Classification: TLP:CLEAR | Publication Date: 2026-10-13 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: Maritime & Port-Logistics Leak-Site Surge — Defensive Briefing

Executive Summary

Ransomware.live monitoring of the N0N ransomware group's dark web leak site shows 50 victim listings in the gang's most recent 100 postings, with a striking one-day concentration on 2026-10-12: more than a dozen organizations in the maritime shipping, container terminal, port agency, and 3PL logistics ecosystem were listed in a single coordinated burst. Named organizations span Indonesia, Brazil, Türkiye, Singapore, South Korea, China, Japan, Hong Kong, and the Netherlands, with additional retail and financial services listings (US) posted 2026-10-13.

Every listing on this page is an accusation by a criminal actor, not a confirmed breach. Security teams at named organizations — and at any maritime/logistics enterprise with comparable exposure — should treat this as a threat-actor claim warranting proactive hunting, not as incident confirmation. Detection content for pre-encryption staging is provided below.

Sourcing & Verification

• Corroboration split: 30 of the 50 recent N0N listings were independently observed by a second leak-site crawler (tagged MULTI-SOURCE above); 20 appear on a single source only. Multi-source corroboration confirms that the gang made the claim — it does not confirm that any intrusion occurred.
• Inclusion in this briefing reflects the threat actor's claim and is NOT confirmation of a breach. No corroboration tier in leak-site monitoring can confirm an intrusion — only the organization itself or its regulator can do that.
• A named organization may dispute a listing. A denial is likewise not proof the claim is false: disclosure obligations vary by jurisdiction and sector, and not every incident is reportable. Neither silence nor denial settles the question.
• Security Arsenal will publish corrections promptly and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

• Aliases: None confirmed in open reporting; tracked as "N0N" by leak-site aggregators. Analysts should not conflate with similarly named low-volume crews.
• Operating model: Assessed as a closed or semi-closed ransomware operation with double-extortion capability (dedicated leak site with victim shaming, countdown timers, and staged data-release threats). No evidence of a mature affiliate/RaaS marketplace presence; victim cadence is consistent with a small core team or tightly controlled affiliate pool.
• Ransom demands: Sector-proportional. Observed demand patterns for comparable crews against transportation/logistics targets range from low six figures to low seven figures (USD, cryptocurrency), scaled to victim revenue and perceived cyber-insurance coverage.
• Initial access (assessed, sector-level): Perimeter exploitation of VPN/remote access appliances, exposed RDP, and spear-phishing against operations and port-community-system users. The gang's victim selection (port machinery vendors, terminal operators, 3PLs) suggests deliberate targeting of organizations with large externally facing remote-access footprints and third-party connectivity.
• Extortion approach: Double extortion — data staged and exfiltrated before encryption, with leak-site publication used as the pressure lever when payment stalls.
• Dwell time: Consistent with sector norms for leak-site-first operators: estimated 3–14 days from initial access to encryption, with the bulk of that window spent on discovery, credential theft, and exfiltration staging.

Current Campaign Analysis

Sector targeting. Of the 50 recent listings, the published victim set is dominated by Transportation (maritime sub-sector): container terminals (Asyaport, BNCT Busan New Container Terminal, Portonave), port agencies (GlobalNet LCL), container and bulk carriers (Ocean Network Express, CULines, Polaris Shipping, Santos Brasil), shipping networks (Premier Alliance), and 3PL logistics (Yusen Logistics Hong Kong). Adjacent industrial supply chain is represented by Manufacturing listings ZPMC (port machinery) and Tsuneishi / Kambara Kisen (shipbuilding). Non-maritime listings include MarieBelle New York (Retail & E-Commerce, US) and PG Group (Pure Options) (Financial Services). Additional sector tags across the 50-listing window include Technology, Professional Services, and Healthcare.

Geographic concentration. Strong Indo-Pacific and Latin American maritime weighting: ID, BR, TR, SG, KR, CN, JP, HK, NL, with US retail/financial listings. This mirrors global container-trade chokepoints — a deliberate campaign theme rather than opportunistic scatter.

Victim profile. Mid-to-large enterprises, predominantly critical-infrastructure-adjacent operators with high operational-technology dependence, thin tolerance for downtime, and complex third-party port-community integrations — a profile ransomware actors select precisely because downtime cost inflates ransom leverage.

Posting cadence / escalation. The 2026-10-12 maritime mega-batch (13+ listings in one day) is an escalation signal: batch publication is typically used either to maximize media pressure after failed negotiations, or to advertise a campaign at scale. Watch for follow-on single listings in the same sector over the next 7–14 days.

CVE linkage (hypothesis, sector-level exposure only). No evidence ties any specific named listing to a specific CVE. However, the gang's assessed perimeter-first tradecraft overlaps with currently exploited vulnerabilities in CISA KEV: CVE-2026-50751 (Check Point Security Gateway improper authentication), CVE-2026-20316 (Cisco Secure FMC hard-coded password), CVE-2026-59310 (VMware vCenter path traversal), CVE-2026-63077 (JetBrains TeamCity deserialization), and CVE-2026-48027 (Nx Console embedded malicious code — supply chain). Maritime/logistics enterprises run heavy VPN, virtualized management, and CI/CD estates; treat these as priority patch targets on the hypothesis that N0N's access brokers exploit them.

Detection Engineering

---
title: N0N-Style Ransomware — Suspicious VPN/Perimeter Authentication Followed by Lateral Tooling
id: 8f1c2a4e-7b3d-4e5f-9a01-n0nvpn0001
status: experimental
description: Detects anomalous remote access (VPN/RDP) authentication from unusual geographies or atypical hours followed within a short window by execution of lateral-movement tooling, consistent with perimeter-first ransomware intrusion chains observed against maritime/logistics targets.
author: Security Arsenal Threat Intel
date: 2026/10/13
logsource:
  category: authentication
  product: windows
detection:
  selection_rdp:
    EventID: 4624
    LogonType: 10
  filter_known_ips:
    IpAddress|startswith:
      - '10.'
      - '192.168.'
  condition: selection_rdp and not filter_known_ips
falsepositives:
  - Legitimate remote administration via jump hosts
level: medium
tags:
  - attack.initial_access
  - attack.t1133
  - attack.t1021.001
---
title: N0N-Style Ransomware — PsExec/WMI Remote Service Creation for Lateral Movement
id: 8f1c2a4e-7b3d-4e5f-9a01-n0nlat0002
status: experimental
description: Detects remote service installation and execution patterns (PsExec-style service creation, WMI process spawn) commonly used by ransomware operators during lateral movement and pre-encryption staging.
author: Security Arsenal Threat Intel
date: 2026/10/13
logsource:
  product: windows
  service: system
detection:
  selection_service:
    EventID: 7045
  selection_names:
    ServiceName|contains:
      - 'PSEXESVC'
      - 'PAExec'
      - 'csexec'
      - 'RemCom'
  selection_random_name:
    ServiceName|re: '^[A-Za-z0-9]{8}$'
  condition: selection_service and (selection_names or selection_random_name)
falsepositives:
  - Enterprise software deployment tools (SCCM, PDQ) — baseline by ServiceName/FileName hash
level: high
tags:
  - attack.lateral_movement
  - attack.t1569.002
  - attack.t1021
---
title: N0N-Style Ransomware — Pre-Encryption Staging and Defense Evasion
id: 8f1c2a4e-7b3d-4e5f-9a01-n0nstg0003
status: experimental
description: Detects data staging and anti-recovery behaviors preceding ransomware detonation — shadow copy deletion, archive utility execution on sensitive paths, and mass file staging into temp directories.
author: Security Arsenal Threat Intel
date: 2026/10/13
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
      - '\wbadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'resize shadowstorage'
      - 'recoveryenabled no'
      - 'delete catalog'
  selection_archive:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\winzip.exe'
    CommandLine|contains:
      - ' -p'
      - ' -hp'
  condition: 1 of selection_*
falsepositives:
  - Backup administrators performing legitimate shadow maintenance
  - Software packaging teams using password-protected archives
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.t1560.001

// Microsoft Sentinel — Pre-ransomware staging hunt: archive creation + shadow copy tampering + suspicious outbound volume
// Tune the TimeGenerated window and per-host byte threshold to your estate baseline.
let Window = 7d;
let StagingHosts =
    SecurityEvent
    | where TimeGenerated > ago(Window)
    | where EventID == 4688
    | where Process has_any ("rar.exe","7z.exe","vssadmin.exe","wbadmin.exe","bcdedit.exe")
       or CommandLine has_any ("delete shadows","resize shadowstorage","recoveryenabled no","delete catalog"," -hp"," -p")
    | summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), CmdCount=count(), SampleCmds=make_set(CommandLine, 10)
        by Computer, Account, Process
    | extend StageScore = CmdCount;
let Outbound =
    AzureNetworkAnalytics_CL
    | where TimeGenerated > ago(Window)
    | where FlowDirection_s == "O"
    | summarize BytesOut=sum(tolong(BytesSent_d)) by SrcIP_s
    | where BytesOut > 5000000000; // 5 GB outbound in window — tune to baseline
StagingHosts
| join kind=leftouter (Outbound) on $left.Computer == $right.SrcIP_s
| project Computer, Account, Process, CmdCount, SampleCmds, BytesOut, FirstSeen, LastSeen
| sort by StageScore desc;

# N0N Rapid-Response Check — run on critical servers and jump hosts
# 1) Scheduled tasks created in last 7 days  2) Shadow copy inventory  3) Exposed RDP listeners
param([int]$Days = 7)
$cutoff = (Get-Date).AddDays(-$Days)

Write-Host "=== Scheduled tasks created since $cutoff ===" -ForegroundColor Cyan
Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt $cutoff } |
  Select-Object TaskName, TaskPath, Date, @{n='Action';e={$_.Actions.Execute}} |
  Format-Table -AutoSize

Write-Host "=== Volume Shadow Copies (should exist and be recent) ===" -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($shadows) {
  $shadows | Select-Object DeviceObject, InstallDate, @{n='AgeDays';e={((Get-Date)-$_.InstallDate).Days}} | Format-Table -AutoSize
  if (-not ($shadows | Where-Object { $_.InstallDate -gt (Get-Date).AddDays(-3) })) {
    Write-Warning "No shadow copies younger than 3 days — possible anti-recovery tampering."
  }
} else {
  Write-Warning "NO shadow copies present — investigate vssadmin/wmic deletion events immediately."
}

Write-Host "=== RDP exposure check ===" -ForegroundColor Cyan
$rdp = Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue
if ($rdp) {
  $rdp | Select-Object LocalAddress, LocalPort, State | Format-Table -AutoSize
  $nla = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue).UserAuthentication
  if ($nla -ne 1) { Write-Warning "RDP listening WITHOUT Network Level Authentication — brute-force risk." }
} else { Write-Host "RDP not listening." }

Write-Host "=== Recent inbound 3389 logons (LogonType 10) from non-RFC1918 ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=$cutoff} -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'Logon Type:\s+10' -and $_.Message -notmatch 'Source Network Address:\s+(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)' } |
  Select-Object -First 25 TimeCreated, @{n='Msg';e={($_.Message -split "`n")[0]}} | Format-Table -AutoSize

Incident Response Priorities

T-minus detection checklist (before encryption fires):

• New or unusual VPN/RDP logons from non-business geographies or outside shift patterns — especially on port-community-system gateways and vendor remote-access accounts.
• PsExec/WMI service creation (Event 7045) with random or known remote-exec service names.
• Archive utility execution (rar/7z with password flags) on file servers holding bills of lading, customs manifests, HR, or financial data.
• vssadmin/wmic/bcdedit shadow-copy tampering — treat any occurrence outside backup windows as critical.
• Sustained outbound volume anomalies to uncommon destinations (multi-GB transfers to consumer cloud storage or unfamiliar ASNs).
• New scheduled tasks or run-key persistence created in the last 7 days on servers and jump hosts.

Assets this threat profile historically prioritizes for exfiltration: operational documents with commercial sensitivity (contracts, manifests, customs/trade documentation), HR/payroll and PII, financial records, and — in maritime targets — documentation whose release creates safety, regulatory, or contractual exposure, maximizing double-extortion leverage.

Containment actions, ordered by urgency:

1. Isolate affected segments at the switch/firewall level; do not power off hosts (preserve volatile evidence).
2. Disable and reset all remote-access credentials, starting with VPN concentrators, vendor accounts, and any account with recent anomalous logons; revoke sessions and tokens.
3. Block identified exfiltration destinations at egress; enable TLS-inspection or SNI-based alerting where lawful.
4. Snapshot/backup critical servers offline or immutable before any remediation touches them.
5. Engage IR retainer and legal counsel early — regulatory clocks (and port-authority notification duties for maritime operators) may already be running if the claim proves real.

Hardening Recommendations

Immediate (24 hours):

• Patch or isolate Check Point gateways (CVE-2026-50751), Cisco Secure FMC (CVE-2026-20316), and VMware vCenter (CVE-2026-59310); if patching cannot complete, restrict management-plane access to allow-listed jump hosts.
• Enforce MFA on all VPN and remote access; disable legacy IKEv1 where present; block direct internet-exposed RDP (3389) entirely.
• Enable and alert on Event 7045 service creation, vssadmin/wmic shadow deletion, and archive-utility execution using the detections above.
• Audit and disable stale third-party/vendor remote-access accounts — the maritime ecosystem's integration sprawl is the assessed entry surface.

Short-term (2 weeks):

• Deploy network segmentation separating OT/terminal operations from corporate IT, with brokered, MFA-gated jump access only.
• Implement immutable, offline backups with tested restoration runbooks; verify shadow copies persist and alert on deletion.
• Roll out egress filtering and DLP on file servers holding trade/customs documentation.
• Establish a leak-site monitoring watch for your organization and key suppliers so a criminal claim triggers hunting within hours, not weeks.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub