Classification: TLP:CLEAR | Publication Date: 2026-11-10 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 67 Listings on Dark Web Leak Site — Sector Targeting Analysis, Detection Rules & IR Playbook

Executive Summary

Security Arsenal's dark web monitoring, corroborated via ransomware.live, has observed 67 new listings on the N0N ransomware group's .onion leak site in its most recent 100-posting window, with a sharp burst of activity published between 2026-11-09 and 2026-11-10. The listings name organizations in the Retail & E-Commerce and Healthcare sectors, alongside a large volume of anonymized "Company #NNN" placeholder entries whose sectors are not disclosed.

Named organizations the gang claims to have compromised include Landmark Group (Retail & E-Commerce, AE) and Vertex Pharmaceuticals Incorporated (Healthcare, US). These are unverified threat-actor claims — N0N asserts it has compromised these organizations, but no tier in our data confirms an actual breach occurred. See Sourcing & Verification below before acting on any named-victim attribution.

Geographically, claimed victims span AE, US, NL, IT, CA, GB, ZA and DK, with the United States dominating the anonymized listings. Security teams in retail, e-commerce and healthcare — particularly those with exposure to VMware vCenter, Cisco FMC, Check Point gateways or JetBrains TeamCity — should treat this briefing as a trigger for immediate detection and hardening actions detailed below.

Sourcing & Verification

• Corroboration status: Of the 67 listings analyzed, 16 were independently observed by a second leak-site crawler (tagged MULTI-SOURCE). 51 appear on a single source only and carry correspondingly lower confidence that the posting itself was accurately captured.
• What corroboration means: MULTI-SOURCE confirms only that two independent crawlers saw the gang publish the claim. It does not confirm a breach. Inclusion of any organization in this briefing reflects the threat actor's claim, not a verified compromise.
• Disputes and denials: A named organization may dispute its listing. Conversely, a denial is not proof the claim is false — disclosure obligations vary by jurisdiction and sector, and not every incident is reportable. Neither silence nor denial settles the question. Only the organization or its regulator can confirm an incident.
• Corrections: Security Arsenal will publish corrections as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

Model: N0N operates as a closed or semi-closed ransomware crew with characteristics of a Ransomware-as-a-Service (RaaS) operation — the high posting cadence (67 listings in a single monitoring window) and heavy use of anonymized placeholder victims are consistent with affiliate-driven volume operations where initial access is brokered or delegated. No confirmed aliases are attributed to this group in current reporting; the numeric naming convention ("N0N") and sequential "Company #NNN" placeholder postings are signature behaviors of its leak-site operation.

Extortion approach: Double extortion. The placeholder-victim pattern is consistent with a pressure tactic: the gang lists unnamed "Company #NNN" entries as a countdown threat, implying data will be released or the victim named unless ransom negotiations begin. Named listings (e.g., Landmark Group, Vertex Pharmaceuticals Incorporated) typically appear when negotiation has stalled or the gang wishes to escalate pressure publicly.

Initial access methods (typical for this playbook):

• Exploitation of internet-facing edge devices and management planes (VPN concentrators, firewalls, virtualization management)
• Phishing with macro-enabled documents or malicious links leading to loader deployment
• Exposed RDP, often acquired via access brokers after brute-force or credential stuffing
• Supply-chain / development-tooling compromise (build servers, CI/CD)

Ransom demands: Observed demands for gangs of this profile typically scale to victim revenue — mid-six to seven figures USD for mid-market retail and healthcare organizations. The volume of US-based placeholder victims suggests mid-market targeting where ransom pressure and payment likelihood are historically highest.

Dwell time: For comparable double-extortion operations, dwell time from initial access to encryption typically ranges from days to two weeks, with data staging and exfiltration occurring in the final 48–96 hours before detonation. The T-minus checklist in the Incident Response section is built around this window.

Current Campaign Analysis

Sectors Targeted

• Retail & E-Commerce: Landmark Group (AE) — the only named retail listing in this window.
• Healthcare: Vertex Pharmaceuticals Incorporated (US) — the only named healthcare listing.
• Not Found / undisclosed: 14 anonymized "Company #NNN" listings (and 51 further single-source listings in the broader 67) where the gang withheld sector detail — itself a negotiation-pressure signal.

Geographic Concentration

The United States is the dominant claimed geography, followed by single listings across NL, IT, and AE, with the gang's broader targeting footprint spanning CA, GB, ZA and DK. This is consistent with opportunistic edge-device exploitation rather than region-specific operations — the gang goes where exposed attack surface exists.

Victim Profile

The named organizations are large enterprises (Landmark Group is a multinational retail conglomerate; Vertex Pharmaceuticals is a large-cap biopharma firm). However, the heavy volume of anonymized listings suggests the bulk of the campaign targets mid-market organizations — typically 100–5,000 employees, with estimated revenues from tens of millions to low billions USD depending on sector. This mixed profile is characteristic of affiliate-driven RaaS: affiliates cast wide nets via exploitable perimeter devices and escalate whichever victims pay.

Posting Frequency & Escalation

15 of the 16 corroborated listings were published in a 48-hour burst (2026-11-09 through 2026-11-10), including a same-day sequence of at least 13 sequential "Company #NNN" entries on 2026-11-09. This bulk-publishing pattern indicates either: (a) batch disclosure after a negotiation deadline expired, or (b) an affiliate dumping access-broker-acquired victims to inflate site statistics. Either way, a burst of this size historically precedes follow-on waves — defenders should assume the campaign is active, not concluded.

CVE Exposure Context (Hypothesis — Not Victim Attribution)

We have no evidence linking any specific CVE to any specific named listing. However, N0N-profile gangs gain initial access predominantly through edge and management-plane exploitation, and the following CISA KEV entries (all confirmed ransomware-exploited) represent exactly the attack surface this class of actor targets:

• CVE-2026-59310 — VMware vCenter path traversal (KEV 2026-08-18): hypervisor management-plane compromise enables mass VM encryption — the highest-impact ransomware scenario.
• CVE-2026-20316 — Cisco Secure FMC hard-coded password (KEV 2026-07-29): firewall management-plane takeover for network-wide access.
• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1) (KEV 2026-06-08): VPN gateway compromise, a classic ransomware ingress.
• CVE-2026-63077 — JetBrains TeamCity deserialization (KEV 2026-08-05): CI/CD server RCE — supply-chain foothold and build-artifact poisoning.
• CVE-2026-48027 — Nx Console embedded malicious code (KEV 2026-05-27): developer-tooling supply-chain compromise.

Any organization in retail or healthcare running unpatched instances of these products should assume it is within N0N's practical reach.

Detection Engineering

---
title: N0N-Profile Edge Device Exploitation Followed by Suspicious VPN/RDP Logon
description: Detects successful VPN or RDP logons from unusual sources following edge-device (VPN gateway, firewall management) exposure — consistent with N0N-style initial access via CVE-2026-50751 (Check Point IKEv1) or brokered RDP access. Tune the device list to your perimeter.
id: 7f3a1c2e-9b0d-4e5a-a1n0-n0n000000001
status: experimental
author: Security Arsenal Threat Intel
 date: 2026/11/10
logsource:
  category: authentication
  product: windows
  service: security
detection:
  selection_logon:
    EventID: 4624
    LogonType:
      - 3
      - 10
  filter_known_internal:
    IpAddress|startswith:
      - '10.'
      - '172.16.'
      - '192.168.'
  condition: selection_logon and not filter_known_internal
fields:
  - IpAddress
  - TargetUserName
  - WorkstationName
falsepositives:
  - Legitimate remote workforce VPN logons; baseline known egress/VPN IP ranges
level: high
tags:
  - attack.initial_access
  - attack.t1133
  - attack.t1078
---
title: N0N-Profile PsExec / WMI Remote Service Creation for Lateral Movement
description: Detects remote service installation (PsExec-style) and WMI process creation used for lateral movement and ransomware payload push, a hallmark of pre-detonation mass deployment.
id: 7f3a1c2e-9b0d-4e5a-a1n0-n0n000000002
status: experimental
author: Security Arsenal Threat Intel
date: 2026/11/10
logsource:
  category: process_creation
  product: windows
detection:
  selection_wmi:
    ParentImage|endswith: '\\WmiPrvSE.exe'
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\pwsh.exe'
  selection_psexec:
    Image|endswith:
      - '\\PSEXESVC.exe'
      - '\\psexec.exe'
      - '\\psexesvc.exe'
  condition: 1 of selection_*
fields:
  - Image
  - ParentImage
  - CommandLine
  - Computer
falsepositives:
  - Enterprise management tools (SCCM, PDQ) — whitelist known admin servers
level: critical
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002
  - attack.t1047
---
title: N0N-Profile Pre-Encryption Staging — Shadow Copy Deletion and Mass Archive Creation
description: Detects the final 48-96h pre-detonation window behaviors — vssadmin/wmic shadow copy deletion, and mass 7z/rar archive creation indicative of data staging before exfiltration and encryption.
id: 7f3a1c2e-9b0d-4e5a-a1n0-n0n000000003
status: experimental
author: Security Arsenal Threat Intel
date: 2026/11/10
logsource:
  category: process_creation
  product: windows
detection:
  selection_shadow:
    CommandLine|contains:
      - 'vssadmin delete shadows'
      - 'vssadmin Delete Shadows'
      - 'wmic shadowcopy delete'
      - 'bcdedit /set {default} recoveryenabled no'
      - 'wbadmin delete catalog'
  selection_staging:
    Image|endswith:
      - '\\7z.exe'
      - '\\7za.exe'
      - '\\rar.exe'
      - '\\winrar.exe'
    CommandLine|contains:
      - ' a -p'
      - ' a -m'
  condition: 1 of selection_*
fields:
  - Image
  - CommandLine
  - User
  - Computer
falsepositives:
  - Backup administrators; archival scripts — correlate with user and host context
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.collection
  - attack.t1560.001

// N0N-profile hunt: lateral movement + pre-ransomware staging chain
// Correlates remote service creation, shadow copy tampering, and archive-tool execution
// on the same host within a 24h window — the pre-detonation signature.
let lookback = 7d;
let staging =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where ProcessCommandLine has_any (
        "vssadmin delete shadows", "vssadmin Delete Shadows",
        "wmic shadowcopy delete", "wbadmin delete catalog",
        "recoveryenabled no")
    | project StagingTime=TimeGenerated, DeviceName, StagingCmd=ProcessCommandLine, AccountName;
let lateral =
    union (
        DeviceEvents
        | where TimeGenerated > ago(lookback)
        | where ActionType == "ServiceInstalled"
        | extend ServiceName = tostring(parse_json(AdditionalFields).ServiceName)
        | where ServiceName has_any ("PSEXESVC", "PAExec", "RemComSvc"),
        DeviceProcessEvents
        | where TimeGenerated > ago(lookback)
        | where InitiatingProcessFileName =~ "WmiPrvSE.exe"
        | where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe")
    )
    | project LateralTime=TimeGenerated, DeviceName, LateralDetail=FileName, AccountName;
let exfil_tools =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName in~ ("rclone.exe", "megasync.exe", "winscp.exe", "filezilla.exe", "7z.exe", "rar.exe")
    | project ExfilTime=TimeGenerated, DeviceName, ExfilTool=FileName, ExfilCmd=ProcessCommandLine;
staging
| join kind=inner lateral on DeviceName
| join kind=leftouter exfil_tools on DeviceName
| extend StagingFirstSeen = min(StagingTime)
| summarize
    StagingCommands = make_set(StagingCmd),
    LateralIndicators = make_set(LateralDetail),
    ExfilTools = make_set(ExfilTool),
    FirstSeen = min(StagingTime), LastSeen = max(StagingTime)
  by DeviceName, AccountName
| sort by FirstSeen asc;

# N0N Rapid Triage — run on suspected hosts / domain-wide via GPO or EDR live response
# Checks: exposed RDP, shadow copy integrity, scheduled tasks & services from last 7 days,
# staging tools, and suspicious recent logons.
$days = 7
$cutoff = (Get-Date).AddDays(-$days)
$report = @()

Write-Host "[1] RDP exposure check" -ForegroundColor Cyan
$rdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$rdpPort = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumber -ErrorAction SilentlyContinue).PortNumber
$report += [pscustomobject]@{Check='RDP Enabled'; Result=$rdpEnabled; Detail="Port: $rdpPort"}
$fw = Get-NetFirewallRule -DisplayGroup 'Remote Desktop' -ErrorAction SilentlyContinue | Where-Object Enabled -eq 'True'
$report += [pscustomobject]@{Check='RDP Firewall Rules Enabled'; Result=($fw.Count -gt 0); Detail="$($fw.Count) rules"}

Write-Host "[2] Volume Shadow Copy integrity" -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
$report += [pscustomobject]@{Check='Shadow Copies Present'; Result=($null -ne $shadows); Detail="Count: $(@($shadows).Count) — 0 on a server is a red flag"}

Write-Host "[3] Scheduled tasks created in last $days days" -ForegroundColor Cyan
Get-ScheduledTask | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    $taskXml = Export-ScheduledTask -TaskName $_.TaskName -TaskPath $_.TaskPath -ErrorAction SilentlyContinue
    if ($taskXml -match '<Date>(\d{4}-\d{2}-\d{2}T[^<]+)</Date>') {
        $created = [datetime]$Matches[1]
        if ($created -gt $cutoff) {
            $report += [pscustomobject]@{Check='New Scheduled Task'; Result=$true; Detail="$($_.TaskPath)$($_.TaskName) — $created"}
        }
    }
}

Write-Host "[4] New services in last $days days (PsExec/lateral movement artifacts)" -ForegroundColor Cyan
Get-CimInstance Win32_Service | Where-Object { $_.PathName -match 'PSEXESVC|ADMIN\$|\\Temp\\|\\Users\\Public\\' } | ForEach-Object {
    $report += [pscustomobject]@{Check='Suspicious Service Path'; Result=$true; Detail="$($_.Name): $($_.PathName)"}
}

Write-Host "[5] Staging/exfil tool presence" -ForegroundColor Cyan
$tools = 'rclone.exe','megasync.exe','7z.exe','rar.exe','winscp.exe'
foreach ($t in $tools) {
    $hits = Get-ChildItem -Path 'C:\Users','C:\ProgramData','C:\Windows\Temp' -Filter $t -Recurse -ErrorAction SilentlyContinue | Where-Object { $_.LastWriteTime -gt $cutoff }
    foreach ($h in $hits) { $report += [pscustomobject]@{Check='Staging Tool (recent)'; Result=$true; Detail="$($h.FullName) — modified $($h.LastWriteTime)"} }
}

Write-Host "[6] Type-10 (RDP) logons, last $days days" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=$cutoff} -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'Logon Type:\s+10' } |
    Select-Object -First 50 | ForEach-Object {
        $report += [pscustomobject]@{Check='RDP Logon'; Result=$true; Detail=$_.TimeCreated}
    }

$report | Format-Table -AutoSize
$report | Export-Csv ".\n0n_triage_$(Get-Date -Format yyyyMMdd_HHmm).csv" -NoTypeInformation
Write-Host "Report exported. Any 'Suspicious Service Path', missing shadow copies, or unexpected staging tools = escalate to IR immediately." -ForegroundColor Yellow

Incident Response Priorities (N0N Playbook)

T-Minus Detection Checklist — Before Encryption Fires

Watch for this sequence in the 48–96 hours preceding detonation:

1. Edge anomaly: New VPN/RDP logons from IPs outside baseline ranges, or configuration changes on Check Point / Cisco FMC / vCenter management planes.
2. Discovery burst: net group "domain admins", nltest, SharpHound/ADRecon output files, rapid SMB enumeration across shares.
3. Lateral movement: PsExec-style service creation, WMI-spawned shells, RDP chaining between servers.
4. Staging: 7z/rar archives in C:\ProgramData or user temp paths; rclone/megasync/config files for cloud exfil endpoints.
5. Sabotage of recovery: vssadmin delete shadows, bcdedit ... recoveryenabled no, backup catalog deletion, backup-agent service stops.
6. Detonation: Mass file-rename events, ransom notes (README-style .txt/.hta) dropped across directories.

Any single item from steps 4–5 on a production server should trigger the IR plan — do not wait for confirmation.

Critical Assets Prioritized for Exfiltration

For retail/e-commerce targets: customer PII databases, payment-adjacent records, loyalty platform data, e-commerce backend exports, and ERP financials. For healthcare/pharma targets: patient records, clinical trial data, research IP, and HR/employee records. Domain controller ntds.dit and backup infrastructure are universally targeted — control of these enables both extortion leverage and encryption at scale.

Containment Actions — Ordered by Urgency

1. Isolate affected segments at the switch/VLAN level (not just host shutdown — preserve volatile evidence).
2. Disable suspect accounts and revoke VPN sessions; force credential resets for any account used in anomalous logons.
3. Block exfil egress: deny unsanctioned cloud storage domains (MEGA, rclone endpoints) at the proxy/firewall.
4. Protect backups: take backup infrastructure offline from the production network; verify at least one immutable/offline copy.
5. Preserve evidence: capture memory and the Security/System event logs from patient-zero hosts before remediation.
6. Engage external IR and legal counsel; assess regulatory notification obligations (healthcare entities: HIPAA timelines; EU operations: GDPR 72-hour clock).

Hardening Recommendations

Immediate (24 hours)

• Patch or mitigate the KEV edge exposure: Verify CVE-2026-50751 (Check Point IKEv1), CVE-2026-20316 (Cisco FMC), CVE-2026-59310 (vCenter), CVE-2026-63077 (TeamCity) and CVE-2026-48027 (Nx Console) remediation status. If patching is impossible today, apply vendor workarounds and restrict management-plane access to jump hosts.
• Kill exposed RDP: No RDP on the internet, period — behind VPN + MFA only. Audit 3389 exposure externally.
• Enforce phishing-resistant MFA on VPN, remote access, and all email/IdP logons.
• Deploy the Sigma and KQL content above and alert on any shadow-copy deletion or PsExec/WMI service creation as P1.
• Block macro execution from internet-sourced Office documents via GPO (Mark of the Web enforcement).

Short-Term (2 weeks)

• Segment the network so that a single compromised workstation cannot reach server VLANs or backup infrastructure; enforce east-west firewalling between user and server segments.
• Immutable, offline, or air-gapped backups with tested restoration — assume online backups will be deleted.
• Tier-0 isolation: dedicated privileged access workstations for domain admins; no DA logons on general-purpose systems.
• Deploy honey credentials and canary files on file shares to trip early on enumeration and staging.
• Egress filtering & DNS control: default-deny outbound for servers; alert on cloud storage APIs not in the sanctioned catalog.
• CI/CD hardening: isolate TeamCity/build infrastructure from production trusts; rotate all secrets that touch build pipelines given the developer-tooling CVEs in play.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub