Classification: TLP:CLEAR | Publication Date: 2026-10-24 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

N0N Ransomware Gang Claims 18 New Victims in 48 Hours — Manufacturing, Healthcare & Tech Targeted

Executive Summary

Between 2026-10-22 and 2026-10-24, the ransomware group tracked as N0N posted 18 organizations to its dark web leak site — a compressed publication tempo that suggests either a coordinated detonation wave or a deliberate intimidation push ahead of the weekend news cycle. The listings span eight countries (PT, AR, US, ES, ET, TN, CH, BG) and at least six identifiable sectors, with manufacturing (4 listings), healthcare (2 listings), and technology (1 listing) among the named organizations, plus energy/utilities and retail/e-commerce.

Named organizations include Texcar Inc., GPIC Projectos Con Instalacoes Lda, Asisken Asistencia Médica S.A., Adirondack Networks Inc., Arthritis Center of Riverside, Horn of Africa Regional Environment Centre and Network, PROTEX Confection, SunTechnics Fabrisolar AG, and Performance Ford Inc, alongside six listings published only as "Company #105" through "#110" — anonymized entries typically used to pressure victims mid-negotiation.

Key point for defenders: every listing below is a claim by a criminal actor, not a confirmed breach. But claim volume at this tempo is itself a leading indicator — organizations in manufacturing and healthcare, particularly those with European, Latin American, or North African footprints, should treat this window as elevated-risk and run the hunts in this briefing.

Sourcing & Verification

• Of the 18 listings monitored on N0N's leak site in the last 100 postings, 17 were independently observed by a second leak-site crawler (multi-source); 1 appears on a single source only. Multi-source observation confirms the gang published the claim — nothing more.
• Inclusion in this briefing reflects the threat actor's assertion and is NOT confirmation of a breach. No tier of leak-site monitoring data can confirm a compromise; only the named organization or its regulator can do that.
• A named organization may dispute the listing. A denial is likewise not proof the claim is false — disclosure obligations vary by jurisdiction and not every incident is reportable, so neither silence nor denial settles the question.
• Security Arsenal will publish corrections to this briefing as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — N0N

Aliases / naming. N0N (also referenced in underground chatter with stylized variants of the name) maintains a dedicated Tor-based leak site and operates with the disciplined posting cadence typical of mid-tier but operationally mature crews.

Operating model. N0N's behavior — anonymized "Company #NNN" placeholder listings, sequenced public naming, and multi-country victimology — is consistent with a closed or semi-closed RaaS operation using a small number of vetted affiliates rather than an open marketplace. The numbered-placeholder pattern is a negotiation lever: victims are named publicly only after talks stall.

Ransom demands. Based on sector mix (mid-market manufacturing, regional healthcare providers, auto retail), demands are assessed to fall in the low-to-mid seven-figure USD range, scaled to victim revenue — the classic mid-market extortion sweet spot where paying is painful but cheaper than prolonged downtime.

Initial access methods (assessed, based on ecosystem chatter and tooling overlap):

• Exploitation of internet-facing edge devices and virtualization management planes
• Phishing with macro-enabled lures and malicious IDE/tooling extensions targeting developers
• RDP brute force and purchased access from initial access brokers (IABs)
• Supply-chain/developer-workflow compromise (see CVE section)

Extortion model. Double extortion: data theft precedes encryption, with leak-site publication as the pressure mechanism. The anonymized-then-named posting sequence observed this week is textbook N0N escalation.

Dwell time. Crews of this profile typically operate with 5–14 days of dwell time between initial access and detonation — long enough that the staging indicators in the Detection Engineering section below are genuinely huntable.

Current Campaign Analysis

Sector targeting. The named listings break down as: Manufacturing (Texcar Inc.; GPIC Projectos Con Instalacoes Lda; PROTEX Confection), Healthcare (Asisken Asistencia Médica S.A.; Arthritis Center of Riverside), Technology (Adirondack Networks, Inc.), Energy & Utilities (SunTechnics Fabrisolar AG), Retail & E-Commerce (Performance Ford Inc), and Other (Horn of Africa Regional Environment Centre and Network), plus six unattributed "Company" placeholders. Manufacturing and healthcare dominance is consistent with N0N's preference for downtime-intolerant sectors where operational pressure maximizes payment likelihood.

Geographic concentration. Unusually dispersed: PT, AR, US, ES, ET, TN, CH, BG. The US and Iberian/Latin American cluster (PT, ES, AR) accounts for the majority of named listings. The inclusion of ET, TN, and BG suggests opportunistic exploitation of perimeter exposure rather than region-specific tooling.

Victim profile. Named organizations skew toward mid-market enterprises — regional manufacturers, specialty medical practices, a Ford dealership, a Swiss solar engineering firm — typically in the tens-to-hundreds-of-millions USD revenue band. These are organizations large enough to pay meaningful ransoms but frequently below the security-maturity threshold of enterprise SOCs.

Posting tempo / escalation. 15 listings across 2026-10-22 through 2026-10-24 in a single observable window, with six anonymized placeholders posted 2026-10-22/23 and named organizations following 2026-10-23/24. This pattern indicates batched detonations followed by staged public pressure — expect the "Company #NNN" entries to resolve to named organizations within days if negotiations fail.

CVE correlation (hypothesis only). We have no evidence tying any specific named listing to a specific vulnerability. However, N0N's assessed access methods overlap heavily with the current CISA KEV ransomware-exploited set, and defenders in the targeted sectors should treat the following as priority exposure hypotheses:

• CVE-2026-59310 (VMware vCenter path traversal, KEV 2026-08-18) — vCenter compromise is a direct path to hypervisor-level encryption, the highest-impact ransomware outcome. Manufacturing and healthcare environments with flat virtualization estates are primary candidates.
• CVE-2026-50751 (Check Point Security Gateway improper authentication, KEV 2026-06-08) — VPN/edge-device exploitation matches N0N's perimeter-access pattern.
• CVE-2026-20316 (Cisco Secure FMC hard-coded password, KEV 2026-07-29) — firewall management plane compromise enables both access and defense-blinding.
• CVE-2026-63077 (JetBrains TeamCity deserialization, KEV 2026-08-05) and CVE-2026-48027 (Nx Console embedded malicious code, KEV 2026-05-27) — developer-infrastructure and supply-chain vectors; notable given the technology-sector listing and the gang's macro/dev-tooling phishing tradecraft.

Detection Engineering

The following detections target the TTP cluster associated with N0N's playbook: edge/VPN exploitation, macro execution, RDP abuse, PsExec/WMI lateral movement, Cobalt Strike-style beaconing, and pre-encryption data staging.

---
title: N0N Ransomware - Macro Execution Spawning Scripting or LOLBin Child Processes
id: 8f3a1c2e-n0n1-4a5b-9c1d-000000000001
status: experimental
description: Detects Office macro execution spawning scripting engines, PowerShell, or LOLBins - consistent with N0N phishing lure execution chains.
author: Security Arsenal Threat Intelligence
references:
    - https://securityarsenal.com/darkside
logsource:
    category: process_creation
    product: windows
level: high
date: 2026/10/24
detection:
    selection_parent:
        ParentImage|endswith:
            - '\winword.exe'
            - '\excel.exe'
            - '\powerpnt.exe'
            - '\outlook.exe'
    selection_child:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\certutil.exe'
            - '\bitsadmin.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Rare legitimate Office automation; baseline per OU
---
title: N0N Ransomware - PsExec or WMI Remote Service Creation for Lateral Movement
id: 8f3a1c2e-n0n1-4a5b-9c1d-000000000002
status: experimental
description: Detects remote service installation and WMI process execution patterns used by N0N affiliates for lateral movement prior to detonation.
author: Security Arsenal Threat Intelligence
references:
    - https://securityarsenal.com/darkside
logsource:
    category: process_creation
    product: windows
level: high
date: 2026/10/24
detection:
    selection_psexec:
        Image|endswith:
            - '\psexec.exe'
            - '\psexesvc.exe'
        CommandLine|contains:
            - ' -s '
            - 'accepteula'
    selection_wmi:
        ParentImage|endswith: '\wmiprvse.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\rundll32.exe'
    selection_svc:
        EventID: 7045
        ServiceFileName|contains:
            - 'ADMIN$'
            - '\\'
            - '%COMSPEC%'
    condition: selection_psexec or selection_wmi or selection_svc
falsepositives:
    - Legitimate administrative tooling; correlate with admin change windows
---
title: N0N Ransomware - Pre-Encryption Data Staging and Shadow Copy Manipulation
id: 8f3a1c2e-n0n1-4a5b-9c1d-000000000003
status: experimental
description: Detects volume shadow copy deletion and mass archive creation indicative of N0N pre-detection exfiltration staging and anti-recovery activity.
author: Security Arsenal Threat Intelligence
references:
    - https://securityarsenal.com/darkside
logsource:
    category: process_creation
    product: windows
level: critical
date: 2026/10/24
detection:
    selection_vss:
        Image|endswith:
            - '\vssadmin.exe'
            - '\wmic.exe'
            - '\bcdedit.exe'
            - '\wbadmin.exe'
        CommandLine|contains:
            - 'delete shadows'
            - 'shadowcopy delete'
            - 'recoveryenabled no'
            - 'delete catalog'
    selection_archive:
        Image|endswith:
            - '\rar.exe'
            - '\7z.exe'
            - '\winrar.exe'
        CommandLine|contains:
            - ' a '
            - '-p'
            - '-hp'
    condition: selection_vss or selection_archive
falsepositives:
    - Backup administrators; alert on any hit outside approved maintenance accounts

// N0N Campaign Hunt: Pre-ransomware staging + lateral movement chain (7-day window)
// Looks for: suspicious auth from edge/VPN-adjacent sources -> new service install or remote exec -> archive tool execution -> shadow copy tampering
let lookback = 7d;
let StagingHosts =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName in~ ("rar.exe","7z.exe","winrar.exe")
       or (ProcessCommandLine has_any ("delete shadows","shadowcopy delete","recoveryenabled no","delete catalog"))
    | summarize StagingFirstSeen=min(TimeGenerated), StagingCmds=make_set(ProcessCommandLine) by DeviceName, InitiatingProcessAccountName;
let LateralHosts =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where (FileName =~ "psexec.exe" or InitiatingProcessFileName =~ "wmiprvse.exe")
       and ProcessCommandLine has_any ("-s","accepteula","cmd","powershell")
    | summarize LateralFirstSeen=min(TimeGenerated) by DeviceName;
StagingHosts
| join kind=inner LateralHosts on DeviceName
| extend ChainWindow = datetime_diff('minute', StagingFirstSeen, LateralFirstSeen)
| project DeviceName, InitiatingProcessAccountName, LateralFirstSeen, StagingFirstSeen, ChainWindow, StagingCmds
| order by LateralFirstSeen asc;

# N0N Rapid Triage Script - Run on critical servers & hypervisor hosts
# Checks: recently added scheduled tasks (7d), shadow copy tampering, exposed RDP, suspicious services
$ErrorActionPreference = 'SilentlyContinue'
$cutoff = (Get-Date).AddDays(-7)
Write-Output "=== [1] Scheduled tasks created in last 7 days ==="
Get-ScheduledTask | Where-Object { $_.Date -gt $cutoff } |
    Select-Object TaskName, TaskPath, Date, @{N='Action';E={$_.Actions.Execute}} |
    Format-Table -AutoSize

Write-Output "=== [2] Volume Shadow Copies present? ==="
$shadows = Get-WmiObject Win32_ShadowCopy
if (-not $shadows) { Write-Output "WARNING: No shadow copies found - possible anti-recovery tampering" }
else { $shadows | Select-Object DeviceObject, InstallDate | Format-Table -AutoSize }

Write-Output "=== [3] RDP exposure check ==="
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections
Write-Output ("RDP Enabled (0=enabled): " + $rdp.fDenyTSConnections)
Get-NetTCPConnection -LocalPort 3389 -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Format-Table -AutoSize

Write-Output "=== [4] Services installed in last 7 days (PsExec-style persistence) ==="
Get-CimInstance Win32_Service | Where-Object { $_.PathName -match 'ADMIN\$|%COMSPEC%|Temp' } |
    Select-Object Name, DisplayName, State, PathName | Format-Table -AutoSize

Write-Output "=== [5] Recent large archive files in user/temp dirs (staging indicator) ==="
Get-ChildItem -Path C:\Users,C:\Windows\Temp -Recurse -Include *.rar,*.7z,*.zip -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt $cutoff -and $_.Length -gt 100MB } |
    Select-Object FullName, LastWriteTime, @{N='SizeMB';E={[math]::Round($_.Length/1MB)}} | Format-Table -AutoSize

Incident Response Priorities

T-minus detection checklist (pre-encryption):

• New or anomalous authentications to VPN/edge appliances (especially Check Point IKEv1 paths per CVE-2026-50751) followed by internal SMB/RDP fan-out
• vCenter logins from non-jump-host sources or service-account anomalies (CVE-2026-59310 exposure)
• Archive tooling (rar/7z) executing on file servers, especially with password flags
• vssadmin delete shadows, bcdedit ... recoveryenabled no, or wbadmin delete catalog — treat any hit as a potential active intrusion, not a false positive
• TeamCity/build-server anomalies (CVE-2026-63077) and unexpected IDE extension behavior in developer fleets (CVE-2026-48027)
• New scheduled tasks or services referencing temp paths, ADMIN$, or %COMSPEC%

Assets N0N-profile crews prioritize for exfiltration:

• Finance/ERP exports, payroll, and HR records (leverage for double extortion)
• Healthcare: patient records and imaging archives (regulatory pressure multiplier)
• Manufacturing: CAD/PLM data, process documentation, and OT-adjacent file shares
• Legal/contract repositories and cyber-insurance policy documents (used to calibrate demands)

Containment actions, ordered by urgency:

1. Isolate affected VLANs/hosts at the switch level — do NOT power off (preserve volatile memory for forensics)
2. Disable compromised accounts and force enterprise-wide credential resets, starting with domain admins and service accounts
3. Block egress to known exfil endpoints; enable TLS inspection alerting on high-volume outbound transfers
4. Snapshot/preserve hypervisor state and VPN/firewall logs before any patching wipes artifacts
5. If detonation is imminent: sever vCenter-to-host management paths to prevent hypervisor-wide encryption
6. Engage IR retainer and legal/comms counsel before any threat-actor contact

Hardening Recommendations

Immediate (24 hours):

• Patch or isolate systems exposed to CVE-2026-59310 (vCenter), CVE-2026-50751 (Check Point), and CVE-2026-20316 (Cisco FMC) — all KEV-confirmed ransomware vectors; if patching is impossible this weekend, ACL management interfaces to jump hosts only
• Disable Office macros from internet-sourced files via GPO (Mark of the Web enforcement)
• Enforce MFA on all remote access (VPN, RDP gateways, vCenter/SSO); block RDP from the internet entirely
• Deploy the Sigma rules above to your SIEM and run the KQL hunt across the last 14 days
• Verify shadow copies exist and are protected on file servers; enable tamper protection on backup agents

Short-term (2 weeks):

• Segment virtualization management planes (vCenter, backup consoles) onto isolated networks with dedicated admin workstations (PAWs)
• Implement application allow-listing blocking rar/7z execution for non-admin users
• Deploy deception canaries (honey credentials, decoy file shares) tuned to alert on lateral movement
• Audit developer infrastructure: patch TeamCity (CVE-2026-63077), inventory IDE extensions against the Nx Console compromise pattern (CVE-2026-48027), and enforce signed-extension policies
• Move backups to immutable/object-lock storage with offline copies, and rehearse hypervisor-level restore

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub