Classification: TLP:CLEAR | Publication Date: 2026-10-14 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 43 Listings in Latest Posting Wave — Maritime & Port Operations Campaign Analysis with Detection Rules

Executive Summary

Security Arsenal's dark web monitoring has identified a significant escalation in activity on the N0N ransomware group's Tor-based leak site. Of the group's last 100 postings, 43 are recent — and the composition of the newest wave is notable: on 2026-10-12, N0N listed at least eight organizations in the transportation and maritime sector, including port terminal operators, container shipping firms, a port machinery manufacturer, and a shipbuilder, spanning Indonesia, Brazil, Turkey, Singapore, South Korea, China, Japan, and Hong Kong. On 2026-10-13, the site added further listings including a US healthcare provider (Hunter Neurology), a US retailer (MarieBelle New York), and a financial services firm (PG Group / Pure Options).

Every listing below is an unverified claim by a criminal actor. Inclusion in this briefing reflects what N0N has posted on its leak site — nothing more. Defenders in maritime, port logistics, healthcare, retail, and financial services should treat this as a sector-level warning and run the detection content in this briefing against their environments regardless of whether their organization appears on the site.

Sourcing & Verification

• Corroboration status: 32 of 43 recent listings were independently observed by a second leak-site crawler (MULTI-SOURCE); 11 listings appear on a single source only. MULTI-SOURCE means two independent crawlers observed the gang make the posting — it does not mean a breach occurred.
• What a listing means: A leak-site posting is an accusation by a threat actor. Inclusion in this briefing reflects N0N's claim and is not confirmation that any named organization was breached, attacked, or is managing an incident. No corroboration tier in this dataset confirms a breach — only the organization itself or its regulator can do that.
• Disputes and denials: A named organization may dispute its listing. A denial is likewise not proof the claim is false: disclosure obligations vary by jurisdiction and sector, and not every incident is reportable. Neither silence nor denial settles the question.
• Corrections: Security Arsenal will publish corrections as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

Aliases and attribution. N0N is tracked by its leak-site branding; no widely adopted aliases have been publicly documented, and no definitive attribution to a known affiliate network or prior brand has been established. Analysts should treat any claimed lineage with skepticism until supported by infrastructure or payload overlap.

Operating model. The volume and sector breadth of recent postings are consistent with a Ransomware-as-a-Service (RaaS) or affiliate-driven model, in which multiple operators publish under a shared brand. The tight clustering of same-day maritime listings, however, suggests at least one highly active affiliate or a coordinated tasking — a pattern more typical of a directed campaign than organic affiliate churn.

Ransom demands. Publicly confirmed demand figures for N0N are not available in our dataset. Groups with comparable victim profiles typically scale demands to victim revenue, with mid-market demands commonly landing in the low-to-mid seven figures (USD). Treat any specific figure circulating in third-party reporting as unverified.

Initial access methods. Based on sector norms and tooling consistent with this class of actor, N0N's likely access paths include: exploitation of internet-facing remote access services (VPN concentrators, firewalls, RDP), spear-phishing with macro- or script-based payloads, and abuse of remote management tooling. See the CVE discussion below for sector-level exposure hypotheses.

Extortion model. Double extortion: data exfiltration prior to encryption, with leak-site publication used as leverage. The presence of named listings implies the gang claims to hold victim data.

Dwell time. No confirmed dwell-time telemetry exists for N0N specifically. Comparable groups typically operate on a 3–14 day window from initial access to detonation, with exfiltration occurring in the final 48–72 hours. That window is the defender's opportunity — see the T-minus checklist below.

Current Campaign Analysis

Sectors targeted

From the live leak-site data, N0N's recent listings concentrate in:

• Transportation / Maritime (dominant): GlobalNet LCL (port agency operations, ID), Santos Brasil (port operations, BR), Asyaport (container terminal operations, TR), Ocean Network Express (container shipping, SG), MGNP (port terminal operations, KR), Portonave (container terminal operations, BR), Polaris Shipping (dry bulk shipping, KR), Yusen Logistics Hong Kong (3PL logistics, HK)
• Manufacturing (maritime-adjacent): ZPMC (port machinery and terminal engineering, CN); Tsuneishi / Kambara Kisen (shipbuilding and ship management, JP)
• Healthcare: Hunter Neurology
• Retail & E-Commerce: MarieBelle New York (US)
• Financial Services: PG Group (Pure Options)
• Unclassified: Company #63, Company #64

The maritime cluster is the story. Eight transportation listings plus two maritime-adjacent manufacturers were posted on a single day (2026-10-12). Whether this reflects a genuine coordinated intrusion campaign, bulk purchase of access from an initial access broker, or leak-site marketing is unknown — but the defensive implication is the same: port authorities, terminal operators, shipping lines, and their OT-adjacent IT networks are in this actor's current scope.

Geographic concentration

Listed countries: US, ID, BR, TR, SG, KR, CN, JP, HK. The maritime wave is heavily Asia-Pacific and Latin America weighted, consistent with the geography of global container throughput. The 2026-10-13 postings extend reach into the US.

Victim profile

The named maritime and logistics organizations are predominantly mid-to-large enterprises — regional terminal operators and international shipping/logistics firms with estimated revenues from tens of millions to multiple billions of USD. The healthcare and retail listings are smaller mid-market organizations. This mixed profile is typical of an affiliate ecosystem: one or more affiliates pursuing large maritime targets, others opportunistically hitting softer mid-market victims.

Posting frequency and escalation

The pattern shows batch publishing: a heavy maritime batch on 2026-10-12 followed by a mixed-sector batch on 2026-10-13. Batch posting is often a pressure tactic (dumping multiple names at once to demonstrate capability) and frequently follows a quiet period of intrusions. Expect additional batches over the next 7–14 days as claimed negotiation windows expire.

CVE exposure hypotheses (sector-level, unconfirmed for any named victim)

We have no evidence linking any specific CVE to any specific named listing. However, the following CISA KEV entries — all confirmed as exploited by ransomware actors — represent plausible sector-level exposure consistent with this class of campaign, and any organization in the targeted sectors should verify patch status immediately:

• CVE-2026-50751 (Check Point Security Gateway, improper authentication in IKEv1 key exchange): perimeter VPN/firewall devices are the most common initial access vector in bulk ransomware campaigns. Unpatched gateways at maritime and logistics firms are a primary hypothesis.
• CVE-2026-20316 (Cisco Secure Firewall Management Center, hard-coded password): management-plane compromise enables policy manipulation and follow-on access.
• CVE-2026-59310 (VMware vCenter path traversal): virtualization infrastructure is the highest-value encryption target; vCenter compromise enables mass hypervisor-level detonation.
• CVE-2026-63077 (JetBrains TeamCity, deserialization / unauthenticated RCE): CI/CD servers hold credentials and signing keys; a classic pivot into software-adjacent manufacturers like port machinery and shipbuilding engineering environments.
• CVE-2026-48027 (Nx Console, embedded malicious code): supply-chain exposure for development environments.

These are framed strictly as exposure hypotheses for the targeted sectors — not as established initial access vectors for any named organization.

Detection Engineering

The following detection content targets the TTPs consistent with double-extortion ransomware operations of this type: remote access exploitation, lateral movement via PsExec/WMI, data staging and exfiltration, and pre-encryption defense evasion (shadow copy deletion).

---
title: N0N-Style Ransomware - RDP Brute Force Followed by Anomalous Admin Logon
id: 8f3a2c11-n0n1-4a2b-9c3d-000000000001
status: experimental
description: Detects password-spray or brute-force patterns against RDP (multiple 4625 failures) followed by a successful logon (4624 type 10) from the same source — consistent with initial access via exposed remote access services observed in bulk ransomware campaigns.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
date: 2026/10/14
logsource:
  product: windows
  service: security
detection:
  sel_fail:
    EventID: 4625
    LogonType: 10
  sel_success:
    EventID: 4624
    LogonType: 10
  condition: sel_fail and sel_success
  timeframe: 10m
falsepositives:
  - Legitimate admin mistyped credentials followed by successful login
  - Vulnerability scanners
level: high
tags:
  - attack.initial_access
  - attack.t1110
  - attack.t1133
---
title: N0N-Style Ransomware - PsExec or WMI Remote Service Creation for Lateral Movement
id: 8f3a2c11-n0n1-4a2b-9c3d-000000000002
status: experimental
description: Detects remote service installation (7045) with PsExec-style service names or WMIC process creation on remote hosts — a hallmark of pre-encryption lateral movement and mass deployment staging.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
date: 2026/10/14
logsource:
  product: windows
  service: system
detection:
  sel_service:
    EventID: 7045
    ServiceFileName|contains:
      - 'PSEXESVC'
      - '\\ADMIN$\\'
      - '\\IPC$\\'
  sel_suspicious_name:
    ServiceName|re: '^[A-Za-z0-9]{8}$'
  condition: sel_service or (sel_service and sel_suspicious_name)
falsepositives:
  - Legitimate software deployment tools (SCCM, PDQ)
  - EDR/IT management agents
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002
  - attack.t1047
---
title: N0N-Style Ransomware - Pre-Encryption Defense Evasion and Data Staging
id: 8f3a2c11-n0n1-4a2b-9c3d-000000000003
status: experimental
description: Detects Volume Shadow Copy deletion, backup catalog tampering, and mass archive staging (rar/7z invoked against data directories) — the final 48-72 hours of a double-extortion intrusion before detonation.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
date: 2026/10/14
logsource:
  category: process_creation
  product: windows
detection:
  sel_vss:
    - CommandLine|contains|all:
        - 'vssadmin'
        - 'delete shadows'
    - CommandLine|contains|all:
        - 'wmic'
        - 'shadowcopy'
        - 'delete'
    - CommandLine|contains|all:
        - 'bcdedit'
        - 'recoveryenabled'
        - 'no'
  sel_staging:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\7za.exe'
    CommandLine|contains:
      - ' -p'
      - ' a '
  condition: sel_vss or sel_staging
falsepositives:
  - Legitimate backup maintenance scripts
  - IT archival operations
level: critical
tags:
  - attack.defense_evasion
  - attack.t1490
  - attack.collection
  - attack.t1560.001

// N0N-style pre-ransomware staging hunt: lateral movement tooling + staging + defense evasion
// correlated on a single host within a 24h window. Run across the last 14 days.
let Window = 14d;
let Lateral =
    DeviceProcessEvents
    | where TimeGenerated > ago(Window)
    | where ProcessCommandLine has_any ("psexec", "\\ADMIN$", "wmic /node:", "Invoke-WMIMethod", "Enter-PSSession")
    | project LateralTime=TimeGenerated, DeviceName, LateralCmd=ProcessCommandLine, InitiatingProcessAccountName;
let DefenseEvasion =
    DeviceProcessEvents
    | where TimeGenerated > ago(Window)
    | where ProcessCommandLine has_any ("vssadmin delete shadows", "shadowcopy delete", "wbadmin delete", "bcdedit", "recoveryenabled no")
    | project EvadeTime=TimeGenerated, DeviceName, EvadeCmd=ProcessCommandLine;
let Staging =
    DeviceProcessEvents
    | where TimeGenerated > ago(Window)
    | where FileName in~ ("rar.exe", "7z.exe", "7za.exe", "winrar.exe") or ProcessCommandLine has_any ("mega", "rclone", "filezilla", "curl.exe -T")
    | project StageTime=TimeGenerated, DeviceName, StageCmd=ProcessCommandLine, FileName;
Lateral
| join kind=inner DefenseEvasion on DeviceName
| join kind=inner Staging on DeviceName
| where (EvadeTime - LateralTime) between (0m .. 24h)
| project DeviceName, InitiatingProcessAccountName, LateralTime, LateralCmd, StageTime, StageCmd, EvadeTime, EvadeCmd
| sort by LateralTime desc;

# Security Arsenal - Rapid Ransomware Pre-Detonation Triage (run elevated, per host or via GPO/Intune)
# Checks: exposed RDP, scheduled tasks created in last 7 days, shadow copy health, suspicious services
Write-Host '=== [1/4] RDP Exposure Check ===' -ForegroundColor Cyan
$rdp = Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue
if ($rdp.fDenyTSConnections -eq 0) {
    Write-Warning 'RDP is ENABLED. Verify it is not internet-exposed (check perimeter firewall for inbound 3389).'
} else { Write-Host 'RDP disabled on this host.' }

Write-Host '=== [2/4] Scheduled Tasks Created in Last 7 Days ===' -ForegroundColor Cyan
Get-ScheduledTask | ForEach-Object {
    $info = Get-ScheduledTaskInfo $_
    if ($_.Date -and ([datetime]$_.Date) -gt (Get-Date).AddDays(-7)) {
        [PSCustomObject]@{ TaskName=$_.TaskName; Path=$_.TaskPath; Created=$_.Date; Author=$_.Author }
    }
} | Format-Table -AutoSize

Write-Host '=== [3/4] Volume Shadow Copy Status ===' -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) { Write-Warning 'NO shadow copies found — possible anti-recovery tampering (T1490).' }
else { $shadows | Select-Object DeviceObject, InstallDate | Format-Table -AutoSize }

Write-Host '=== [4/4] Recently Installed Services (possible PsExec-style staging) ===' -ForegroundColor Cyan
Get-CimInstance Win32_Service | Where-Object {
    $_.PathName -match 'ADMIN\$|PSEXESVC|Temp' -or
    ($_.Name -match '^[A-Za-z0-9]{8}$' -and $_.State -eq 'Running')
} | Select-Object Name, DisplayName, State, PathName | Format-Table -AutoSize
Write-Host '=== Triage complete. Escalate any hits to your IR team immediately. ===' -ForegroundColor Green

Incident Response Priorities

T-minus detection checklist (before encryption fires)

1. Exfiltration signals first: egress spikes to cloud storage (MEGA, Dropbox, rclone endpoints), sustained outbound transfers from file servers or database hosts, FTP/SFTP sessions to unfamiliar IPs. In double extortion, the data leaves before anything is encrypted.
2. Anti-recovery activity: vssadmin/wmic shadow copy deletion, bcdedit recovery suppression, backup catalog deletion (T1490). This is the strongest near-term detonation indicator.
3. Mass staging: archive utilities (rar/7z) executing against shared drives; files consolidated into staging directories on a single host.
4. Lateral movement spread: PsExec-style service creation (Event 7045) appearing on multiple servers within hours; new local admin accounts; abnormal SMB admin-share writes from a single source host.
5. EDR/logging tampering: agents going quiet en masse, audit policy changes, or event log clearing (Event 1102).

Critical assets this class of actor prioritizes for exfiltration

• For maritime/port victims: terminal operating system (TOS) data, cargo manifests, customs documentation, bills of lading — operationally sensitive and time-critical, maximizing pressure.
• For healthcare: patient records (PHI) — high regulatory leverage.
• For financial services: client PII, transaction records, and financial statements.
• Universally: domain controller backups (NTDS.dit), email archives of executives and legal counsel, cyber insurance policies (used to calibrate demands), and backup configurations.

Containment actions, ordered by urgency

1. Isolate, do not power off suspected staging/exfil hosts (preserve memory for forensics); disable switch ports or apply host firewall isolation.
2. Cut egress: emergency deny rules for non-business cloud storage and known exfil endpoints at the perimeter.
3. Reset credentials in priority order: domain admins → service accounts → VPN/firewall management planes → all remote access accounts. Assume Kerberos compromise (krbtgt double-reset if domain-wide spread is suspected).
4. Disable the suspected access path: patch or take offline any unpatched perimeter VPN/firewall (see KEV list); block inbound RDP at the edge regardless.
5. Protect backups: verify offline/immutable copies are intact and isolated before any recovery conversation; snapshot hypervisor infrastructure.
6. Preserve evidence: firewall/VPN logs, authentication logs, and EDR telemetry for the full suspected dwell window (assume at least 14 days).

Hardening Recommendations

Immediate (24 hours)

• Patch the perimeter: verify remediation of CVE-2026-50751 (Check Point IKEv1), CVE-2026-20316 (Cisco FMC), and CVE-2026-59310 (vCenter) on any exposed appliance. These are CISA KEV entries with confirmed ransomware exploitation.
• Kill inbound RDP at the edge; require VPN + MFA for all remote administration. Audit for RDP brute-force patterns (Event 4625, LogonType 10).
• Enforce phishing-resistant MFA on VPN, email, and remote access; disable IKEv1 aggressive mode where present.
• Deploy the Sigma and KQL content above and alert on shadow copy deletion as critical severity.
• Verify backup immutability and confirm offline copies exist and are restorable.

Short-term (2 weeks)

• Segment port/terminal operational networks from corporate IT with enforced one-way or brokered data flows — maritime victims face OT-adjacent risk that flat networks amplify.
• Deploy egress filtering and DLP alerting on bulk outbound transfers from file servers and database hosts.
• Restrict lateral movement tooling: block PsExec/WMI remote execution for non-admin workstations via application control; implement tiered administration with dedicated PAWs.
• Harden CI/CD infrastructure (CVE-2026-63077 class): isolate build servers, rotate secrets stored in them, and enforce signed artifact pipelines — particularly for engineering/manufacturing environments.
• Stand up leak-site monitoring for your organization's name, brands, and executive identities so a listing — verified or not — triggers a predefined response playbook rather than a scramble.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub