Classification: TLP:CLEAR | Publication Date: 2026-11-02 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang: 7 New Organizations Named on Dark Web Leak Site — Sector Targeting Analysis & Detection Rules

Executive Summary

Between 2026-10-30 and 2026-11-02, the N0N ransomware group published seven new listings to its .onion leak site, naming organizations headquartered in the United States, Malaysia, and the United Arab Emirates. Five of the seven listings are unnamed entities in the US labeled 'Company #113' through 'Company #117' with no sector attribution available; the two named listings are Digital Triumph (Technology, Malaysia, listed 2026-10-31) and Minutes Quick Services (Professional Services, UAE, listed 2026-10-30). All seven listings are claims made by a criminal threat actor on its own infrastructure. None of these listings constitutes a confirmed breach.

The posting tempo — five US listings on a single day (2026-11-02) — suggests either a batch publication of previously-compromised access or an aggressive claims campaign designed to pressure negotiations. Enterprise security teams operating VMware vCenter, JetBrains TeamCity, Cisco FMC, Check Point gateways, or exposed RDP/VPN infrastructure should treat this activity as an operational warning and run the detection content in this briefing immediately, regardless of whether their organization appears on any leak site.

Sourcing & Verification

• Corroboration of postings: 6 of 7 listings were independently observed by a second leak-site crawler (MULTI-SOURCE), meaning the gang did publish those claims. 1 listing — Minutes Quick Services — appears on a single source only (ransomware.live) with no second-crawler confirmation that the posting even exists.
• What corroboration does NOT mean: MULTI-SOURCE confirms only that the threat actor published the claim. Inclusion in this briefing reflects the threat actor's own statement and is not confirmation of a breach, an intrusion, or any security incident at any named organization. No tier of our data confirms a breach — only the organization itself or its regulator can do that.
• Disputes and denials: A named organization may dispute its listing, and a denial is likewise not proof the claim is false. Disclosure obligations vary by jurisdiction and sector, and not every incident is reportable — so neither silence nor denial settles the question. We report the claim's existence, nothing more.
• Corrections: Security Arsenal will publish corrections promptly. We welcome contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

Aliases: N0N (primary branding). No widely documented alias cluster as of this publication; monitor for rebrand indicators on breach forums.

Operating model: N0N presents as a closed or semi-closed ransomware-as-a-service (RaaS) operation, consistent with batch victim posting patterns and a maintained .onion disclosure site with negotiation portals.

Ransom demands: Demands observed across comparable closed-group operations in this tier typically range from low-six-figures to low-seven-figures USD, scaled to estimated victim revenue. Mid-market professional services and technology firms — the profile visible in this week's listings — are commonly pressured in the $150K–$1M band, with double-extortion leverage ('pay or we publish') as the standard threat.

Initial access methods (known and assessed):

• Exploitation of perimeter appliances — VPN concentrators, firewalls, and remote access gateways (see CVE section below).
• Phishing with macro-enabled or script-payload attachments leading to loader execution.
• Exposed RDP — brute force and credential stuffing against internet-facing 3389.
• Purchased access from initial access brokers (IABs), evidenced in batch campaigns by heterogeneous victimology with a common detonation toolkit.

Extortion model: Double extortion — data staged and exfiltrated before encryption, with leak-site publication used as negotiation leverage. The batch-posting pattern observed 2026-11-02 (five US entities in one day) is consistent with a 'dump the non-payers' escalation cadence.

Dwell time: Comparable crews in this tier typically operate with 3–14 days of dwell time between initial access and detonation, during which staging, credential theft, and exfiltration occur. This pre-encryption window is the defender's opportunity — the detection content below is built around it.

Current Campaign Analysis

Sectors targeted

From the seven listings: five entities carry no sector attribution ('Not Found'), one is Technology (Digital Triumph), and one is Professional Services (Minutes Quick Services). The technology and professional-services skew in the named listings is consistent with the group's historical preference for data-rich mid-market firms whose clients create secondary pressure to pay.

Geographic concentration

• United States: 5 listings (Company #113–#117), all published 2026-11-02
• Malaysia: 1 listing (Digital Triumph, 2026-10-31)
• United Arab Emirates: 1 listing (Minutes Quick Services, 2026-10-30)

The US-heavy concentration matches the general ransomware economy; the MY and AE listings suggest the group's access pipeline (likely broker-sourced) is not geographically restricted.

Victim profile

The named organizations and the unnamed US entities fit a mid-market profile: large enough to carry cyber insurance and pay five-to-six-figure demands, small enough to lack 24/7 SOC coverage. Professional services and technology firms in this band typically hold concentrated client data — contracts, financials, PII — making them efficient double-extortion targets.

Posting frequency and escalation

Seven listings across four days, with five dropped in a single 24-hour window, is an escalation pattern. Two interpretations: (1) a batch of intrusions from a shared access source reached negotiation failure simultaneously, or (2) deliberate shock-posting to raise the group's profile. Either way, expect follow-on listings in the coming week.

CVE exposure — hypothesis, not attribution

We have no evidence linking any specific named listing to any specific CVE. However, N0N-tier groups are known to favor perimeter-appliance exploitation, and the following CISA KEV entries (all confirmed as ransomware-exploited) represent the exposure classes defenders in targeted sectors should assume are being probed right now:

• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1). Gateway compromise = direct network foothold.
• CVE-2026-20316 — Cisco Secure FMC hard-coded password. Management-plane takeover of the firewall estate.
• CVE-2026-59310 — VMware vCenter path traversal. Hypervisor management access — the classic pre-encryption pivot for mass ESXi detonation.
• CVE-2026-63077 — JetBrains TeamCity deserialization. Build-server compromise — especially relevant for technology-sector victims and supply-chain follow-on.
• CVE-2026-48027 — Nx Console embedded malicious code. Developer-workstation supply chain vector.

If any of these products are internet-reachable in your environment and unpatched, you are in the same exposure pool as this campaign's target class. Patch or isolate first, hunt second.

Detection Engineering

The Sigma rules below target the pre-encryption window: perimeter/remote-access anomalies, lateral movement tooling (PsExec/WMI), and pre-ransomware staging behavior (shadow copy tampering, mass file access).

---
title: N0N Campaign — Suspicious RDP/VPN Brute Force Followed by Successful Logon
id: 8f2c1a7e-3b4d-4e6a-9c1f-n0n000000001
status: experimental
description: Detects burst of failed logons followed by a successful interactive/remote logon from the same source, consistent with RDP brute force or VPN credential stuffing used by ransomware crews for initial access.
author: Security Arsenal Threat Intelligence
references:
    - https://securityarsenal.com/darkside
logsource:
    product: windows
    service: security
detection:
    selection_failed:
        EventID: 4625
    selection_success:
        EventID: 4624
        LogonType:
            - 3
            - 10
    condition: selection_failed and selection_success
timeframe: 15m
falsepositives:
    - Legitimate password spray from misconfigured service accounts
    - Vulnerability scanners
level: high
tags:
    - attack.initial_access
    - attack.t1110
    - attack.t1078
---
title: N0N Campaign — PsExec or WMI Remote Service Execution
id: 8f2c1a7e-3b4d-4e6a-9c1f-n0n000000002
status: experimental
description: Detects remote service creation (PsExec-style) and WMI process creation used for lateral movement during ransomware staging phases.
author: Security Arsenal Threat Intelligence
references:
    - https://securityarsenal.com/darkside
logsource:
    category: process_creation
    product: windows
detection:
    selection_psexec:
        EventID: 7045
        ServiceName|contains:
            - 'PSEXESVC'
            - 'PAExec'
            - 'csexec'
    selection_wmi:
        ParentImage|endswith: '\WmiPrvSE.exe'
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\rundll32.exe'
    condition: 1 of selection_*
falsepositives:
    - Legitimate administrative tooling (SCCM, PDQ)
    - IT management software
level: high
tags:
    - attack.lateral_movement
    - attack.t1021.002
    - attack.t1047
    - attack.t1569.002
---
title: N0N Campaign — Pre-Encryption Staging (Shadow Copy Deletion and Mass File Access)
id: 8f2c1a7e-3b4d-4e6a-9c1f-n0n000000003
status: experimental
description: Detects Volume Shadow Copy deletion via vssadmin/wmic and suspicious bulk data access consistent with ransomware pre-detonation staging and recovery-inhibition behavior.
author: Security Arsenal Threat Intelligence
references:
    - https://securityarsenal.com/darkside
logsource:
    category: process_creation
    product: windows
detection:
    selection_vss:
        - Image|endswith: '\vssadmin.exe'
          CommandLine|contains:
              - 'delete shadows'
              - 'Delete Shadows'
        - Image|endswith: '\wmic.exe'
          CommandLine|contains: 'shadowcopy'
    selection_bcd:
        Image|endswith: '\bcdedit.exe'
        CommandLine|contains:
            - 'recoveryenabled'
            - 'bootstatuspolicy'
    condition: 1 of selection_*
falsepositives:
    - Backup software maintenance
    - System administrators performing storage cleanup
level: critical
tags:
    - attack.impact
    - attack.t1490
    - attack.defense_evasion

KQL hunt query for Microsoft Sentinel — lateral movement and pre-ransomware staging indicators:

// N0N Campaign Hunt: Lateral movement tooling + staging indicators over 7 days
let Lookback = 7d;
let SuspiciousTools = dynamic(["psexec.exe","psexesvc.exe","paexec.exe","wmic.exe","nltest.exe","adfind.exe","netscan.exe","rclone.exe","megasync.exe","filezilla.exe"];
let LateralEvents =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName in~ (SuspiciousTools)
       or (InitiatingProcessFileName =~ "WmiPrvSE.exe" and FileName in~ ("powershell.exe","cmd.exe","rundll32.exe"))
    | extend Indicator = iff(FileName in~ ("rclone.exe","megasync.exe","filezilla.exe"), "Possible Exfil Staging",
                        iff(FileName in~ ("adfind.exe","nltest.exe","netscan.exe"), "Domain Recon", "Lateral Movement Tool"))
    | summarize Commands = make_set(ProcessCommandLine, 5), IndicatorTypes = make_set(Indicator), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
        by DeviceName, AccountName, FileName;
let VssTamper =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where (FileName =~ "vssadmin.exe" and ProcessCommandLine has "delete shadows")
       or (FileName =~ "wmic.exe" and ProcessCommandLine has "shadowcopy")
       or (FileName =~ "bcdedit.exe" and ProcessCommandLine has "recoveryenabled")
    | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, AlertHint = "RECOVERY-INHIBITION: likely pre-encryption";
LateralEvents;
// Run VssTamper separately for critical pre-detonation signal — any hit warrants immediate IR engagement

Rapid-response PowerShell script — enumerate exposed RDP, new scheduled tasks, and shadow copy state:

# N0N Rapid Triage — run elevated on suspected hosts. Outputs to C:\IR-Triage\
$out = "C:\IR-Triage\$env:COMPUTERNAME-$(Get-Date -Format 'yyyyMMdd-HHmmss')"
New-Item -ItemType Directory -Path $out -Force | Out-Null

# 1. RDP exposure check
"=== RDP CONFIGURATION ===" | Out-File "$out\rdp.txt"
(Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server').fDenyTSConnections |
    ForEach-Object { "RDP Disabled flag: $_ (0 = RDP ENABLED)" } | Out-File "$out\rdp.txt" -Append
Get-NetTCPConnection -LocalPort 3389 -ErrorAction SilentlyContinue |
    Select-Object LocalAddress,RemoteAddress,State | Out-File "$out\rdp.txt" -Append

# 2. Scheduled tasks created/modified in last 7 days
Get-ScheduledTask | ForEach-Object {
    $i = $_ | Get-ScheduledTaskInfo
    [PSCustomObject]@{ Name=$_.TaskName; Path=$_.TaskPath; LastRun=$i.LastRunTime; Author=$_.Author }
} | Where-Object { $_.LastRun -gt (Get-Date).AddDays(-7) } |
    Sort-Object LastRun -Descending | Out-File "$out\new_tasks.txt"

# 3. Shadow copy inventory (absence after known backups = tamper indicator)
"=== VOLUME SHADOW COPIES ===" | Out-File "$out\vss.txt"
vssadmin list shadows | Out-File "$out\vss.txt" -Append

# 4. Recent service installations (PsExec-class lateral movement artifacts)
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
    Select-Object TimeCreated, Message | Out-File "$out\new_services.txt"

# 5. Suspicious outbound listeners / beacons
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object { $_.RemotePort -in 443,4444,8443,8080 -and $_.RemoteAddress -notlike '10.*' -and $_.RemoteAddress -notlike '192.168.*' } |
    ForEach-Object { $_ | Add-Member -NotePropertyName ProcessName -NotePropertyValue (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName -PassThru } |
    Select-Object LocalPort,RemoteAddress,RemotePort,ProcessName | Out-File "$out\beacons.txt"

Write-Host "Triage bundle written to $out — review new_services.txt and beacons.txt FIRST."

Incident Response Priorities

T-minus detection checklist — before encryption fires

1. vssadmin/bcdedit/wmic shadow-copy tampering — the single highest-fidelity pre-detonation signal. Any hit = treat as active intrusion.
2. New service installations (Event 7045) with random or masquerading names — PsExec-class lateral movement.
3. AdFind/nltest/netscan execution — domain reconnaissance typically 24–72 hours before detonation.
4. Rclone, MEGAsync, FileZilla, or 7-Zip bulk-archive processes on servers holding sensitive data — exfil staging.
5. Anomalous after-hours admin logons, especially service accounts authenticating interactively.
6. EDR tampering events — agents disabled, sensors uninstalled, or safe-mode boot attempts on servers.

Assets this gang's tier prioritizes for exfiltration

• Finance and HR file shares (payroll, banking, PII)
• Client contracts and legal documents (professional-services leverage material)
• Source code repositories and build artifacts (technology-sector leverage; TeamCity compromise makes this urgent)
• Backup catalogs and backup admin credentials
• Email of executive and legal teams

Containment actions, ordered by urgency

1. Isolate, don't power off — network-isolate suspected hosts; preserve RAM for forensic capture of in-memory tooling.
2. Disable compromised accounts and force enterprise-wide credential reset starting with domain admins, VPN users, and backup admins.
3. Block known exfil channels — egress-filter rclone/MEGA/file-sharing destinations and unclassified cloud storage.
4. Cut lateral paths — disable PsExec-capable admin shares where feasible, restrict WMI to management hosts, enforce LAPS.
5. Protect backups — take backup infrastructure offline or into immutable/air-gapped mode immediately upon any staging indicator.
6. Engage IR retainer and legal counsel before any threat-actor contact; do not access the gang's negotiation portal from corporate infrastructure.

Hardening Recommendations

Immediate (24 hours)

• Patch or isolate Check Point gateways (CVE-2026-50751), Cisco FMC (CVE-2026-20316), vCenter (CVE-2026-59310), and TeamCity (CVE-2026-63077). If patching isn't possible today, remove the management interfaces from internet reachability.
• Audit RDP exposure: nmap -p 3389 your own external ranges; close anything unauthenticated by VPN or ZTNA.
• Deploy the Sigma rules above to your SIEM and validate the vssadmin rule fires in a test.
• Verify backup immutability and test one restore. Assume the attacker has read your backup catalog.
• Block macro execution from Office via GPO if not already done; enable Attack Surface Reduction rules in block mode.

Short-term (2 weeks)

• Eliminate flat network paths: tier administration, separate workstation and server VLANs, and restrict SMB/RPC between workstation segments.
• Move remote access behind phishing-resistant MFA (FIDO2) and deprecate IKEv1 wherever it remains enabled on Check Point estates.
• Deploy canary files and honey credentials on file servers — near-zero-false-positive early warning for staging behavior.
• Implement egress filtering with TLS inspection on server segments; servers should not be able to reach arbitrary cloud storage.
• Stand up continuous dark-web monitoring for your organization's name, domains, and executive identities so a leak-site listing triggers an internal response within hours, not weeks.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub