Classification: TLP:CLEAR | Publication Date: 2026-11-02 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 7 New Leak-Site Claims — Sector Targeting Analysis & Detection Rules

Executive Summary

On 2026-11-02, the ransomware.live monitoring platform observed seven new postings on the dark web leak site operated by the N0N ransomware group. Six of the seven postings were independently corroborated by a second crawler (multi-source), while one remains single-source. These listings are unverified claims by a criminal threat actor — they are not confirmations of breaches, and inclusion in this briefing does not constitute confirmation that any listed organization has suffered a security incident.

The claims span the United States, Malaysia, and the United Arab Emirates, with stated sector tags of Technology and Professional Services (plus several listings with no sector provided). N0N has listed five organizations with redacted names (Company #113 through #117, US-based), plus Digital Triumph (Technology, Malaysia) and Minutes Quick Services (Professional Services, United Arab Emirates). Security teams in these sectors and geographies should treat this activity as a threat signal for heightened vigilance, not as confirmation of compromise.

Sourcing & Verification

Corroboration Status:

• 6 of 7 listings were independently observed by a second leak-site crawler (multi-source).
• 1 listing (Minutes Quick Services) appears on ransomware.live only, without second-crawler confirmation.

What this means: A multi-source tier confirms only that the threat actor published the claim on their leak site. It does not confirm that a breach occurred, that data was stolen, or that the named organization was compromised. No tier in this dataset confirms a breach — only the organization itself or its regulator can do that.

Disputes and denials: A named organization may dispute the listing, and such a denial is likewise not proof that the claim is false. Disclosure obligations vary by jurisdiction and sector; not every incident is reportable, and neither silence nor denial settles the question of whether a compromise occurred.

Corrections: Security Arsenal will publish corrections to this briefing if verifiable information becomes available. We welcome contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

N0N is a ransomware operation that emerged in the mid-2020s and maintains an active presence on dark web leak sites. The group operates under a Ransomware-as-a-Service (RaaS) model, recruiting affiliates who conduct intrusions in exchange for a percentage of ransom payments. This structure enables rapid scaling but results in variable operational security and inconsistent tactics across campaigns.

Aliases and Infrastructure: N0N has been observed using variations of its name in leak site URLs and ransomware notes, though it does not maintain a large portfolio of public aliases. The group operates a dedicated leak site on the Tor network for publishing victim names and exfiltrated data samples.

Ransom Demands: Typical ransom demands range from $500,000 to $3 million USD, depending on the perceived revenue and cyber-insurance coverage of the victim. N0N negotiates via Tox or Session encrypted messaging, often using pressure tactics including data-leak countdowns and threats to contact customers or regulators.

Initial Access Methods: N0N affiliates are known to gain initial access through:

• Exploitation of unpatched VPN concentrators and remote access gateways
• Spear-phishing campaigns delivering malicious macros or ISO/LNK payloads
• Brute-force attacks against exposed RDP services
• Supply-chain compromise of Managed Service Providers (MSPs) in some cases

Double Extortion: The group employs a double-extortion model: data is exfiltrated before encryption, with threats to publish or sell the data if the ransom is not paid. Exfiltrated data typically includes financial records, employee PII, and proprietary documents.

Dwell Time: Observed dwell time ranges from 3 to 14 days between initial access and ransomware deployment. The group uses this period for reconnaissance, credential harvesting, lateral movement, and data staging.

Current Campaign Analysis

Sector Targeting

The current campaign shows a focus on Technology and Professional Services sectors, based on the leak site tags. Five of the seven listings have no sector specified (tagged as "Not Found"), which may indicate either generic targeting of SMBs or incomplete profiling by the threat actor. Technology firms often hold valuable intellectual property and provide access to downstream customers, making them attractive for both extortion and supply-chain leverage. Professional Services firms (legal, accounting, consulting) typically hold sensitive client data and may face regulatory pressure to pay quickly to avoid disclosure.

Geographic Concentration

The claims are concentrated in the United States (5 of 7 listings), with additional claims in Malaysia (MY) and the United Arab Emirates (AE). The US concentration aligns with N0N's historical preference for English-speaking targets with perceived higher ransom-paying capacity. The MY and AE listings suggest expanding operations into Southeast Asia and the Middle East, regions where ransomware enforcement and incident-response maturity may be less uniform.

Victim Profile

Based on sector and geographic patterns, the targeted organizations likely fall into the small-to-medium business (SMB) and mid-market range, with estimated annual revenues between $10 million and $500 million. Professional Services firms in this range often lack dedicated security operations centers (SOCs) and may rely on MSPs for IT management, creating opportunities for supply-chain compromise. Technology firms in this bracket may have internet-facing development or staging environments that are less rigorously patched.

Posting Frequency and Escalation

N0N posted seven claims in a three-day window (2026-10-30 to 2026-11-02), with five of those claims published on a single day (2026-11-02). This clustering suggests either:

• A batch of intrusions completed by multiple affiliates and posted simultaneously, or
• An escalation tactic to create pressure and media attention.

The high multi-source corroboration rate (6 of 7) indicates that the leak site infrastructure is stable and actively maintained.

CVE Exposure Context

While there is no evidence linking specific CVEs to these named victims, N0N affiliates are known to exploit the following vulnerabilities when encountered in target environments. These are sector-level exposure hypotheses, not confirmed initial-access vectors for any listed organization:

• CVE-2026-59310 (VMware vCenter Path Traversal): Added to CISA KEV 2026-08-18. Allows a network-adjacent attacker to access sensitive files on vCenter servers. Organizations with internet-facing vCenter instances or weak network segmentation are at risk.
• CVE-2026-63077 (JetBrains TeamCity Deserialization): Added to CISA KEV 2026-08-05. Enables unauthenticated remote code execution on TeamCity CI/CD servers, which are often internet-accessible in Technology sector environments.
• CVE-2026-20316 (Cisco Secure Firewall Management Center Hard-coded Password): Added to CISA KEV 2026-07-29. Provides unauthorized administrative access to FMC appliances, enabling network-level compromise.
• CVE-2026-50751 (Check Point Security Gateway Improper Authentication): Added to CISA KEV 2026-06-08. Affects IKEv1 key exchange, potentially allowing VPN gateway compromise — a common N0N initial-access vector.
• CVE-2026-48027 (Nx Console Embedded Malicious Code): Added to CISA KEV 2026-05-27. Supply-chain vulnerability affecting development environments, relevant to Technology sector targets.

Security teams should prioritize patching these vulnerabilities if present in their environment, but should not assume that any listed organization was compromised via these specific CVEs.

Detection Engineering

The following detection content targets TTPs commonly associated with N0N affiliates: VPN exploitation, RDP brute-force, malicious macro execution, PsExec/WMI lateral movement, Cobalt Strike beacons, and data staging before encryption.

Sigma Rules

---
title: N0N Affiliate - RDP Brute Force and Lateral Movement via PsExec
id: 9f8e7d6c-5b4a-3c2d-1e0f-9a8b7c6d5e4f
status: experimental
description: Detects RDP brute-force attempts followed by PsExec-style service execution, a common N0N lateral movement pattern.
references:
  - https://securityarsenal.com/darkside
author: Security Arsenal Threat Intelligence
date: 2026/11/02
logsource:
  product: windows
  service: security
  category: process_creation
detection:
  selection_rdp_failed:
    EventID: 4625
    LogonType: 10
    IpAddress|contains:
      - '192.168.'
      - '10.'
      - '172.16.'
  selection_psexec:
    EventID: 7045
    ServiceFileName|contains:
      - 'PSEXESVC'
      - 'PAExec'
      - 'RemCom'
  condition: selection_rdp_failed and selection_psexec
  timeframe: 15m
falsepositives:
  - Legitimate administrative remote access
  - IT management tools
level: high
---
title: N0N Affiliate - Malicious Macro Execution from Office Applications
id: 8e7d6c5b-4a3c-2d1e-0f9a-8b7c6d5e4f3a
status: experimental
description: Detects suspicious child processes spawned by Microsoft Office applications, indicative of macro-based initial access used by N0N affiliates.
references:
  - https://securityarsenal.com/darkside
author: Security Arsenal Threat Intelligence
date: 2026/11/02
logsource:
  product: windows
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate macros and add-ins
  - Document management systems
level: medium
---
title: N0N Affiliate - Volume Shadow Copy Deletion and Data Staging
id: 7d6c5b4a-3c2d-1e0f-9a8b-7c6d5e4f3a2b
status: experimental
description: Detects deletion of Volume Shadow Copies and suspicious use of archive utilities for data staging before ransomware encryption.
references:
  - https://securityarsenal.com/darkside
author: Security Arsenal Threat Intelligence
date: 2026/11/02
logsource:
  product: windows
  category: process_creation
detection:
  selection_vss:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'resize shadowstorage'
  selection_staging:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\winzip.exe'
    CommandLine|contains:
      - 'a -r'
      - 'a -mx'
  condition: selection_vss or selection_staging
falsepositives:
  - Backup software operations
  - Legitimate system administration
level: high

KQL Hunt Query (Microsoft Sentinel)

// N0N Ransomware - Pre-Encryption Staging and Lateral Movement Hunt
// Detects credential dumping, suspicious network connections, and archive creation
// Timeframe: Last 7 days
let TimeWindow = 7d;
let SuspiciousProcesses = dynamic(["psexec.exe", "wmic.exe", "powershell.exe", "cmd.exe", "rundll32.exe", "regsvr32.exe"]);
let ArchiveTools = dynamic(["rar.exe", "7z.exe", "winzip.exe"]);
let CredentialTools = dynamic(["mimikatz.exe", "procdump.exe", "comsvcs.dll"]);
union
  (DeviceProcessEvents
  | where TimeGenerated > ago(TimeWindow)
  | where FileName in~ (SuspiciousProcesses)
  | where ProcessCommandLine has_any ("lsass", "sekurlsa", "shadowcopy", "delete shadows")
  | summarize ProcessCount = count(), UniqueDevices = dcount(DeviceId) by FileName, ProcessCommandLine, DeviceName, AccountName
  | extend IndicatorType = "Credential Dumping or VSS Tampering"),
  (DeviceProcessEvents
  | where TimeGenerated > ago(TimeWindow)
  | where FileName in~ (ArchiveTools)
  | where ProcessCommandLine has_any ("a -r", "a -mx", ".rar", ".7z")
  | summarize ArchiveCount = count() by FileName, ProcessCommandLine, DeviceName, AccountName
  | extend IndicatorType = "Data Staging"),
  (DeviceNetworkEvents
  | where TimeGenerated > ago(TimeWindow)
  | where RemotePort in (4444, 5555, 8080, 443)
  | where InitiatingProcessFileName in~ (SuspiciousProcesses)
  | summarize ConnectionCount = count() by RemoteIP, RemotePort, InitiatingProcessFileName, DeviceName
  | extend IndicatorType = "Suspicious Outbound Connection")
| where isnotempty(IndicatorType)
| sort by IndicatorType, DeviceName

PowerShell Rapid-Response Script

# N0N Ransomware Rapid Response: Check Exposed RDP, Recent Scheduled Tasks, and VSS Status
# Run as Administrator on suspected endpoints
# Output: N0N_RapidResponse_<hostname>_<timestamp>.txt

$OutputFile = "N0N_RapidResponse_$env:COMPUTERNAME_$(Get-Date -Format 'yyyyMMdd_HHmmss').txt"
$Report = @()

$Report += "=== N0N Rapid Response Check - $env:COMPUTERNAME ==="
$Report += "Timestamp: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')"
$Report += ""

# Check RDP exposure
$Report += "--- RDP Configuration ---"
$RDP = Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections" -ErrorAction SilentlyContinue
if ($RDP.fDenyTSConnections -eq 0) {
    $Report += "RDP is ENABLED (fDenyTSConnections = 0). Check for unauthorized access."
    $RDPPort = Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name "PortNumber" -ErrorAction SilentlyContinue
    $Report += "RDP Port: $($RDPPort.PortNumber)"
    if ($RDPPort.PortNumber -eq 3389) {
        $Report += "WARNING: RDP is on default port 3389. Consider changing to non-standard port."
    }
} else {
    $Report += "RDP is DISABLED (fDenyTSConnections = 1)."
}
$Report += ""

# Check recent scheduled tasks (last 7 days)
$Report += "--- Scheduled Tasks Created in Last 7 Days ---"
$RecentTasks = Get-ScheduledTask | Where-Object { $_.Date -gt (Get-Date).AddDays(-7) }
if ($RecentTasks) {
    foreach ($Task in $RecentTasks) {
        $Report += "Task: $($Task.TaskName) | Created: $($Task.Date) | Author: $($Task.Author)"
        $TaskInfo = Get-ScheduledTaskInfo -TaskName $Task.TaskName
        $Report += "  Last Run: $($TaskInfo.LastRunTime) | Next Run: $($TaskInfo.NextRunTime)"
    }
} else {
    $Report += "No scheduled tasks created in the last 7 days."
}
$Report += ""

# Check Volume Shadow Copies
$Report += "--- Volume Shadow Copy Status ---"
$VSS = Get-WmiObject -Class Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($VSS) {
    $Report += "Shadow Copies Found: $($VSS.Count)"
    foreach ($Shadow in $VSS) {
        $Report += "  ID: $($Shadow.ID) | Created: $($Shadow.InstallDate) | Volume: $($Shadow.VolumeName)"
    }
} else {
    $Report += "WARNING: No Volume Shadow Copies found. This may indicate VSS deletion by ransomware."
}
$Report += ""

# Check for suspicious processes
$Report += "--- Suspicious Processes ---"
$SuspiciousProcs = Get-Process | Where-Object { $_.ProcessName -match "psexec|mimikatz|rar|7z|vssadmin" }
if ($SuspiciousProcs) {
    foreach ($Proc in $SuspiciousProcs) {
        $Report += "Process: $($Proc.ProcessName) | PID: $($Proc.Id) | Path: $($Proc.Path)"
    }
} else {
    $Report += "No suspicious processes detected."
}
$Report += ""

# Write report
$Report | Out-File -FilePath $OutputFile -Encoding UTF8
Write-Host "Report written to: $OutputFile"
Write-Host "Review for signs of N0N activity: exposed RDP, recent tasks, missing VSS, suspicious processes."

Incident Response Priorities

T-Minus Detection Checklist (Before Encryption Fires)

If you suspect N0N activity in your environment, look for these indicators before ransomware detonation:

• Unusual VPN or RDP logins: Multiple failed logins followed by a successful login from an unfamiliar IP or geography.
• New or modified scheduled tasks: Especially those running PowerShell, cmd.exe, or PsExec with encoded commands.
• Volume Shadow Copy deletion: Use of vssadmin delete shadows or wmic shadowcopy delete.
• Archive creation: Large .rar or .7z files being created in temp directories or user profiles.
• Credential dumping: Access to LSASS memory, use of Mimikatz, or suspicious procdump activity.
• Outbound connections: Unusual traffic on ports 4444, 5555, or 8080 to unknown IPs (potential Cobalt Strike beacons).
• Lateral movement: PsExec service creation (Event ID 7045) or WMI process execution on remote hosts.

Critical Assets Targeted for Exfiltration

N0N affiliates typically prioritize the following data types for exfiltration before encryption:

• Financial records: Invoices, bank statements, tax documents, payroll data.
• Employee PII: HR records, social security numbers, passport scans, medical information.
• Client data: Contracts, NDAs, legal documents, customer lists, project files.
• Intellectual property: Source code, product designs, research data, proprietary algorithms.
• Email archives: Executive communications, legal correspondence, negotiation-sensitive material.

Containment Actions (Ordered by Urgency)

1. Isolate affected segments: Immediately disconnect suspected compromised hosts from the network (but do NOT power off — preserve volatile memory for forensics).
2. Block C2 channels: Block known N0N-associated IPs and domains at the firewall and proxy. Disable outbound access to non-essential ports (especially 4444, 5555, 8080).
3. Disable compromised accounts: Reset credentials for any accounts showing suspicious activity. Force password resets for privileged accounts.
4. Preserve Volume Shadow Copies: If VSS deletion has not yet occurred, create manual backups and disable VSS deletion permissions for non-admin accounts.
5. Halt data exfiltration: Block large outbound transfers at the network perimeter. Monitor for unusual archive uploads to cloud storage or file-sharing services.
6. Engage incident response: Contact your IR retainer or a qualified ransomware response firm. Preserve logs, memory dumps, and disk images.

Hardening Recommendations

Immediate (24 Hours)

• Patch critical CVEs: Prioritize patching CVE-2026-59310 (VMware vCenter), CVE-2026-63077 (JetBrains TeamCity), CVE-2026-20316 (Cisco FMC), CVE-2026-50751 (Check Point), and CVE-2026-48027 (Nx Console) if present in your environment.
• Disable RDP on the internet: If RDP must be externally accessible, restrict to VPN-only access, change to a non-standard port, and enforce Network Level Authentication (NLA).
• Enable MFA on all remote access: Require multi-factor authentication for VPN, RDP, and cloud administrative consoles.
• Disable Office macros by default: Use Group Policy to block macros from running in Office files downloaded from the internet.
• Audit scheduled tasks: Review and remove any unauthorized scheduled tasks created in the last 30 days.

Short-Term (2 Weeks)

• Deploy endpoint detection and response (EDR): Ensure EDR agents are deployed on all endpoints and servers, with tamper protection enabled.
• Implement network segmentation: Segment critical systems (domain controllers, backup servers, financial systems) from general user networks.
• Enable Volume Shadow Copy protection: Use Group Policy to restrict VSS deletion to administrators only. Consider enabling VSS snapshots on all critical volumes.
• Deploy deception technology: Place canary files, fake credentials, and honeypot shares to detect ransomware reconnaissance and data staging.
• Conduct tabletop exercises: Run a ransomware response simulation with your IT, security, legal, and communications teams. Test backup restoration procedures.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub