Classification: TLP:CLEAR | Publication Date: 2026-11-09 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 69 New Listings in Single-Day Surge — Sector Analysis & Detection Rules

Executive Summary

On 2026-11-09, leak-site monitoring via ransomware.live observed an unusually large single-day posting surge from the N0N ransomware operation: 69 new listings appeared within their most recent 100 postings, with the cluster observed on this publication date. The listings are dominated by organizations in the United States, with additional claimed victims in the Netherlands, Italy, Canada, the United Kingdom, South Africa, Denmark, and Hong Kong. Sector metadata is largely absent ("Not Found") for the majority of listings; the Hospitality sector is the only explicitly tagged vertical in the current data set.

Fourteen of the listings are anonymized as "Company #198" through "Company #211," a pattern consistent with victims who have not yet been publicly named — either because negotiations are ongoing or because the gang is staging pressure. One organization is named: 159 Solutions, Inc. (US), which N0N lists as a claimed victim as of 2026-11-09. Per our sourcing rules, this is a threat-actor claim, not a confirmed breach.

The volume and simultaneity of this surge is the analytically significant signal. Gangs typically batch-post in this fashion either (a) after a successful automated initial-access campaign against a common exposure class, or (b) as a pressure tactic to inflate perceived momentum. Defenders should treat both hypotheses as actionable.

Sourcing & Verification

• 56 of 69 listings were independently observed by a second leak-site crawler (MULTI-SOURCE), meaning two independent collection systems observed N0N publish the claim. 13 listings appear on a single source only and carry proportionally lower collection confidence.
• Inclusion in this briefing reflects the threat actor's claim. It is not confirmation that any listed organization was breached. No corroboration tier in this data set confirms intrusion — only the affected organization or its regulator can do that.
• A named organization may dispute a listing. A denial is likewise not proof the claim is false: disclosure obligations vary by jurisdiction and sector, and not every incident is reportable. Neither silence nor denial settles the question. We report claims as claims.
• Security Arsenal will publish corrections as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

Operational model. N0N operates in the contemporary post-RaaS mold: a core crew managing the leak site, negotiation infrastructure, and payload, with access likely sourced through a mix of affiliated initial access brokers (IABs) and opportunistic edge-device exploitation. The gang maintains a dedicated .onion leak site and practices double extortion — data theft first, encryption second, publication as the escalation lever.

Known aliases / attribution. As of this publication, no publicly corroborated aliases or rebrand lineage for N0N have been established in our collection. Analysts should treat any claimed lineage to prior brands as unverified until supported by code overlap, infrastructure reuse, or negotiator TTP continuity.

Typical initial access (pattern-of-life, not victim-specific attribution). Consistent with the 2025–2026 mid-tier ransomware ecosystem, N0N's campaigns align with the following access hypotheses:

• Exploitation of internet-facing edge appliances and management planes (VPN concentrators, firewalls, virtualization management) — see the KEV exposure discussion below.
• Phishing-delivered loaders with macro or script-based execution chains leading to Cobalt Strike or equivalent C2.
• Exposed or weakly authenticated RDP, often acquired from IABs as pre-built access.

Ransom and pressure model. Mid-tier gangs of this profile typically issue demands scaled to perceived victim revenue, with leak-site countdowns and partial data teasers as staged escalation. The batch-anonymized "Company #NNN" naming convention observed today is consistent with a negotiation-window pressure tactic: victims are listed but unnamed while talks are live.

Dwell time. For comparable crews, observed dwell time from initial access to detonation typically ranges from days to under three weeks, with exfiltration staged in the final 48–96 hours. The single-day posting surge suggests access may have been aggregated over a longer window and published simultaneously for effect.

Current Campaign Analysis

Sector Targeting

Sector metadata is sparse in this dump — the majority of listings carry "Not Found" sector tags. The one explicit vertical is Hospitality, a sector historically attractive to ransomware crews due to high availability requirements, seasonal revenue sensitivity, fragmented IT estates (property management systems, POS, booking platforms), and historically uneven MFA coverage on remote access.

Geographic Concentration

The claimed victim set is heavily US-weighted, with secondary concentration in Western Europe (NL, IT, GB, DK) and outliers in CA, ZA, and HK. This distribution is consistent with English-language negotiation operations and the typical IAB market for US/EU access.

Victim Profile

With 14 of 15 listings anonymized and sector data absent, revenue sizing is speculative. The only named listing, 159 Solutions, Inc., is claimed by N0N as a US-based victim; no further firmographic claims are made here. The anonymized "Company #NNN" pattern suggests the gang is holding names in reserve as negotiation leverage — meaning the public-facing campaign may be larger than what is currently attributable.

Posting Frequency / Escalation Pattern

69 listings in a single observed window is a burst pattern, not a steady drip. Two working hypotheses:

1. Common-vector campaign: the gang (or its access supplier) worked a single exposure class — e.g., a specific edge appliance flaw — across many targets, then posted results in bulk.
2. Reputation-building surge: newer or re-branding crews sometimes batch-post accumulated claims to establish credibility quickly.

Defenders should plan against hypothesis #1, because it implies an actively exploited common denominator.

CVE Exposure Hypotheses (Sector-Level, Not Victim Attribution)

We have no evidence linking any specific CVE to any specific named listing. However, the following CISA KEV entries — all confirmed as ransomware-exploited — represent the exposure classes that gangs with N0N's profile are known to operationalize. Treat these as priority patch-verification targets, not as established intrusion vectors for the listed organizations:

• CVE-2026-59310 — VMware vCenter path traversal (KEV 2026-08-18): management-plane compromise enables direct access to the hypervisor layer — the highest-impact ransomware target in virtualized estates.
• CVE-2026-63077 — JetBrains TeamCity deserialization (KEV 2026-08-05): CI/CD compromise enables supply-chain-style lateral spread and credential harvesting from build agents.
• CVE-2026-20316 — Cisco Secure FMC hard-coded password (KEV 2026-07-29): firewall management-plane takeover defeats perimeter segmentation.
• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1) (KEV 2026-06-08): VPN gateway compromise is the classic ransomware front door.
• CVE-2026-48027 — Nx Console embedded malicious code (KEV 2026-05-27): developer-workstation supply chain entry.

If any of these products are internet-facing in your environment and unpatched, you are in the candidate initial-access pool for campaigns exactly like this one.

Detection Engineering

The following detections target the TTP cluster associated with N0N-profile intrusions: edge/VPN initial access, macro-based phishing execution, RDP brute force, PsExec/WMI lateral movement, Cobalt Strike beaconing, and pre-encryption data staging.

---
title: Suspicious Office Macro Spawning Script or LOLBin Child Process
id: 9f2a1c4e-n0n1-4a11-9c01-2026m0n00001
status: experimental
description: Detects Office applications spawning script interpreters or living-off-the-land binaries, consistent with phishing-macro initial execution used by ransomware crews of N0N's profile.
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate Office add-ins; baseline by user role
level: high
tags:
  - attack.initial_access
  - attack.t1566.001
  - attack.t1059
---
title: PsExec-Style Remote Service Creation Followed by WMI or Admin Share Activity
id: 9f2a1c4e-n0n1-4a11-9c01-2026m0n00002
status: experimental
description: Detects remote service installation events (7045) with PsExec-like service names or ADMIN$ path references, a hallmark of ransomware lateral movement prior to mass detonation.
author: Security Arsenal Threat Intelligence
logsource:
  product: windows
  service: system
detection:
  selection_event:
    EventID: 7045
  selection_pattern:
    ServiceFileName|contains:
      - 'ADMIN$'
      - 'PSEXESVC'
      - '\\.\pipe\'
    ServiceName|re: '(?i)^(psexesvc|remcom|[a-z]{8}$|[0-9a-f]{8})'
  condition: selection_event and selection_pattern
falsepositives:
  - Legitimate remote administration tooling (SCCM, PDQ); allowlist known service names and source hosts
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002
---
title: Pre-Ransomware Data Staging and Shadow Copy Tampering
id: 9f2a1c4e-n0n1-4a11-9c01-2026m0n00003
status: experimental
description: Detects volume shadow copy deletion, backup catalog tampering, and boot config changes frequently executed in the hours before encryption, plus archive utility execution consistent with data staging for exfiltration.
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    - Image|endswith: '\vssadmin.exe'
      CommandLine|contains|all:
        - 'delete'
        - 'shadows'
    - Image|endswith: '\wmic.exe'
      CommandLine|contains: 'shadowcopy'
    - Image|endswith: '\bcdedit.exe'
      CommandLine|contains:
        - 'recoveryenabled'
        - 'ignoreallfailures'
    - Image|endswith: '\wbadmin.exe'
      CommandLine|contains: 'delete'
  selection_staging:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\winrar.exe'
    CommandLine|contains:
      - ' a '
      - '-p'
  condition: selection_vss or selection_staging
falsepositives:
  - Backup administrators running shadow cleanup; validate against change windows
  - Developer archive usage; correlate with user context and unusual hours
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.t1560.001

// Hunt: Pre-ransomware staging & lateral movement pattern (N0N-profile)
// Looks for: suspicious service installs -> remote execution -> staging/archive activity
// -> shadow copy tampering, pivoted on a single device within a 24h window.
let Window = 24h;
let SuspiciousServices =
    DeviceEvents
    | where TimeGenerated > ago(7d)
    | where ActionType == "ServiceInstalled"
    | extend ServiceName = tostring(parse_json(AdditionalFields).ServiceName)
    | where ServiceName matches regex @"(?i)^(psexesvc|remcom|[a-z]{8}|[0-9a-f]{8})$"
    | project ServiceTime = TimeGenerated, DeviceId, DeviceName, ServiceName, InitiatingProcessAccountName;
let RemoteExec =
    DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where RemotePort in (445, 135, 5985, 5986, 3389)
    | where ActionType == "ConnectionSuccess"
    | project ConnTime = TimeGenerated, DeviceId, RemoteIP, RemotePort, InitiatingProcessFileName;
let Staging =
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where FileName in~ ("rar.exe", "7z.exe", "winrar.exe", "vssadmin.exe", "wmic.exe", "bcdedit.exe", "wbadmin.exe")
    | project ProcTime = TimeGenerated, DeviceId, FileName, ProcessCommandLine, AccountName;
SuspiciousServices
| join kind=inner Staging on DeviceId
| where ProcTime between (ServiceTime .. (ServiceTime + Window))
| join kind=leftouter RemoteExec on DeviceId
| where ConnTime between (ServiceTime .. (ServiceTime + Window))
| summarize
    FirstService = min(ServiceTime),
    StagingEvents = countif(FileName in~ ("rar.exe","7z.exe","winrar.exe")),
    ShadowTamper = countif(FileName in~ ("vssadmin.exe","wmic.exe","bcdedit.exe","wbadmin.exe")),
    RemoteConns = dcount(RemoteIP),
    Commands = make_set(ProcessCommandLine, 20)
    by DeviceName, InitiatingProcessAccountName, ServiceName
| where StagingEvents > 0 or ShadowTamper > 0
| order by FirstService desc;

# Rapid Triage: N0N-Profile Pre-Detonation Indicators
# Run elevated. Checks RDP exposure, new scheduled tasks (7d), shadow copy status,
# suspicious services, and recent archive-tool execution artifacts.

$Days = 7
$Cutoff = (Get-Date).AddDays(-$Days)
$Report = @()

Write-Host "=== [1] RDP Exposure ===" -ForegroundColor Cyan
$rdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$nla = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -ErrorAction SilentlyContinue).UserAuthentication
$Report += [pscustomobject]@{Check='RDP Enabled'; Finding=$rdpEnabled}
$Report += [pscustomobject]@{Check='NLA Required'; Finding=($nla -eq 1)}
Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue |
  ForEach-Object { $Report += [pscustomobject]@{Check='RDP Listener'; Finding="$($_.LocalAddress):$($_.LocalPort)"} }

Write-Host "=== [2] Scheduled Tasks Created/Modified in last $Days days ===" -ForegroundColor Cyan
Get-ScheduledTask | Where-Object { $_.Date -gt $Cutoff } |
  ForEach-Object { $Report += [pscustomobject]@{Check='New Scheduled Task'; Finding="$($_.TaskPath)$($_.TaskName) | Author=$($_.Author) | Date=$($_.Date)"} }

Write-Host "=== [3] Volume Shadow Copy Status ===" -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) { $Report += [pscustomobject]@{Check='Shadow Copies'; Finding='NONE PRESENT — investigate vssadmin/wmic deletion (T1490)'} }
else { $shadows | ForEach-Object { $Report += [pscustomobject]@{Check='Shadow Copy'; Finding="$($_.ID) created $($_.InstallDate)"} } }

Write-Host "=== [4] Suspicious Services (PsExec-style names) ===" -ForegroundColor Cyan
Get-CimInstance Win32_Service | Where-Object { $_.Name -match '^(psexesvc|remcom|[a-z]{8}|[0-9a-f]{8})$' -or $_.PathName -match 'ADMIN\$' } |
  ForEach-Object { $Report += [pscustomobject]@{Check='Suspicious Service'; Finding="$($_.Name) -> $($_.PathName)"} }

Write-Host "=== [5] Archive-Tool Execution (staging indicator) ===" -ForegroundColor Cyan
Get-ChildItem "$env:SystemDrive\Users\*\AppData\Roaming\Microsoft\Windows\Recent" -ErrorAction SilentlyContinue |
  Where-Object { $_.LastWriteTime -gt $Cutoff -and $_.Name -match '\.(rar|7z|zip)' } |
  ForEach-Object { $Report += [pscustomobject]@{Check='Recent Archive Artifact'; Finding="$($_.Name) | $($_.LastWriteTime)"} }

$Report | Format-Table -AutoSize | Out-String -Width 300 | Write-Host
$Report | Export-Csv ".\N0N_Triage_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation
Write-Host "Report saved. If Shadow Copies are absent AND suspicious services exist: isolate host NOW." -ForegroundColor Yellow

Incident Response Priorities

T-Minus Detection Checklist (Before Encryption Fires)

N0N-profile crews typically exhibit these behaviors in the 48–96 hours pre-detonation. Hunt for them now:

• Unexpected archive utility execution (rar/7z) against file servers or document shares — staging for exfil
• Newly created services with 8-character random names or ADMIN$ path references
• vssadmin delete shadows, wmic shadowcopy delete, bcdedit recovery tampering, wbadmin delete catalog
• Outbound transfers >1 GB to uncommon destinations (cloud storage ASNs, VPS ranges, MEGA/paste-style services)
• Cobalt Strike-style beaconing: periodic HTTPS to low-reputation domains, malleable C2 user-agents, named pipes like \\.\pipe\MSSE-* or \\.\pipe\postex_*
• Authentication anomalies: single account touching many hosts via SMB/WMI/WinRM in a short window
• Disabled or tampered EDR/AV services; new exclusions added to Defender or third-party AV
• Unpatched edge appliances with recent admin logins from unusual source IPs (tie to the KEV list above)

Critical Assets This Profile Prioritizes for Exfiltration

Based on double-extortion economics and the Hospitality tagging observed in this campaign:

• Customer/guest PII databases (reservations, loyalty programs, payment-adjacent records)
• Finance: payroll, banking, tax filings, wire transfer records
• Legal: contracts, litigation files, M&A material
• Executive mailboxes and board communications
• Backup catalogs and disaster recovery documentation (targeted to weaken recovery posture)

Containment Actions — Ordered by Urgency

1. Isolate, don't nuke. Network-segment suspected hosts immediately; preserve memory and volatile artifacts for forensics before any reimage.
2. Kill the egress. Block unclassified outbound traffic at the proxy/firewall; alert on large transfers to consumer cloud storage.
3. Credential reset at scale. Reset domain admin, service, and VPN credentials — assume harvesting occurred during dwell time. Rotate Kerberos krbtgt twice if domain-wide compromise is suspected.
4. Audit edge appliances. Pull VPN/firewall logs for the full dwell window (assume 3 weeks); check for logins on accounts without MFA.
5. Protect the backups. Take backup infrastructure offline or into immutable mode; verify restore capability before the encryption wave, not after.
6. Engage IR early. If any checklist item fires on a critical asset, escalate to retainers immediately — the dwell window is short.

Hardening Recommendations

Immediate (24 Hours)

• Patch the KEV five. Verify remediation status for CVE-2026-59310 (vCenter), CVE-2026-63077 (TeamCity), CVE-2026-20316 (Cisco FMC), CVE-2026-50751 (Check Point IKEv1), and CVE-2026-48027 (Nx Console). If patching is blocked, remove the management interface from internet exposure today — not this week.
• Enforce MFA on all remote access. VPN, RDP gateways, and third-party remote tools — no exceptions for service or legacy accounts.
• Disable RDP where not operationally required; where required, restrict via host firewall to jump hosts only and confirm NLA is enforced (script above).
• Block Office macro child processes via ASR rules; the Sigma rule above gives you detection coverage in the interim.
• Deploy the shadow-copy-tampering detection to all servers hosting file shares, databases, and backup targets.
• Alert on bulk egress. Baseline outbound volume per server; alert on >2x deviation to non-corporate destinations.

Short-Term (Two Weeks)

• Segment the management plane. vCenter, firewall managers, and CI/CD servers must live in dedicated management VLANs reachable only from hardened jump hosts — this directly blunts the KEV exposure classes listed above.
• Implement tiered administration with separate credentials per tier; ransomware crews weaponize flat privilege structures for mass detonation.
• Immutable, offline, or logically air-gapped backups with tested restore runbooks. Assume the gang reads your backup documentation during dwell time.
• EDR in block mode everywhere, including servers and VDI; remove tampering exclusions and alert on any attempt to add them.
• Deception: deploy canary file shares and honey credentials on file servers and backup infrastructure — staging behavior trips these reliably.
• Tabletop the leak-site scenario. Decide now, with legal and comms, how you respond if your organization appears on a site like N0N's: verification workflow, disclosure triggers, negotiation policy, and regulator notification thresholds. Organizations listed in this surge are living that decision today.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub