Classification: TLP:CLEAR | Publication Date: 2026-11-03 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 7 Leak-Site Listings in 4 Days — US-Heavy Campaign Analysis & Detection Engineering

Executive Summary

Between 2026-10-30 and 2026-11-02, the ransomware group tracked as N0N published 7 new victim listings on its dark web leak site, including a concentrated burst of five US-based organizations posted on a single day (2026-11-02). Six of the seven listings were independently corroborated by a second leak-site crawler, meaning the gang demonstrably made these claims — though the underlying breaches remain unconfirmed by the named organizations or any regulator.

The victim set skews heavily toward the United States (5 of 7), with additional listings in Malaysia (Technology) and the UAE (Professional Services). The single-day clustering of five US listings suggests either a coordinated "dump" of previously held victims or a recent wave of successful intrusions moving through the gang's extortion pipeline. Enterprise defenders — particularly those operating VMware vCenter, JetBrains TeamCity, Cisco FMC, or Check Point gateways — should treat the CVE exposure discussion below as a patching and hunting trigger, framed strictly as hypothesis pending confirmed intrusion data.

This briefing provides the threat actor profile, campaign analysis, Sigma/KQL detection content, and incident response priorities aligned to N0N's observed playbook.

Sourcing & Verification

• Corroboration breakdown: 6 of 7 listings were independently observed by a second leak-site crawler (multi-source). 1 listing — Minutes Quick Services (AE) — appears on a single source (ransomware.live) only, with no second-crawler confirmation that the posting even exists.
• What corroboration means: Multi-source confirmation verifies that the gang published the claim. It does not confirm that a breach occurred. No tier in this dataset confirms a breach — only the named organization or its regulator can do that.
• Disputes and denials: A named organization may dispute a listing, and a denial is likewise not proof the claim is false. Disclosure obligations vary by jurisdiction, sector, and materiality thresholds; not every incident is reportable, and neither silence nor denial settles the question.
• Corrections: Security Arsenal will publish corrections to this briefing as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

Analyst note: N0N is a lower-visibility actor compared to top-tier RaaS brands. Treat profile attributes marked "consistent with peer groups" as probabilistic, not confirmed, tradecraft attribution.

Current Campaign Analysis

Sector Targeting

From the seven listings observed:

• Not Found / unclassified (5): All US-based, published 2026-11-02 (Company #113 through Company #117). The absence of sector metadata in the gang's own postings is itself notable — either deliberate obfuscation or low-effort listing generation.
• Technology (1): Digital Triumph (Malaysia), published 2026-10-31.
• Professional Services (1): Minutes Quick Services (UAE), published 2026-10-30 — single-source listing, lowest confidence that the posting exists.

Geographic Concentration

• United States: 5 of 7 (71%) — all posted the same day, indicating either batch publication or a US-focused intrusion wave.
• Malaysia: 1 (Technology)
• United Arab Emirates: 1 (Professional Services)

Victim Profile

Based on sector composition, the likely victim profile is small-to-mid-market enterprises — organizations large enough to hold monetizable data but frequently below the security-maturity threshold of large enterprises. Professional services and technology firms in this band typically carry client data, credentials, and IP that increase extortion leverage. Revenue estimates cannot be responsibly assigned without confirmed identity data for the five unclassified US listings.

Posting Frequency / Escalation Pattern

The 5-listings-in-one-day pattern is the dominant signal. Two working hypotheses: (1) the gang sat on intrusions and published in a batch to maximize pressure; (2) a recent access wave — potentially via a single exploited edge technology — matured simultaneously. Defenders should assume the latter is possible and hunt accordingly.

CVE Exposure — Hypothesis Only

No evidence links any specific named listing above to any specific CVE. The following are actively exploited vulnerabilities (CISA KEV, confirmed ransomware use) that match the infrastructure classes this group and its peers are known to target. Treat these as sector-level exposure hypotheses and patch/hunt accordingly:

• CVE-2026-59310 — VMware vCenter path traversal (KEV 2026-08-18): Hypervisor management plane compromise is a hallmark of enterprise ransomware; vCenter access enables mass VM encryption in one stroke.
• CVE-2026-20316 — Cisco Secure FMC hard-coded password (KEV 2026-07-29): Firewall management plane takeover provides network-wide visibility and policy manipulation.
• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1) (KEV 2026-06-08): VPN edge exploitation is a top initial-access vector across ransomware ecosystems.
• CVE-2026-63077 — JetBrains TeamCity deserialization (KEV 2026-08-05): CI/CD compromise yields source code, build secrets, and signing keys — high-value exfiltration targets for technology-sector victims.
• CVE-2026-48027 — Nx Console embedded malicious code (KEV 2026-05-27): Supply-chain/developer-tooling vector; relevant to technology-sector targets.

Priority for this campaign: Given the US-heavy burst, edge remote-access devices (Check Point, Cisco FMC) and virtualization management (vCenter) should be validated first.

Detection Engineering

The following detections target the TTPs consistent with N0N's playbook and peer-group tradecraft: edge exploitation follow-on activity, lateral movement via PsExec/WMI, pre-encryption data staging, and shadow copy destruction.

---
title: N0N Campaign - PsExec or Remote Service Creation for Lateral Movement
id: 8f3a1c2e-n0n1-4a7b-9c2d-1e5f6a7b8c01
status: experimental
description: Detects creation of new Windows services consistent with PsExec-style remote execution, a lateral movement technique commonly observed in ransomware intrusions prior to encryption.
author: Security Arsenal Threat Intelligence
date: 2026/11/03
references:
  - https://securityarsenal.com/darkside
logsource:
  category: service_creation
  product: windows
detection:
  selection_svc_name:
    ServiceName|contains:
      - 'PSEXESVC'
      - 'PAExec'
      - 'RemCom'
  selection_random_name:
    ServiceName|re: '^[A-Za-z0-9]{8}$'
  selection_image:
    ImagePath|contains:
      - '\\ADMIN$\\'
      - '\\IPC$\\'
      - '%SystemRoot%\\PSEXESVC.exe'
  condition: selection_svc_name or selection_random_name and selection_image
falsepositives:
  - Legitimate administrative tooling (SCCM, PDQ, manage-engine) using remote service execution
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002
---
title: N0N Campaign - Pre-Encryption Data Staging via Archive Utilities or Rclone
id: 8f3a1c2e-n0n1-4a7b-9c2d-1e5f6a7b8c02
status: experimental
description: Detects execution of archive utilities and cloud-sync exfiltration tools (rclone, 7zip, WinRAR with suspicious paths) consistent with data staging before double-extortion leak.
author: Security Arsenal Threat Intelligence
date: 2026/11/03
logsource:
  category: process_creation
  product: windows
detection:
  selection_rclone:
    Image|endswith:
      - '\\rclone.exe'
    CommandLine|contains:
      - ' copy '
      - ' sync '
      - ' move '
      - '--config'
      - 'mega'
      - 's3'
  selection_archive:
    Image|endswith:
      - '\\7z.exe'
      - '\\7za.exe'
      - '\\rar.exe'
      - '\\winrar.exe'
    CommandLine|contains:
      - ' a '
      - ' -p'
      - ' -v'
      - '\\ProgramData\\'
      - '\\Users\\Public\\'
  filter_legit_paths:
    Image|startswith:
      - 'C:\\Program Files\\7-Zip\\'
      - 'C:\\Program Files\\WinRAR\\'
  condition: selection_rclone or (selection_archive and not filter_legit_paths)
falsepositives:
  - Backup administrators using 7zip/rclone for legitimate archival
  - Software packaging workflows
level: high
tags:
  - attack.collection
  - attack.t1560.001
  - attack.exfiltration
  - attack.t1537
---
title: N0N Campaign - Shadow Copy Deletion and Recovery Sabotage
id: 8f3a1c2e-n0n1-4a7b-9c2d-1e5f6a7b8c03
status: experimental
description: Detects deletion of Volume Shadow Copies and disabling of boot recovery — near-universal pre-encryption behavior across ransomware families including operations consistent with N0N.
author: Security Arsenal Threat Intelligence
date: 2026/11/03
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: '\\vssadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'resize shadowstorage'
  selection_wmic:
    Image|endswith: '\\wmic.exe'
    CommandLine|contains:
      - 'shadowcopy'
      - 'delete'
  selection_bcdedit:
    Image|endswith: '\\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
  selection_powershell:
    Image|endswith:
      - '\\powershell.exe'
      - '\\pwsh.exe'
    CommandLine|contains:
      - 'Get-WmiObject Win32_Shadowcopy'
      - 'Remove-WmiObject'
      - 'vssadmin delete shadows'
  condition: 1 of selection_*
falsepositives:
  - Storage administrators managing shadow storage quotas
  - Some backup agents resize shadowstorage (whitelist known tools)
level: critical
tags:
  - attack.impact
  - attack.t1490

The following KQL query hunts for pre-ransomware lateral movement and staging behavior in Microsoft Sentinel — correlated remote service creation, suspicious archive activity, and shadow-copy tampering within a rolling window on the same host.

// N0N pre-ransomware staging hunt: lateral movement + staging + recovery sabotage
// Lookback: 14 days | Tuning: adjust rarity threshold and excluded service accounts
let lookback = 14d;
let svcCreation =
    SecurityEvent
    | where TimeGenerated > ago(lookback)
    | where EventID == 7045
    | where ServiceName has_any ("PSEXESVC","PAExec","RemCom")
       or ServiceName matches regex "^[A-Za-z0-9]{8}$"
    | project SvcTime=TimeGenerated, Computer, Account, ServiceName, ServiceFileName;
let archiveStaging =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName in~ ("7z.exe","7za.exe","rar.exe","rclone.exe")
    | where ProcessCommandLine has_any (" a "," -p"," copy "," sync "," move ","--config")
    | project ArchiveTime=TimeGenerated, DeviceName, FileName, ProcessCommandLine, AccountName;
let shadowSabotage =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where (FileName =~ "vssadmin.exe" and ProcessCommandLine has "delete shadows")
       or (FileName =~ "wmic.exe" and ProcessCommandLine has "shadowcopy")
       or (FileName =~ "bcdedit.exe" and ProcessCommandLine has "recoveryenabled")
    | project SabotageTime=TimeGenerated, DeviceName, FileName, ProcessCommandLine;
svcCreation
| join kind=inner (archiveStaging) on $left.Computer == $right.DeviceName
| join kind=inner (shadowSabotage) on $left.Computer == $right.DeviceName
| extend WindowHours = datetime_diff("hour", SabotageTime, SvcTime)
| where WindowHours between (-72 and 72)
| summarize
    FirstSeen=min(SvcTime),
    LastSeen=max(SabotageTime),
    Services=make_set(ServiceName),
    ArchiveCmds=make_set(ProcessCommandLine)
    by Computer, Account
| extend Severity = "Critical - correlated pre-encryption staging"
| sort by LastSeen desc

The following PowerShell script provides rapid triage for a suspected pre-encryption window: exposed RDP listeners, recently created scheduled tasks, shadow copy integrity, and suspicious archive/sync tooling on disk.

# Security Arsenal - N0N Rapid Triage (run elevated on suspect hosts)
# Triage window: last 7 days
$window = (Get-Date).AddDays(-7)
Write-Host "=== N0N RAPID TRIAGE: $env:COMPUTERNAME ===" -ForegroundColor Cyan

# 1. RDP exposure
Write-Host "`n[1] RDP Listener Status" -ForegroundColor Yellow
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue
$nla = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue
Write-Host ("  RDP Enabled : " + $(if ($rdp.fDenyTSConnections -eq 0) {"YES - investigate"} else {"No"}))
Write-Host ("  NLA Enabled : " + $(if ($nla.UserAuthentication -eq 1) {"Yes"} else {"NO - brute force risk"}))
Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue | Format-Table LocalAddress,LocalPort,State -AutoSize

# 2. Scheduled tasks created in the last 7 days
Write-Host "`n[2] Scheduled Tasks Created Since $window" -ForegroundColor Yellow
Get-ScheduledTask | ForEach-Object {
    $info = Get-ScheduledTaskInfo $_ -ErrorAction SilentlyContinue
    if ($info -and $info.LastRunTime -gt $window) {
        [PSCustomObject]@{ Task=$_.TaskName; Path=$_.TaskPath; LastRun=$info.LastRunTime }
    }
} | Sort-Object LastRun -Descending | Format-Table -AutoSize

# 3. Volume Shadow Copy integrity
Write-Host "`n[3] Volume Shadow Copies" -ForegroundColor Yellow
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($shadows) {
    $shadows | Select-Object DeviceObject, InstallDate, VolumeName | Format-Table -AutoSize
} else {
    Write-Host "  WARNING: No shadow copies present - possible anti-recovery sabotage" -ForegroundColor Red
}

# 4. Staging tooling on disk (rclone / 7zip in non-standard paths)
Write-Host "`n[4] Exfiltration/Staging Tool Artifacts" -ForegroundColor Yellow
$searchPaths = @("C:\ProgramData","C:\Users\Public","C:\Windows\Temp","$env:TEMP")
foreach ($p in $searchPaths) {
    Get-ChildItem -Path $p -Recurse -Include "rclone.exe","7z.exe","7za.exe","rar.exe" -ErrorAction SilentlyContinue |
        Where-Object { $_.LastWriteTime -gt $window } |
        Select-Object FullName, LastWriteTime, Length
}

# 5. Recent failed logons (RDP brute force signature)
Write-Host "`n[5] Failed Logon Volume (Event 4625, last 24h)" -ForegroundColor Yellow
$fails = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue
Write-Host ("  Failed logons (24h): " + $(if ($fails) {$fails.Count} else {0}))
if ($fails.Count -gt 100) { Write-Host "  ALERT: Elevated failure volume - brute force pattern" -ForegroundColor Red }

Write-Host "`n=== TRIAGE COMPLETE ===" -ForegroundColor Cyan

Incident Response Priorities

T-Minus Detection Checklist (Pre-Encryption Window)

• Shadow copy tampering — any vssadmin delete shadows, wmic shadowcopy delete, or bcdedit recovery changes (critical; fires hours before encryption)
• Mass archive creation — 7zip/RAR jobs against \\ProgramData\\, \\Users\\Public\\, or file server roots
• Rclone/mega/S3 tooling on servers that have no business running sync clients
• New random-named services (8-char alphanumeric) or PSEXESVC across multiple hosts in a short window
• Edge device anomalies — new local admin accounts on VPN/firewall appliances, unexpected IKEv1 negotiation logs (Check Point), FMC login anomalies
• vCenter/TeamCity authentication anomalies — service-account logons from workstation subnets

Likely Exfiltration Priorities

Based on the sector mix in this campaign, expect targeting of:

1. Client data and contracts (professional services leverage)
2. Source code, build secrets, CI/CD credentials (technology-sector leverage — reinforces the TeamCity/Nx hypothesis)
3. HR/PII and financial records (regulatory-pressure leverage)
4. Domain controller / identity stores (ntds.dit) for both leverage and persistence

Containment Actions — Ordered by Urgency

1. Isolate, don't power off — network-quarantine suspected hosts to preserve memory artifacts
2. Disable edge remote access — force-reset VPN concentrator credentials; block IKEv1 on Check Point gateways until patched (CVE-2026-50751)
3. Reset tier-0 credentials — domain admins, vCenter SSO admins, TeamCity service accounts, FMC accounts
4. Block exfil channels — egress filtering on rclone endpoints (mega.io, S3, Backblaze), deny-list known leak-adjacent infrastructure
5. Snapshot critical VMs before any remediation touches vCenter
6. Engage IR retainer before negotiating or wiping anything — leak-site claims often exaggerate scope; evidence determines reality

Hardening Recommendations

Immediate (24 Hours)

• Patch the edge: Verify remediation status for CVE-2026-50751 (Check Point IKEv1), CVE-2026-20316 (Cisco FMC hard-coded password — rotate all FMC credentials regardless), and CVE-2026-59310 (vCenter). These are confirmed ransomware-exploited KEV entries.
• Kill legacy VPN auth: Disable IKEv1 aggressive mode; enforce MFA on all remote access.
• Deploy the Sigma rules above to your SIEM and validate the shadow-copy rule fires on a test host.
• Run the triage PowerShell on internet-adjacent servers and any host matching the staging profile.
• Audit for rclone/7zip on servers via your EDR software inventory — these should not exist outside IT workstations.

Short-Term (2 Weeks)

• Segment the management plane: vCenter, FMC, TeamCity, and backup infrastructure must sit in a dedicated, ACL'd management network with jump-host-only access.
• CI/CD isolation (CVE-2026-63077, CVE-2026-48027): Move build servers off flat networks; rotate all build secrets and signing keys if TeamCity was internet-reachable at any point since August.
• Immutable backups: Enforce offline/immutable copies with a separate credential domain — ransomware operators explicitly hunt backup infrastructure.
• Egress control: Default-deny outbound for server VLANs; alert on any new destination ASNs.
• Leak-site monitoring: Subscribe to victim-monitoring (your brand, subsidiaries, key suppliers) so a future claim against you surfaces in hours, not weeks.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub