Classification: TLP:CLEAR | Publication Date: 2026-11-11 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 48 Leak-Site Listings — Retail & Healthcare Exposure, Targeting Analysis and Detection Rules

Executive Summary

N0N has listed 48 organizations in its recent leak-site activity, with named claims touching Retail & E-Commerce and Healthcare and a large set of anonymized or unresolved listings marked Not Found. The named multi-source listings are Landmark Group, tagged Retail & E-Commerce in AE and published 2026-11-10, and Vertex Pharmaceuticals Incorporated, tagged Healthcare in US and published 2026-11-09. These are criminal claims, not confirmed breaches. The listing set also includes Company #199 through Company #211, mostly single-source, mostly published 2026-11-09, with US, NL, IT and unknown-country tags in the detailed sample. Country visibility across the campaign dataset is AE, US, NL, IT, CA, GB, ZA and DK. Treat the leak site as an extortion signal: useful for prioritization, dangerous if treated as proof.

Security teams in retail/e-commerce, healthcare, pharmaceutical research, and organizations with unresolved third-party exposure should assume N0N is attempting pressure operations and hunt for pre-encryption behavior now: edge-device exploitation, VPN or RDP access anomalies, macro-driven execution, remote service creation, WMI or PsExec-style movement, shadow-copy tampering, archive staging, and egress to cloud storage or bulletproof hosting. Any connection between the listed organizations and the CISA KEV items below is unproven; use those CVEs as sector-level exposure hypotheses only.

Sourcing & Verification

Of the 48 listings in this dataset, 2 were independently observed by a second leak-site crawler and are marked MULTI-SOURCE; 46 appear on ransomware.live only and remain SINGLE-SOURCE. MULTI-SOURCE means two independent crawlers saw the gang make the claim; it does not confirm that any breach occurred. No tier in this data confirms compromise. Inclusion reflects the threat actor's claim and is not confirmation of a breach, data theft, encryption, or operational impact.

A named organization may dispute a listing. A denial is likewise not proof that the claim is false: disclosure obligations vary by jurisdiction, contract, regulator, materiality, and whether personal data or reportable systems are involved, so neither silence nor denial settles the question. Security Arsenal will publish corrections and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

Public attribution for N0N remains limited in this dataset, so the profile below separates what is observed from what is operationally useful but not proven.

• Known aliases: none are established by this feed. Do not merge N0N with similarly named crews without infrastructure, payload, victim-communication, or negotiation-portal overlap.
• Operating model: unconfirmed. The high posting cadence and same-day clustering are consistent with an affiliate-driven or RaaS-like publishing workflow, but a closed group can also batch claims. Treat RaaS as a working hypothesis only.
• Ransom demands: not available in this dataset. Do not infer demand size from victim brand value; extortion amounts are frequently tailored after access brokers, insurers, or negotiators assess data sensitivity and ability to pay.
• Initial access: no evidence ties a named listing to a specific exploit. Defensive planning should cover the common ransomware ingress set: phishing with macro or script execution, exposed or weakly authenticated RDP, VPN and remote-access edge devices, compromised service accounts, unpatched virtualization and management planes, CI/CD compromise, and malicious or tampered developer tooling.
• Extortion approach: leak-site publication implies double-extortion intent even when no data sample is visible. Assume pressure may escalate from listing to data snippets, countdowns, reseller or journalist outreach, and threats to contact customers or regulators.
• Dwell time: not measurable from a leak site. Enterprise plans should assume days to weeks between ingress and encryption and design detections for the quiet middle: credential theft, discovery, backup tampering, and staged archives.

Current Campaign Analysis

Sector pressure

The two named multi-source claims concentrate in Retail & E-Commerce and Healthcare. Landmark Group is listed under Retail & E-Commerce in AE. Vertex Pharmaceuticals Incorporated is listed under Healthcare in US. The remaining detailed listings are labeled Not Found and should not be sector-assigned. Across the full 48-listing set, the target-sector field is Retail & E-Commerce, Healthcare, and Not Found; that mixture suggests N0N is either publishing unresolved access-broker inventory, obscuring victim identities during negotiation, or aggregating opportunistic intrusions rather than running a purely vertical campaign.

Geographic concentration

The campaign dataset names AE, US, NL, IT, CA, GB, ZA and DK. In the detailed sample, US appears repeatedly among anonymized Company listings, NL and IT appear once each, AE carries the named retail claim, and two entries have unknown country. This is a broad Western and Middle East footprint rather than a single-country operation. Multinational organizations should correlate subsidiary, franchise, logistics, clinic, research, and managed-service-provider exposure instead of checking headquarters only.

Victim profile and sizing

Reliable company size cannot be established for Company #199 through Company #211 because the sector and sometimes country are unresolved. For the named claims, the sectors imply high-value pressure surfaces: retail/e-commerce environments commonly hold customer, order, loyalty, supplier, ERP and payment-adjacent workflows; healthcare and pharmaceutical environments commonly hold identity data, clinical-adjacent file stores, imaging exports, research collaboration data, billing and regulated records. Revenue estimates should not be used to validate the gang's claim. The safe analytical point is narrower: N0N is presenting a blend of brand-name claims and opaque inventory, which is consistent with extortion operations that trade on uncertainty.

Posting frequency and escalation

The detailed sample shows a burst on 2026-11-09: Vertex Pharmaceuticals Incorporated plus Company #199 through Company #207 and Company #209 through Company #211 are listed that day, with Landmark Group following on 2026-11-10. A same-day block of anonymized listings often indicates batch publishing, negotiation pressure, or crawler synchronization rather than same-day intrusion. Watch for escalation signals: new proof packs, countdown timers, reposting after denial, sudden removal which may indicate payment or dispute, and redistribution through Telegram, XSS-like forums, or clearweb mirrors.

CVE exposure hypotheses

No evidence links any named organization to a specific CVE. The following CISA KEV items are confirmed ransomware-relevant exposure and should be treated as sector-level risk only:

• CVE-2026-59310, Broadcom VMware vCenter path traversal: prioritize vCenter isolation, patching, and audit of management-plane logons. Ransomware crews value virtualization control because it can turn one foothold into fleet-wide encryption.
• CVE-2026-63077, JetBrains TeamCity deserialization: treat CI/CD as an identity and artifact store. Compromise can expose secrets, source, signing material, and deployment paths.
• CVE-2026-20316, Cisco Secure Firewall Management Center hard-coded password: management consoles for network security gear are high-impact persistence and policy-manipulation points.
• CVE-2026-50751, Check Point Security Gateway improper authentication in IKEv1: review VPN edge configuration and disable legacy exchange paths where operationally possible.
• CVE-2026-48027, Nx Console embedded malicious code: investigate developer workstations and build agents for supply-chain execution rather than assuming perimeter-only entry.

Detection Engineering

The detections below target behaviors common in ransomware operations and relevant to N0N's plausible playbook: edge or remote-access entry, macro execution, lateral movement with PsExec or WMI, and pre-encryption staging. Tune thresholds to environment baseline and validate in a lab before broad enforcement.

---
title: N0N Hunt - External RDP Brute Force Followed By Success
id: 9f0d0d31-7a65-4d66-8f25-n0nrdp001
status: experimental
description: Detects bursts of failed remote interactive logons followed by a successful RDP or network logon from the same source, consistent with VPN or RDP password attack leading to access.
author: Security Arsenal
date: 2026/11/11
modified: 2026/11/11
references:
  - https://securityarsenal.com/darkside
logsource:
  product: windows
  service: security
detection:
  selection_failed:
    EventID: 4625
    LogonType:
      - 3
      - 10
  selection_success:
    EventID: 4624
    LogonType:
      - 3
      - 10
  filter_internal:
    IpAddress|startswith:
      - '10.'
      - '192.168.'
      - '172.16.'
      - '172.17.'
      - '172.18.'
      - '172.19.'
      - '172.20.'
      - '172.21.'
      - '172.22.'
      - '172.23.'
      - '172.24.'
      - '172.25.'
      - '172.26.'
      - '172.27.'
      - '172.28.'
      - '172.29.'
      - '172.30.'
      - '172.31.'
      - '127.'
  condition: selection_failed and selection_success and not filter_internal
timeframe: 15m
falsepositives:
  - Remote access gateways that NAT internal clients
  - Penetration tests and approved vulnerability scanners
level: high
tags:
  - attack.initial_access
  - attack.t1110
  - attack.t1133
  - n0n
---
title: N0N Hunt - Office Macro Spawns Script Or Shell
id: 2d6f2bc6-9a4f-4f30-a6c1-n0nmacro02
status: experimental
description: Detects Office applications launching command shells, script hosts, mshta, rundll32 or PowerShell shortly after document open, consistent with phishing macro execution.
author: Security Arsenal
date: 2026/11/11
modified: 2026/11/11
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - 'winword.exe'
      - 'excel.exe'
      - 'powerpnt.exe'
      - 'outlook.exe'
  selection_child:
    Image|endswith:
      - 'powershell.exe'
      - 'pwsh.exe'
      - 'cmd.exe'
      - 'wscript.exe'
      - 'cscript.exe'
      - 'mshta.exe'
      - 'rundll32.exe'
      - 'regsvr32.exe'
      - 'msiexec.exe'
  filter_signed_ms:
    CommandLine|contains:
      - 'Office'
      - 'Microsoft Office'
  condition: selection_parent and selection_child and not filter_signed_ms
falsepositives:
  - Legacy line-of-business macros
  - Document management plugins
level: high
tags:
  - attack.initial_access
  - attack.t1566.001
  - attack.t1204.002
  - n0n
---
title: N0N Hunt - Pre Encryption Staging And Remote Execution
id: 6e2a9a13-46b0-4c8c-9d44-n0nstage03
status: experimental
description: Detects shadow copy tampering, archive tool execution, remote service creation and PsExec or WMI style staging associated with ransomware preparation and double extortion.
author: Security Arsenal
date: 2026/11/11
modified: 2026/11/11
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_shadow:
    CommandLine|contains:
      - 'delete shadows'
      - 'resize shadowstorage'
      - 'recoveryenabled no'
      - 'shadowcopy delete'
      - 'delete catalog'
  selection_stage:
    Image|endswith:
      - '7z.exe'
      - '7za.exe'
      - 'rar.exe'
      - 'winrar.exe'
      - 'rclone.exe'
      - 'megacmd.exe'
      - 'winscp.exe'
      - 'filezilla.exe'
  selection_remote:
    Image|endswith:
      - 'psexec.exe'
      - 'psexesvc.exe'
      - 'wmic.exe'
      - 'sc.exe'
      - 'schtasks.exe'
      - 'winrm.exe'
  condition: 1 of selection_*
falsepositives:
  - Backup administrators running maintenance
  - Software distribution and packaging teams
  - Forensic collection using approved archive tools
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.t1560.001
  - attack.t1021.002
  - attack.t1048
  - n0n

let lookback = 14d;
let staging_tools = dynamic(['vssadmin.exe','bcdedit.exe','wbadmin.exe','rar.exe','7z.exe','7za.exe','winrar.exe','rclone.exe','megacmd.exe','winscp.exe','filezilla.exe','curl.exe']);
let remote_exec = dynamic(['psexec.exe','psexesvc.exe','wmic.exe','wmiprvse.exe','winrm.exe','schtasks.exe','sc.exe']);
let proc = DeviceProcessEvents
| where Timestamp >= ago(lookback)
| where FileName in~ (staging_tools)
   or FileName in~ (remote_exec)
   or ProcessCommandLine has_any ('delete shadows','resize shadowstorage','recoveryenabled no','shadowcopy delete','start psexesvc','/create','ADMIN$','C$')
| project DeviceName, AccountName, FileName, ProcessCommandLine, Timestamp, InitiatingProcessFileName;
let svc = SecurityEvent
| where TimeGenerated >= ago(lookback)
| where EventID == 7045
| where ServiceName has_any ('PSEXESVC','paexec','remcom') or ServiceFileName has_any ('ADMIN$','C$')
| project Device=Computer, Account=AccountName, ServiceName, ServiceFileName, TimeGenerated;
let rdp = SecurityEvent
| where TimeGenerated >= ago(lookback)
| where EventID in (4624,4625) and LogonType in (3,10)
| summarize Failed=countif(EventID==4625), Success=countif(EventID==4624), Sources=dcount(IpAddress) by Computer, Account=AccountName, bin(TimeGenerated,15m)
| where Failed >= 10 and Success >= 1;
proc
| summarize StagingEvents=count(), Tools=make_set(FileName), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, AccountName
| join kind=leftouter (svc | summarize RemoteServices=count(), Services=make_set(ServiceName) by Device, Account) on $left.DeviceName == $right.Device and $left.AccountName == $right.Account
| join kind=leftouter (rdp | summarize Rdp15mBursts=count(), MaxFailed=max(Failed), MaxSources=max(Sources) by Computer) on $left.DeviceName == $right.Computer
| extend RiskScore = StagingEvents*2 + toint(RemoteServices)*5 + toint(Rdp15mBursts)*3
| sort by RiskScore desc, LastSeen desc

# Rapid ransomware pre-detonation check for a Windows host or small fleet. Run as administrator; review before remediation.
$days = 7
$since = (Get-Date).AddDays(-$days)
Write-Output '=== RDP listener check ==='
Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue | Where-Object {$_.LocalPort -eq 3389} | Select-Object LocalAddress,LocalPort,OwningProcess
Write-Output '=== Scheduled tasks created or changed recently ==='
Get-ScheduledTask | Where-Object {$_.Date -ge $since -or ($_.TaskPath -notlike '*Microsoft*' -and $_.State -ne 'Disabled')} | Select-Object TaskName,TaskPath,State,Date
Write-Output '=== Suspicious services and remote execution residue ==='
Get-CimInstance Win32_Service | Where-Object {$_.Name -match 'PSEXESVC|paexec|remcom' -or $_.PathName -match 'ADMIN|Temp|AppData|ProgramData'} | Select-Object Name,State,StartMode,PathName
Write-Output '=== Staging and impact tools in process command lines ==='
Get-CimInstance Win32_Process | Where-Object {$_.CommandLine -match 'delete shadows|resize shadowstorage|recoveryenabled no|rclone|7za|winrar|filezilla|winscp|psexec|wmic|schtasks'} | Select-Object ProcessId,Name,CommandLine,CreationDate
Write-Output '=== Volume Shadow Copy visibility ==='
vssadmin list shadows
Write-Output '=== Recent failed and successful remote logons ==='
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4625; StartTime=$since} -MaxEvents 5000 -ErrorAction SilentlyContinue | Where-Object {$_.Message -match 'Logon Type:\s+(3|10)'} | Select-Object TimeCreated,Id,Message | Group-Object Id | Select-Object Name,Count
Write-Output '=== Local administrators changed recently ==='
Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue | Select-Object Name,PrincipalSource

Incident Response Priorities

T-minus checklist: before encryption fires

Prioritize signals that usually appear hours to days before detonation:

• Edge and remote access: VPN concentrator alerts, impossible travel, new device certificates, legacy IKEv1 negotiation, repeated RDP failures followed by success, service-account logons from unusual countries including AE, US, NL, IT, CA, GB, ZA or DK when business context is absent.
• Identity: new local administrators, sudden Group Policy changes, DCSync-like replication requests, abnormal Kerberos ticket use, disabled MFA prompts, helpdesk password resets clustered before off-hours.
• Lateral movement: Event 7045 service installs, PSEXESVC, WMI process creation, WinRM enablement, schtasks to many hosts, ADMIN$ or C$ access bursts, server-to-server SMB where no change window exists.
• Staging: 7z, WinRAR, rclone, MEGAcmd, WinSCP, FileZilla, curl to rare domains, large archives on file servers, database exports outside maintenance, compression of research, ERP, POS-adjacent, EHR-adjacent, or customer data shares.
• Impact preparation: vssadmin or wbadmin deletion, bcdedit recovery changes, backup console logons followed by job deletion, EDR service tampering, safe-mode boot artifacts, mass file rename tests on a subset of hosts.

Critical assets this gang may pressure

Do not assume the leak list proves data theft. Plan around what ransomware pressure teams typically monetize and what the observed sectors expose: identity providers and domain controllers; virtualization management such as vCenter; backup control planes and immutable repositories; file shares with customer, employee, patient, research, supplier, order and financial data; CI/CD such as TeamCity where secrets and signing keys live; firewall and VPN management such as FMC or Check Point gateways; database exports; NAS devices; executive mailboxes; legal and insurance documents. For retail/e-commerce, protect order management, loyalty, ERP, warehouse and franchise portals without implying cardholder data exposure unless evidence exists. For healthcare and pharma, prioritize EHR-adjacent shares, PACS exports, research collaboration spaces, billing, HR and regulated records.

Containment actions ordered by urgency

1. Preserve evidence first: capture volatile artifacts from suspected patient-zero hosts, firewall and VPN logs, authentication logs, EDR telemetry, and leak-site screenshots before powering systems down.
2. Break remote access: disable inbound RDP, restrict VPN to known device posture, revoke suspicious sessions and tokens, rotate exposed service and helpdesk credentials, and enforce MFA re-enrollment.
3. Isolate identity and management planes: protect domain controllers, vCenter, TeamCity, backup consoles, FMC and security gateways from lateral reachability; block server-to-server SMB, WMI and WinRM except from approved admin hosts.
4. Stop staging and egress: deny rare cloud storage, pastebin-like, MEGA, anonymous file transfer and uncategorized egress at proxy and firewall; retain DNS and TLS metadata for scoping.
5. Contain endpoints surgically: isolate hosts with shadow-copy deletion, remote service creation, or archive staging; avoid broad shutdowns that destroy memory evidence unless encryption is actively spreading.
6. Protect recoverability: verify backups are offline or immutable, snapshot key VMs where safe, disable backup-job deletion rights, and test restore of one critical service before declaring containment.
7. Coordinate communications: legal, privacy, cyber insurance, executive leadership and regulators should use verified facts only. Public statements should not validate a criminal claim beyond confirmed evidence.

Hardening Recommendations

Immediate, 24 hours

• Patch or mitigate the listed KEV exposures where present: vCenter CVE-2026-59310, TeamCity CVE-2026-63077, Cisco FMC CVE-2026-20316, Check Point CVE-2026-50751, and investigate Nx Console supply-chain exposure under CVE-2026-48027. This is exposure reduction, not an assertion that N0N used these flaws.
• Block inbound RDP from the internet, require VPN plus device compliance, disable legacy IKEv1 paths where feasible, rotate credentials tied to remote access, and alert on failed logon bursts followed by success.
• Deploy the Sigma and KQL hunts above; create incident tickets for any host with shadow-copy deletion plus archive tooling or remote service creation.
• Disable Office macros from the internet, enable attack surface reduction rules, and block Office child processes such as PowerShell, mshta, wscript and rundll32 unless explicitly approved.
• Put backup control planes behind separate admin credentials, require phishing-resistant MFA, restrict delete rights, confirm immutable copies, and remove standing access from normal workstation networks.
• Egress-filter uncommon storage and file-transfer endpoints; alert on new domains, high-volume uploads, and archive tools executed by non-admin users.
• Rehearse communications templates that say an organization is aware of an unverified criminal claim only if legal approves; do not amplify the gang by treating listing as proof.

Short term, two weeks

• Segment by identity and workload: tiered administration, privileged access workstations, LAPS or equivalent local-admin randomization, just-in-time admin, and no domain admin logon to servers or workstations.
• Isolate management planes for virtualization, CI/CD, firewalls, backups and security tooling behind brokered access with session recording and rapid disablement.
• Reduce supply-chain blast radius: pin and verify developer extensions, isolate build agents, sign artifacts, rotate CI/CD secrets, and require provenance checks after any developer-tool alert.
• Deploy deception: canary credentials, decoy shares named like customer, patient, research, backup and finance data, and alert on any access outside the deception path.
• Strengthen data controls: discover and classify crown-jewel shares, remove broad read access, encrypt sensitive exports, and monitor database export volume by user and host baseline.
• Operationalize leak-site response: monitor N0N listings, correlate brand and subsidiary names with internal asset inventory, pre-authorize legal review, and keep correction channels ready so a criminal claim does not become unearned fact.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub