Classification: TLP:CLEAR | Publication Date: 2026-11-11 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 45 Leak-Site Claims Posted in Bulk — Analysis & Detection Rules

Executive Summary

Security Arsenal's dark web monitoring has identified a bulk posting event by the ransomware group tracked as N0N. On 2026-11-09, the group listed 45 organizations on its Tor-based leak site in what appears to be a single coordinated dump — an unusual cadence that warrants immediate defensive attention regardless of claim validity.

Key observations:

• All 45 listings are single-source. Zero listings were independently observed by a second leak-site crawler. This does not mean the claims are false — it means our visibility into this posting wave comes from one collection point only.
• Sector data is unavailable. Every listing carries a sector classification of "Not Found," meaning we cannot confirm or deny any sector concentration from this dataset. Any downstream reporting claiming a sector focus for this wave is not supported by the data.
• Geographic concentration is US-heavy. Of the listings with country attribution: United States dominates, followed by Netherlands, Italy, Canada, United Kingdom, South Africa, and Denmark. Two listings carry no country attribution.
• The bulk-drop pattern itself is a signal. Mass same-day postings are historically associated with either (a) a mass-exploitation event against a common vulnerability or platform, or (b) backlog dumping — a gang publishing stale claims to inflate perceived operational tempo. Defenders should treat both scenarios as actionable.

Organizations operating VMware vCenter, JetBrains TeamCity, Cisco Secure FMC, or Check Point gateways should assume elevated targeting probability this cycle and execute the hunt queries below immediately. This CVE linkage is hypothesis based on current CISA KEV ransomware-confirmed exploitation, not evidence tying any specific named organization to any specific vulnerability.

Sourcing & Verification

• 0 of 45 listings were independently observed by a second leak-site crawler; 45 of 45 appear on a single source only (ransomware.live aggregation of N0N's .onion site).
• Inclusion in this briefing reflects the threat actor's claim and is NOT confirmation of a breach. A leak-site posting is an accusation by a criminal actor. No corroboration tier in our data — including multi-source — confirms a breach; only the organization itself or its regulator can do that.
• A named organization may dispute its listing, and a denial is likewise not proof the claim is false. Disclosure obligations vary by jurisdiction and sector, and not every incident is reportable — so neither silence nor denial settles the question.
• Security Arsenal will publish corrections to this briefing as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

Attribution caveat: N0N is a low-visibility actor in our collection. Where reliable intelligence is absent, we say so rather than fabricate profile detail.

• Aliases: None confirmed in our collection. The self-styled "N0N" branding is the only identifier observed on its leak infrastructure.
• Operating model: Unconfirmed. The bulk same-day posting of 45 claims with near-zero metadata (no sectors, sparse countries, numbered placeholder-style victim labels) is consistent with a closed or semi-closed group running mass exploitation and batch-publishing, rather than a mature RaaS program with affiliate-diverse victimology. RaaS operations typically show staggered posting cadence and richer per-victim detail.
• Ransom demands: No reliable figures available for this actor. Do not budget against invented numbers.
• Double extortion: The existence of a leak site at all confirms an extortion component beyond pure encryption — organizations named should assume the actor claims to hold exfiltrated data, whether or not that claim is substantiated.
• Initial access methods (hypothesis): No victim-specific vector is confirmed. However, the current CISA KEV catalog shows confirmed ransomware exploitation of edge and management-plane technologies — VMware vCenter (CVE-2026-59310), JetBrains TeamCity (CVE-2026-63077), Cisco Secure FMC (CVE-2026-20316), Check Point Security Gateway (CVE-2026-50751), and the Nx Console supply-chain incident (CVE-2026-48027). A bulk victim wave is mechanically consistent with mass scanning/exploitation of one or more such exposures. This is sector-level exposure analysis, not a claim that any named organization was compromised via any specific CVE.
• Dwell time: Unknown for this actor. As a planning assumption, use the industry-observed modern range of 24–96 hours from initial access to encryption for opportunistic mass-exploitation crews, and days to weeks where hands-on staging and exfiltration occur first.

Current Campaign Analysis

Sectors

Sector fields are "Not Found" for all 45 listings. We cannot characterize sector targeting from this data and will not guess. Enterprise defenders in any vertical should treat this as a general-alert event, not a sector-specific one.

Geographic Concentration

Listings with country attribution break down as: US (majority), NL, IT, CA, GB, ZA, DK, with two listings unattributed. This is a Western-economy-focused wave with US dominance — consistent with extortion economics (higher payment propensity and cyber-insurance coverage) rather than ideologically driven targeting.

Victim Profile

The victim labels on the leak site follow a numbered placeholder convention (e.g., Company #211, Company #210, Company #209) with no revenue or size data published. Numbered anonymized listings are sometimes used by gangs as a pre-negotiation pressure stage — full naming threatened if contact isn't made. Organizations that suspect they may correspond to an anonymized listing should check internal telemetry against the indicators below rather than wait for full publication.

Posting Frequency / Escalation Pattern

45 claims in a single day (2026-11-09) with no observed stagger. Two scenarios, both actionable:

1. Mass exploitation event — a single vulnerability or access broker dump yielded many footholds, published at once. If so, unpatched edge infrastructure in your environment is an open door right now.
2. Backlog inflation — stale or fabricated claims published for reputation. If so, the operational threat is lower but the extortion/reputational threat to named organizations remains real.

CVE Connection (Hypothesis Only)

We have no evidence linking any named listing to any CVE. That said, all five CVEs in scope are CISA KEV entries with confirmed ransomware use, and bulk posting waves correlate historically with mass exploitation of exactly this vulnerability class:

Action: If any of these products are in your estate and unpatched, treat this briefing as your forcing function.

Detection Engineering

The following analytics target the TTP cluster most consistent with a mass-exploitation → bulk-extortion playbook: edge appliance exploitation, post-exploitation tunneling, credential dumping, staging, and shadow-copy destruction.

---
title: Edge Appliance Exploitation Followed By Web Shell or Tunneling Tool
date: 2026/11/11
id: 8f2a1c4e-7b3d-4e5a-9c1f-n0n0edge0001
status: experimental
description: Detects suspicious child processes spawned by VPN/firewall/hypervisor management services consistent with post-exploitation of edge devices (e.g., Check Point, Cisco FMC, vCenter). Hypothesis-linked to bulk ransomware posting waves.
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\httpd.exe'
      - '\nginx.exe'
      - '\tomcat.exe'
      - '\java.exe'
      - '\vpnd.exe'
      - '\fw1.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\net.exe'
      - '\whoami.exe'
      - '\curl.exe'
      - '\wget.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate management-plane scripting; baseline by parent service and host role
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t1059
---
title: Pre-Encryption Staging - Shadow Copy Deletion And Backup Tampering
date: 2026/11/11
id: 8f2a1c4e-7b3d-4e5a-9c1f-n0n0encr0002
status: experimental
description: Detects Volume Shadow Copy deletion, backup catalog tampering, and recovery disabling — near-universal pre-detonation behavior across ransomware crews including bulk-posting actors.
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
      - '\wbadmin.exe'
  selection_cmd:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'resize shadowstorage'
      - 'delete catalog'
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
  condition: selection_img and selection_cmd
falsepositives:
  - Rare; backup administration outside change windows should be investigated
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.defense_evasion
---
title: Lateral Movement Via PsExec Or WMI Remote Execution
date: 2026/11/11
id: 8f2a1c4e-7b3d-4e5a-9c1f-n0n0latm0003
status: experimental
description: Detects PsExec-style service execution and WMI-spawned remote processes — the lateral movement backbone used to stage ransomware across estates before simultaneous detonation.
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec:
    Image|endswith:
      - '\PSEXESVC.exe'
      - '\psexec.exe'
      - '\psexec64.exe'
  selection_wmi:
    ParentImage|endswith: '\WmiPrvSE.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\rundll32.exe'
  condition: selection_psexec or selection_wmi
falsepositives:
  - Enterprise admin tooling (SCCM, PDQ); correlate with authorized deployment windows and admin accounts
level: high
tags:
  - attack.lateral_movement
  - attack.t1569.002
  - attack.t1047

// Security Arsenal — N0N bulk-campaign hunt
// Pre-ransomware staging: edge-origin logon anomalies + staging/archive creation + exfil-size transfers
// Microsoft Sentinel / Defender XDR
let lookback = 7d;
let stagingExt = dynamic([".zip", ".7z", ".rar", ".tar", ".gz"]);
let edgeOrigin =
    DeviceLogonEvents
    | where Timestamp >= lookback
    | where LogonType in ("Network", "RemoteInteractive", "Batch")
    | summarize FirstSeen=min(Timestamp), LogonCount=count(),
                SourceIPs=make_set(RemoteIP), Targets=make_set(DeviceName)
        by AccountName, bin(Timestamp, 1h)
    | where LogonCount >= 10  // burst remote logons — brute force or spray residue
    | project HourBucket=Timestamp, AccountName, LogonCount, SourceIPs, Targets;
let archiveStaging =
    DeviceFileEvents
    | where Timestamp >= lookback
    | where FolderPath has_any (stagingExt)
    | where FileSize > 50 * 1024 * 1024  // >50MB archives — data staging signature
    | extend HourBucket = bin(Timestamp, 1h)
    | summarize Archives=count(), Hosts=make_set(DeviceName), Files=make_set(FolderPath)
        by InitiatingProcessAccountName, HourBucket;
edgeOrigin
| join kind=inner archiveStaging on $left.AccountName == $right.InitiatingProcessAccountName and $left.HourBucket == $right.HourBucket
| project HourBucket, AccountName, LogonCount, SourceIPs, Archives, Files, Hosts
| order by HourBucket desc;

# Security Arsenal — N0N Rapid Triage Script (run elevated, per host or via GPO/Intune)
# Checks: exposed RDP, scheduled tasks added in last 7 days, shadow copy tampering, suspicious services
$ErrorActionPreference = 'SilentlyContinue'
$report = [ordered]@{}

# 1) RDP exposure check
$rdpEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$nlaEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp').UserAuthentication -eq 1
$report['RDP_Enabled'] = $rdpEnabled
$report['RDP_NLA_Enforced'] = $nlaEnabled
if ($rdpEnabled -and -not $nlaEnabled) { Write-Warning 'RDP enabled WITHOUT NLA — brute-force exposure. Disable or enforce NLA now.' }

# 2) Scheduled tasks created/modified in last 7 days (persistence)
$cutoff = (Get-Date).AddDays(-7)
$recentTasks = Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt $cutoff } |
    Select-Object TaskName, TaskPath, Date, @{n='Action';e={$_.Actions.Execute}}
$report['RecentScheduledTasks'] = $recentTasks
if ($recentTasks) { Write-Warning ('{0} scheduled tasks created in last 7 days — review for persistence.' -f $recentTasks.Count) }

# 3) Shadow copy inventory (ransomware staging often deletes these)
$shadows = Get-CimInstance Win32_ShadowCopy
$report['ShadowCopyCount'] = @($shadows).Count
if (@($shadows).Count -eq 0) { Write-Warning 'ZERO Volume Shadow Copies present — possible anti-recovery tampering (T1490).' }

# 4) Suspicious recently-created services (PsExec-style / ransomware service deployment)
$recentSvc = Get-CimInstance Win32_Service | Where-Object {
    $_.PathName -match 'ADMIN\$|PSEXESVC|\\\\.*\\(svc|tmp)|AppData.*\.exe'
} | Select-Object Name, DisplayName, PathName, StartMode, State
$report['SuspiciousServices'] = $recentSvc
if ($recentSvc) { Write-Warning 'Suspicious service paths detected — investigate lateral movement.' }

# 5) Edge product exposure inventory (KEV-linked hypothesis check)
$edgeChecks = @('vpxd','TeamCity','fmc','fw1','CheckPoint')
$procs = Get-Process | Select-Object -ExpandProperty ProcessName
$report['EdgeServicesRunning'] = $edgeChecks | Where-Object { $e=$_; $procs -match $e }

$report | ConvertTo-Json -Depth 4 | Out-File "$env:TEMP\N0N_Triage_$(Get-Date -Format yyyyMMdd_HHmm).json"
Write-Host 'Triage complete. Report written to TEMP. Review WARNING lines first.' -ForegroundColor Cyan

Incident Response Priorities

T-Minus Detection Checklist (Before Encryption Fires)

If you find any of these, you are likely inside the dwell window — act immediately:

1. Shadow copy deletion events (the Sigma rule above) — this is the strongest near-detonation signal.
2. Bulk archive creation (>50MB .zip/.7z/.rar on servers that don't normally produce them).
3. Burst network logons from a single account across many hosts in under an hour (see KQL).
4. New services with ADMIN$ or temp-path binaries — PsExec-class staging.
5. EDR/AV tampering: disabled sensors, deleted exclusions changes, or mass sensor check-in gaps.
6. Unusual outbound volume to cloud storage or unknown IPs from file servers/DCs.
7. CI/CD or management-plane anomalies: TeamCity agent registrations, vCenter logins from non-admin subnets, FMC/Check Point config exports.

Critical Assets Typically Prioritized for Exfiltration

For extortion-first crews, assume priority on: file servers and SharePoint/DFS roots, finance and HR shares, legal/contract repositories, backup servers (to destroy recovery), domain controllers (credential theft: NTDS.dit), and database backups. The leak site exists to monetize stolen data — encryption may be secondary or absent.

Containment Actions — Ordered by Urgency

1. Isolate, don't power off affected segments (preserve volatile evidence; kill lateral movement).
2. Disable the suspect accounts enterprise-wide; force credential resets for any account in the hunt output.
3. Block egress to unknown destinations at the perimeter; preserve firewall/ proxy logs first.
4. Snapshot/backup domain controllers and critical servers immediately to offline storage.
5. Pull edge appliance logs (VPN, firewall, vCenter, CI/CD) before rotation — initial access evidence lives there.
6. Engage IR retainer and legal counsel before any actor contact; do not visit the leak site from corporate infrastructure.
7. If you believe you correspond to an anonymized listing ("Company #NNN"), prioritize the exfiltration hunt — anonymized listings are frequently pre-negotiation.

Hardening Recommendations

Immediate (24 Hours)

• Patch or isolate all five KEV-listed products: vCenter (CVE-2026-59310), TeamCity (CVE-2026-63077), Cisco FMC (CVE-2026-20316), Check Point gateways (CVE-2026-50751), and audit developer machines for the malicious Nx Console version (CVE-2026-48027). If you cannot patch, remove management interfaces from any untrusted network.
• Enforce MFA on all remote access (VPN, RDP gateways, vCenter, firewall management) — no exceptions for service accounts on management planes.
• Disable or NLA-enforce RDP estate-wide; run the triage script on internet-facing hosts first.
• Deploy the three Sigma rules to your SIEM and alert shadow-copy deletion at critical severity with auto-page.
• Verify offline/immutable backups exist and restore-test one critical system this week.

Short-Term (2 Weeks)

• Segment management planes: vCenter, CI/CD, and firewall management on isolated VLANs reachable only from jump hosts with recorded sessions.
• Deploy egress filtering and DLP-aware proxying — bulk extortion requires bulk exfiltration; make large outbound transfers loud.
• Tier-0 hardening: no interactive logon to DCs, gMSA for services, LAPS for local admins, and WDAC/AppLocker on servers to blunt PsExec-class tooling.
• Canary files and honey credentials on file shares — cheap, high-fidelity pre-encryption tripwires.
• Tabletop an extortion-only scenario: your IR plan must handle data-leak extortion where no encryption ever fires.

This briefing reflects unverified threat-actor claims collected from criminal infrastructure. Security Arsenal will update or correct this analysis as additional collection becomes available. Named organizations may contact security@securityarsenal.com.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub