exe a -t7z'
      - 'robocopy'
      - 'rclone copy'
      - 'mega.nz'
      - 'dropboxapi'
      - 'file.io'
      - 'transfer.sh'
      - '\ProgramData\'
      - '\Users\Public\'
  selection_remote:
    CommandLine|contains:
      - '\\'
      - '/accepteula'
      - 'admin$'
  condition: selection_lateral or (selection_stage and selection_remote)
falsepositives:
  - Software distribution, backup agents, SCCM/Intune, sanctioned archiving.
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1047
  - attack.collection
  - attack.exfiltration

// Microsoft Sentinel hunt: pre-ransomware staging/lateral movement markers aligned to N0N-style double extortion
let lookback = 14d;
let suspiciousAdminShare = dynamic(["admin$","c$","ipc$"]);
union isfuzzy=true
(
  SecurityEvent
  | where TimeGenerated > ago(lookback)
  | where EventID in (4624,4625,4648,4672,4768,4769,4771)
  | extend LogonType = toint(LogonType)
  | where (EventID==4625 and LogonType in (3,10) and IpAddress !in ("","-"))
       or (EventID==4624 and LogonType==10)
       or (EventID==4648 and TargetServerName has_any suspiciousAdminShare)
  | summarize FailedCount=countif(EventID==4625), SuccessCount=countif(EventID==4624), ExplicitCred=countif(EventID==4648), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by Account, IpAddress, Computer
  | where FailedCount > 20 and SuccessCount > 0 or ExplicitCred > 0
),
(
  DeviceProcessEvents
  | where TimeGenerated > ago(lookback)
  | where FileName in~ ("psexec.exe","psexesvc.exe","wmic.exe","rclone.exe","7z.exe","rar.exe","robocopy.exe","vssadmin.exe","bcdedit.exe","powershell.exe","cmd.exe")
  | where ProcessCommandLine has_any ("delete shadows","shadowcopy delete","/accepteula","admin$","rclone copy","mega.nz","transfer.sh","file.io","\\ProgramData\\","\\Users\\Public\\","Domain Admins","nltest /dclist")
  | summarize ProcCount=count(), Commands=make_set(ProcessCommandLine, 20), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by DeviceName, AccountName, InitiatingProcessAccountName
),
(
  DeviceNetworkEvents
  | where TimeGenerated > ago(lookback)
  | where RemoteUrl has_any ("mega.nz","dropbox","transfer.sh","file.io","anonfiles","gofile","pixeldrain") or RemoteIP in (" suspicious egress indicators via threat intel ")
  | summarize EgressConnections=count(), RemoteDestinations=make_set(strcat(RemoteIP,"|",RemoteUrl), 50), BytesSentEstimate=sum(tolong(0)) by DeviceName, InitiatingProcessFileName
)
| project-rename Entity=coalesce(Account, AccountName, InitiatingProcessFileName), Host=coalesce(Computer, DeviceName)
| summarize TotalSignals=sum(FailedCount+SuccessCount+ExplicitCred+ProcCount+EgressConnections), FirstActivity=min(FirstSeen), LastActivity=max(LastSeen) by Host, Entity
| where TotalSignals >= 10
| sort by TotalSignals desc

# Rapid N0N-style pre-detonation checks: exposed RDP, suspicious tasks/services, shadow-copy tampering, and new admin accounts.
$ErrorActionPreference = 'SilentlyContinue'
$since = (Get-Date).AddDays(-7)
$report = [ordered]@{}
$report.ExposedRDP = Get-NetTCPConnection -State Listen -LocalPort 3389 | Select-Object LocalAddress,LocalPort,OwningProcess
$report.NewAdminUsers = Get-LocalGroupMember -Group "Administrators" | Where-Object {$_.ObjectClass -eq 'User'} | Select-Object Name,PrincipalSource
$report.RecentScheduledTasks = Get-ScheduledTask | Where-Object {$_.Date -gt $since -or ($_.Actions.Execute -match 'powershell|cmd|wscript|cscript|mshta|rundll32')} | Select-Object TaskName,TaskPath,Date,Author,State
$report.RecentServices = Get-CimInstance Win32_Service | Where-Object {$_.InstallDate -gt $since -or $_.PathName -match 'psexec|psexesvc|temp|programdata|users\\public'} | Select-Object Name,DisplayName,State,StartMode,PathName,InstallDate
$report.ShadowCopyState = & vssadmin list shadows 2>&1
$report.ShadowDeletionEvents = Get-WinEvent -FilterHashtable @{LogName='System'; Id=7036,7040,7045; StartTime=$since} | Where-Object {$_.Message -match 'Volume Shadow|VSS|psexesvc|random'} | Select-Object TimeCreated,Id,ProviderName,Message
$report.SuspiciousAutoruns = Get-CimInstance Win32_StartupCommand | Where-Object {$_.Command -match 'powershell|mshta|rundll32|wscript|cscript|http|temp|programdata'} | Select-Object Name,Command,Location,User
$report | ConvertTo-Json -Depth 6

Incident Response Priorities

• T-minus detection checklist: New VPN success after failure bursts; impossible-travel logons; RDP/3389 listener exposed or re-enabled; Office spawning script interpreters; LSASS access or sekurlsa-style strings; vssadmin delete shadows, wmic shadowcopy delete, bcdedit recovery changes; PsExec service install/7045 events; WMI process creation on remote hosts; archive creation under ProgramData/Users\Public; rclone/7z/robocopy to external destinations; DNS spikes to file-sharing domains; EDR tamper/disable attempts; backup console credential use outside change windows.
• Assets likely prioritized for claimed exfiltration: Regulated records and identity data for healthcare/financial claims; customer/POS-adjacent data and order histories for retail/hospitality claims; source code, build secrets, CI/CD tokens, cloud keys, contracts, HR/payroll, tax/accounting files, legal matter data, backup catalogs, and domain admin credential stores. Validate what actually left via NetFlow/proxy/cloud audit, not the leak-site blurb.
• Containment order: 1) Isolate affected segments and disable compromised accounts/session tokens. 2) Block edge ingress to vulnerable VPN/firewall/vCenter/TeamCity paths; force MFA resets for remote access. 3) Preserve memory/images on first responders' highest-value hosts before shutdown. 4) Protect backups: offline/immutable copy verification, rotate backup credentials, disable delete rights. 5) Kill lateral tools: remove rogue services/tasks, revoke Kerberos tickets, reset krbtgt twice if domain-wide credential theft is credible. 6) Egress choke: deny unsanctioned file-sharing and newly seen ASNs. 7) Decide disclosure based on counsel/regulators; do not let criminal claims set the factual record.

Hardening Recommendations

• Immediate (24h): Patch or virtual-patch KEV-exposed edge services: Check Point IKEv1 auth weakness, Cisco FMC hard-coded credential path, VMware vCenter traversal, TeamCity deserialization, and malicious developer-console extensions. Enforce phishing-resistant MFA on VPN/RDP/OWA/admin portals; disable legacy IKEv1 where feasible; block inbound 3389 except brokered gateway with device health; disable Office macros by policy and block child processes from Office; alert on shadow-copy deletion and backup-job changes; deny outbound to consumer file-sharing without business justification.
• Short-term (2 weeks): Move remote access behind ZTNA with posture checks; segment backup/control planes from production; implement tiered admin with PAWs and gMSA; deploy canary shares and decoy credentials; require signed scripts and constrained language mode on servers; centralize VPN/firewall/vCenter/TeamCity/EDR logs into Sentinel with 14-30 day hot retention; run an exposure sweep for internet-facing vCenter/FMC/Check Point/TeamCity and developer extensions; test restoration from immutable backups and measure time-to-isolate for the sectors N0N is currently claiming.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub